Parameter whitelisting fix + touchz()

Of course, I know my original comment also have typo :(