Index: modules/node/node.module
===================================================================
RCS file: /cvs/drupal/drupal/modules/node/node.module,v
retrieving revision 1.947.2.11
diff -u -p -r1.947.2.11 node.module
--- modules/node/node.module	25 Jun 2008 08:59:57 -0000	1.947.2.11
+++ modules/node/node.module	27 Jan 2009 21:26:51 -0000
@@ -1677,10 +1677,25 @@ function node_feed($nids = FALSE, $chann
         $item = node_prepare($item, $teaser);
       }
 
-      // Allow modules to change $node->teaser before viewing.
+      // Allow modules to change $node->content before the node is rendered.
       node_invoke_nodeapi($item, 'view', $teaser, FALSE);
     }
 
+    // Set the proper node property, then unset unused $node property so that a
+    // bad theme can not open a security hole.
+    $content = drupal_render($node->content);
+    if ($teaser) {
+      $node->teaser = $content;
+      unset($node->body);
+    }
+    else {
+      $node->body = $content;
+      unset($node->teaser);
+    }
+  
+    // Allow modules to modify the fully-built node.
+    node_invoke_nodeapi($node, 'alter', $teaser, FALSE);
+
     // Allow modules to add additional item fields and/or modify $item
     $extra = node_invoke_nodeapi($item, 'rss item');
     $extra = array_merge($extra, array(array('key' => 'pubDate', 'value' => gmdate('r', $item->created)), array('key' => 'dc:creator', 'value' => $item->name), array('key' => 'guid', 'value' => $item->nid .' at '. $base_url, 'attributes' => array('isPermaLink' => 'false'))));