fix publish id traversal, and status redirect