2 files changed, 24 insertions(+), 5 deletions(-)

diff --git a/includes/common.inc b/includes/common.inc
index d7189ab..9eb54dd 100644
--- a/includes/common.inc
+++ b/includes/common.inc
@@ -1318,6 +1318,8 @@ function filter_xss_admin($string) {
  *   cause an XSS attack.
  * @param $allowed_tags
  *   An array of allowed tags.
+ * @param $display
+ *   Boolean flag, if true unallowed HTML will be encoded and displayed.
  *
  * @return
  *   An XSS safe version of $string, or an empty string if $string is not
@@ -1326,7 +1328,7 @@ function filter_xss_admin($string) {
  * @see drupal_validate_utf8()
  * @ingroup sanitization
  */
-function filter_xss($string, $allowed_tags = array('a', 'em', 'strong', 'cite', 'blockquote', 'code', 'ul', 'ol', 'li', 'dl', 'dt', 'dd')) {
+function filter_xss($string, $allowed_tags = array('a', 'em', 'strong', 'cite', 'blockquote', 'code', 'ul', 'ol', 'li', 'dl', 'dt', 'dd'), $display = FALSE) {
   // Only operate on valid UTF-8 strings. This is necessary to prevent cross
   // site scripting issues on Internet Explorer 6.
   if (!drupal_validate_utf8($string)) {
@@ -1349,6 +1351,8 @@ function filter_xss($string, $allowed_tags = array('a', 'em', 'strong', 'cite',
   // Named entities
   $string = preg_replace('/&([A-Za-z][A-Za-z0-9]*;)/', '&\1', $string);
 
+  $callback = $display ? '_filter_xss_split_display' : '_filter_xss_split';
+
   return preg_replace_callback('%
     (
     <(?=[^a-zA-Z!/])  # a lone <
@@ -1358,7 +1362,11 @@ function filter_xss($string, $allowed_tags = array('a', 'em', 'strong', 'cite',
     <[^>]*(>|$)       # a string that starts with a <, up until the > or the end of the string
     |                 # or
     >                 # just a >
-    )%x', '_filter_xss_split', $string);
+    )%x', $callback, $string);
+}
+
+function _filter_xss_split_display($m, $store = FALSE) {
+  _filter_xss_split($m, $store, TRUE);
 }
 
 /**
@@ -1374,7 +1382,7 @@ function filter_xss($string, $allowed_tags = array('a', 'em', 'strong', 'cite',
  *   If the element isn't allowed, an empty string. Otherwise, the cleaned up
  *   version of the HTML element.
  */
-function _filter_xss_split($m, $store = FALSE) {
+function _filter_xss_split($m, $store = FALSE, $display = FALSE) {
   static $allowed_html;
 
   if ($store) {
@@ -1409,7 +1417,12 @@ function _filter_xss_split($m, $store = FALSE) {
 
   if (!isset($allowed_html[strtolower($elem)])) {
     // Disallowed HTML element
-    return '';
+    if ($display) {
+      return check_plain('<'. $elem . $attrlist .'>');
+    }
+    else {
+      return '';
+    }
   }
 
   if ($comment) {
diff --git a/modules/filter/filter.module b/modules/filter/filter.module
index 66fadcb..6a5b98c 100644
--- a/modules/filter/filter.module
+++ b/modules/filter/filter.module
@@ -1157,6 +1157,7 @@ function filter_filter_info() {
     'default settings' => array(
       'allowed_html' => '<a> <em> <strong> <cite> <blockquote> <code> <ul> <ol> <li> <dl> <dt> <dd>',
       'filter_html_help' => 1,
+      'filter_html_display' => 0,
       'filter_html_nofollow' => 0,
     ),
     'tips callback' => '_filter_html_tips',
@@ -1208,6 +1209,11 @@ function _filter_html_settings($form, &$form_state, $filter, $format, $defaults)
     '#title' => t('Display basic HTML help in long filter tips'),
     '#default_value' => $filter->settings['filter_html_help'],
   );
+  $settings['filter_html_display'] = array(
+    '#type' => 'checkbox',
+    '#title' => t('Display unallowed HTML tags not listed above as plain text'),
+    '#default_value' => $filter->settings['filter_html_display'],
+  );
   $settings['filter_html_nofollow'] = array(
     '#type' => 'checkbox',
     '#title' => t('Add rel="nofollow" to all links'),
@@ -1221,7 +1227,7 @@ function _filter_html_settings($form, &$form_state, $filter, $format, $defaults)
  */
 function _filter_html($text, $filter) {
   $allowed_tags = preg_split('/\s+|<|>/', $filter->settings['allowed_html'], -1, PREG_SPLIT_NO_EMPTY);
-  $text = filter_xss($text, $allowed_tags);
+  $text = filter_xss($text, $allowed_tags, TRUE);
 
   if ($filter->settings['filter_html_nofollow']) {
     $html_dom = filter_dom_load($text);