check_plain (for menu title and description) is of course right and important, but ignores that it is possible to use HTML in a vocabulary/term description (which I do intensively to make result pages look even nice without using "views").

Please excuse that since this is my first report ever and I am currently heavily involved in a huge project, I am yet only "leeching" but not ready to learn the CVS instructions, so I simply post the necessary changes here, hopefully someone would patch it. It is really simply done:

in function _taxonomy_menu_save:

replace

'options' => array('attributes' => array('title' => trim($item['description'])
  ? check_plain($item['description']) : check_plain($item['name']))),

with

'options' => array('attributes' => array('title' => trim($item['description'])
  ? check_plain(strip_tags($item['description'])) : check_plain(strip_tags($item['name'])))),

Thanks for your great work anyway!

Comments

indytechcook’s picture

Status: Active » Closed (duplicate)
doitDave’s picture

Great - looking forward to an "official" fix (for my part, it now works fine). :-)