security fixes for create quote