fix host in path attack