fixed a security leak on admin