check_plain (for menu title and description) is of course right and important, but ignores that it is possible to use HTML in a vocabulary/term description (which I do intensively to make result pages look even nice without using "views").
Please excuse that since this is my first report ever and I am currently heavily involved in a huge project, I am yet only "leeching" but not ready to learn the CVS instructions, so I simply post the necessary changes here, hopefully someone would patch it. It is really simply done:
in function _taxonomy_menu_save:
replace
'options' => array('attributes' => array('title' => trim($item['description'])
? check_plain($item['description']) : check_plain($item['name']))),
with
'options' => array('attributes' => array('title' => trim($item['description'])
? check_plain(strip_tags($item['description'])) : check_plain(strip_tags($item['name'])))),
Thanks for your great work anyway!
Comments
Comment #1
indytechcook CreditAttribution: indytechcook commentedThanks Dave. I'm combining your suggestions with #799428: Generated menu item title contains unencoded html special characters being that they are related (http://drupal.org/node/799428#comment-3149440).
Comment #2
doitDave CreditAttribution: doitDave commentedGreat - looking forward to an "official" fix (for my part, it now works fine). :-)