XSS vulnerability when displaying list of revisions or individual

This module has a XSS vulnerability. This is mitigated by the fact that the user requires the "administer views" permission which is a restricted permission.

You can see this vulnerability by:
1. Enabling the module
2. As a user with "administer views" permission create a new view.
3. Modify the view and save a revision with a message something like <script>alert("Cookie" + document.cookie);</script>
4. View all revisions for the view at admin/structure/views/revisions/[name of view]
5. View the problematic revision at admin/structure/views/revisions/revision/1
6. 4 and 5 both display the log message unfiltered.

I believe the solution is to pass $revision->log through filter_xss() the two times it is used, once in views_revisions_page(), once in views_revisions_revision_page().