patched security vulnerability in ajax function