access callbacks, filter external data

The menu item access callbacks should use the "access content" permission rather than just TRUE.

There's a lot of text that comes from external sources and then gets stored and displayed without any filtering. From a security perspective, that information should be filtered on output.

I don't see a specific issue unless someone can alter the data coming in from the soap service so this doesn't need to block the application, but before making a release I suggest going through and adding check_plain or filter_xss appropriately. See http://drupal.org/writing-secure-code for details.