in function station_archive_arg_program_nid_handler($op, &$query, $argtype, $arg = '') in archive/views.inc

case 'title':
$node = db_fetch_object(db_query("SELECT sap.title FROM {station_archive_program} sap WHERE sap.program_nid=%d", $query));
changed
//return check_plain($node->title);
to
return $node->title;

As function format_rss_channel applies check_plain to the title already.

CommentFileSizeAuthor
#2 station-check_plain.patch497 bytesdarrick

Comments

drewish’s picture

drewish commented
Status: Active » Needs work

could you roll a patch?

darrick’s picture

darrick commented
StatusFileSize
new station-check_plain.patch497 bytes

Here is a patch to the cvs.

vladimir.dolgopolov’s picture

vladimir.dolgopolov commented

I don't think it was a good idea to remove check_plain().
Now I can enter a title like this:

alert('XSS');

We need here another decision.

damienmckenna’s picture

damienmckenna
Location TN, USA
commented
Status: Needs work » Closed (won't fix)

The Drupal 5 versions are no longer supported, if someone would like to step up to co-maintain it then please do so, otherwise future work will only happen for D6 and D7. Thank you.