merge some security fixes from rogerroger288