Index: webform.install
===================================================================
RCS file: /cvs/drupal-contrib/contributions/modules/webform/webform.install,v
retrieving revision 1.60
diff -u -p -r1.60 webform.install
--- webform.install	17 Oct 2010 21:12:21 -0000	1.60
+++ webform.install	18 Nov 2010 23:01:19 -0000
@@ -27,11 +27,10 @@ function webform_schema() {
         'not null' => TRUE,
       ),
       'confirmation_format' => array(
-        'description' => 'The input format used by the confirmation message.',
-        'type' => 'int',
-        'size' => 'tiny',
-        'not null' => TRUE,
-        'default' => 0,
+        'description' => 'The {filter_format}.format of the confirmation message.',
+        'type' => 'varchar',
+        'length' => 255,
+        'not null' => FALSE,
       ),
       'redirect_url' => array(
         'description' => 'The URL a user is redirected to after submitting a form.',
@@ -456,3 +455,40 @@ function webform_update_7305() {
     db_change_field('webform', 'additional_submit', 'additional_submit', array('type' => 'text', 'not null' => FALSE));
   }
 }
+
+/**
+ * Update the confirmation_format column for default text format changes.
+ */
+function webform_update_7306() {
+  // These changes are modeled after user_update_7010().
+  db_change_field('webform', 'confirmation_format', 'confirmation_format', array(
+    'description' => 'The {filter_format}.format of the confirmation message.',
+    'type' => 'int',
+    'unsigned' => TRUE,
+    'not null' => FALSE,
+  ));
+  db_update('webform')
+    ->fields(array('confirmation_format' => NULL))
+    ->condition('confirmation', '')
+    ->condition('confirmation_format', 0)
+    ->execute();
+  $existing_formats = db_query("SELECT format FROM {filter_format}")->fetchCol();
+  $default_format = variable_get('filter_default_format', 1);
+  db_update('webform')
+    ->fields(array('confirmation_format' => $default_format))
+    ->isNotNull('confirmation_format')
+    ->condition('confirmation_format', $existing_formats, 'NOT IN')
+    ->execute();
+}
+
+/**
+ * Update the confirmation_format column to allow it to store strings.
+ */
+function webform_update_7307() {
+  db_change_field('webform', 'confirmation_format', 'confirmation_format', array(
+    'description' => 'The {filter_format}.format of the confirmation message.',
+    'type' => 'varchar',
+    'length' => 255,
+    'not null' => FALSE,
+  ));
+}
Index: webform.module
===================================================================
RCS file: /cvs/drupal-contrib/contributions/modules/webform/webform.module,v
retrieving revision 1.269
diff -u -p -r1.269 webform.module
--- webform.module	5 Nov 2010 01:05:53 -0000	1.269
+++ webform.module	18 Nov 2010 23:01:20 -0000
@@ -1010,7 +1010,7 @@ function webform_node_delete($node) {
 function webform_node_defaults() {
   return array(
     'confirmation' => '',
-    'confirmation_format' => filter_default_format(),
+    'confirmation_format' => NULL,
     'redirect_url' => '<confirmation>',
     'teaser' => 0,
     'block' => 0,
@@ -2255,7 +2255,7 @@ function webform_client_form_submit($for
   }
   // If redirecting and we have a confirmation message, show it as a message.
   elseif (!$external_url && (!empty($redirect_url) && $redirect_url != '<confirmation>') && !empty($confirmation)) {
-    drupal_set_message(check_markup($confirmation, $node->webform['confirmation_format'], FALSE));
+    drupal_set_message(check_markup($confirmation, $node->webform['confirmation_format'], '', TRUE));
   }
 
   $form_state['redirect'] = $redirect;
@@ -2345,7 +2345,7 @@ function template_preprocess_webform_for
  * Prepare for theming of the webform submission confirmation.
  */
 function template_preprocess_webform_confirmation(&$vars) {
-  $confirmation = check_markup($vars['node']->webform['confirmation'], $vars['node']->webform['confirmation_format'], FALSE);
+  $confirmation = check_markup($vars['node']->webform['confirmation'], $vars['node']->webform['confirmation_format'], '', TRUE);
   // Strip out empty tags added by WYSIWYG editors if needed.
   $vars['confirmation_message'] = strlen(trim(strip_tags($confirmation))) ? $confirmation : '';
 }
@@ -2727,7 +2727,7 @@ function _webform_filter_values($string,
  * Filters all special tokens provided by webform, and allows basic layout in descriptions.
  */
 function _webform_filter_descriptions($string, $node = NULL, $submission = NULL) {
-  return strlen($string) == 0 ? '' : check_markup(_webform_filter_values($string, $node, $submission, NULL, FALSE));
+  return strlen($string) == 0 ? '' : _webform_filter_xss(_webform_filter_values($string, $node, $submission, NULL, FALSE));
 }
 
 /**
Index: components/markup.inc
===================================================================
RCS file: /cvs/drupal-contrib/contributions/modules/webform/components/markup.inc,v
retrieving revision 1.21
diff -u -p -r1.21 markup.inc
--- components/markup.inc	18 Oct 2010 07:21:10 -0000	1.21
+++ components/markup.inc	18 Nov 2010 23:01:20 -0000
@@ -17,7 +17,7 @@ function _webform_defaults_markup() {
     'weight' => 0,
     'value' => '',
     'extra' => array(
-      'format' => filter_default_format(),
+      'format' => NULL,
     ),
   );
 }
@@ -33,7 +33,7 @@ function _webform_edit_markup($component
     '#default_value' => $component['value'],
     '#description' => t('Markup allows you to enter custom HTML or PHP logic into your form.') . theme('webform_token_help'),
     '#weight' => -1,
-    '#format' => $component['extra']['format'],
+    '#format' => isset($component['extra']['format']) ? $component['extra']['format'] : NULL,
     '#element_validate' => array('_webform_edit_markup_validate'),
   );
 
@@ -62,7 +62,7 @@ function _webform_render_markup($compone
     '#type' => 'markup',
     '#title' => $filter ? NULL : $component['name'],
     '#weight' => $component['weight'],
-    '#markup' => $filter ? _webform_filter_values(check_markup($component['value'], $component['extra']['format'], FALSE), NULL, NULL, NULL, FALSE) : $component['value'],
+    '#markup' => $filter ? _webform_filter_values(check_markup($component['value'], $component['extra']['format'], '', TRUE), NULL, NULL, NULL, FALSE) : $component['value'],
     '#input_format' => $component['extra']['format'],
     '#theme_wrappers' => array('webform_element'),
     '#webform_component' => $component,
Index: includes/webform.pages.inc
===================================================================
RCS file: /cvs/drupal-contrib/contributions/modules/webform/includes/webform.pages.inc,v
retrieving revision 1.18
diff -u -p -r1.18 webform.pages.inc
--- includes/webform.pages.inc	17 Oct 2010 18:53:13 -0000	1.18
+++ includes/webform.pages.inc	18 Nov 2010 23:01:20 -0000
@@ -40,7 +40,7 @@ function webform_configure_form($form, &
     '#default_value' => $node->webform['confirmation'],
     '#cols' => 40,
     '#rows' => 10,
-    '#format' => $node->webform['confirmation_format'],
+    '#format' => isset($node->webform['confirmation_format']) ? $node->webform['confirmation_format'] : NULL,
     '#parents' => array('confirmation'),
   );