XSS vulnerability in administrative interface

Problem/Motivation

From the original report by @mr.baileys:

apologies, I found another XSS issue, this time in the Authcache Block submodule.

Create a custom block, embed <script> as part of the description, make sure the block is authcache-enabled, and visit admin/config/system/authcache/p13n (the markup substitution page). The script will be executed.

It's Less Critical, since it requires "Administer Blocks" to be exploited, but since core filters a block's description, and since "administer blocks" is not a restricted permission, it's probably best to fix it.

The same issue exists in Authcache Views (human readable view name) and Authcache Field (field label).

Proposed resolution

Use check_plain()

Remaining tasks

User interface changes

API changes

Data model changes