The bug and the fix were reported by https://hackerone.com/pnoltof
Attach a file by drag & drop or click to upload
