Security: XSS can be injected in the group edit view