unsanitized input bugfix. credit to irving ruan for the catch
Merge remote-tracking branch 'origin/develop' into develop