/controllers/ & /lib/: fixed a security bug with search