Fixed raw XSS attack