fix xss leak
Merge pull request #1726 from joshuaruesweg/patch-24

fix xss leak