? BODY-AS-FIELD.patch
? FIELD-TO-COLUMN-PARTIAL.patch
? Makefile
? constants.pl
? d6-50-nodes.sql.gz
? d7-50-nodes.sql.gz
? head.kpf
? patches
? modules/field/field.delete.inc
? modules/field/modules/combo
? scripts/generate-autoload.pl
? sites/all/modules/cck
? sites/all/modules/devel
? sites/all/modules/pbs
? sites/all/modules/taint
? sites/default/files
? sites/default/settings.php
Index: modules/field/modules/options/options.module
===================================================================
RCS file: /cvs/drupal/drupal/modules/field/modules/options/options.module,v
retrieving revision 1.5
diff -u -F^[fc] -r1.5 options.module
--- modules/field/modules/options/options.module	12 Apr 2009 02:18:51 -0000	1.5
+++ modules/field/modules/options/options.module	22 May 2009 15:59:34 -0000
@@ -194,6 +194,17 @@ function options_select_process($element
   }
 
   $options = options_options($field, $instance);
+
+  // The custom list of allowed values for list fields can include
+  // HTML, which will be displayed normally (after filter_xss
+  // sanitization) by the radios / checkboxes widgets. The select
+  // widget, however, needs to filter this HTML out.  However, the
+  // entities need to be left unencoded.  theme('select') will call
+  // check_plain() on both the key and value, so if we do not decode
+  // entities in the values here, they will end up double-encoded and
+  // the user will see the encoded form.
+  $options = array_map(create_function('$opt', 'return html_entity_decode(strip_tags($opt), ENT_QUOTES);'), $options);
+
   $element[$field_key] = array(
     '#type' => 'select',
     '#title' => $element['#title'],