fixed exploit without whitelist