fixed xss bug
Merge branch 'feature/security' into develop