plugged request file security hole