fix a xss bug for admin