- sa-2006-002: XSS issues with username log and mission

includes/theme.inc

@@ -958,7 +958,7 @@ function theme_username($object) {
       $output = l($name, 'user/'. $object->uid, array('title' => t('View user profile.')));
     }
     else {
-      $output = $name;
+      $output = check_plain($name);
     }
   }
   else if ($object->name) {
@@ -967,10 +967,10 @@ function theme_username($object) {
     // aggregator modules). This clause enables modules to display
     // the true author of the content.
     if ($object->homepage) {
-      $output = '<a href="'. $object->homepage .'">'. $object->name .'</a>';
+      $output = l($object->name, $object->homepage);
     }
     else {
-      $output = $object->name;
+      $output = check_plain($object->name);
     }
 
     $output .= ' ('. t('not verified') .')';

themes/engines/phptemplate/phptemplate.engine

@@ -143,7 +143,7 @@ function phptemplate_page($content) {
 
   /* Set title and breadcrumb to declared values */
   if (drupal_get_path_alias($_GET['q']) == variable_get('site_frontpage', 'node')) {
-    $mission = theme_get_setting('mission');
+    $mission = filter_xss(theme_get_setting('mission'));
   }
 
   /* Add favicon */