fixed: security fix in update.inc.php