Data passed to the echo module should be sanitized and protected against external exploits.

It has been reported that the Echo module has a security vulnerability in that it allows an external hacker to craft a URL that causes the target site to display arbitrary data, without limitation.

Since receiving and responding to the original security team report, I have not heard from them in a long time, and I have since lost the original email and thus have no way to update the official report.

Therefore, I have fixed the issue on my own as follows:

1. All $_REQUEST data is now sanitized by filter_xss().
2. The echo_themed_page() function now stores a hash of its arguments in the cache. The _echo_access() function checks for the existence of this cache entry ensure that the request was indeed generated by echo_themed_page() and not by an external source.

This means that the Echo module now depends on a working cache implementation.