patch (r708231: Possible security issue because pipline can be set by the 'pipeline' request parameter)