#242873 by pwolanin and bjaspan: Make drupal_set_title() do check_plain() by default.

includes/batch.inc

@@ -80,10 +80,10 @@ function _batch_start() {
 function _batch_progress_page_js() {
   $batch = batch_get();
 
-  // The first batch set gets to set the page title
-  // and the initialization and error messages.
+  // The first batch set gets to set the page title and the initialization and
+  // error messages. Only safe strings should be passed in to batch_set().
   $current_set = _batch_current_set();
-  drupal_set_title($current_set['title']);
+  drupal_set_title($current_set['title'], PASS_THROUGH);
   drupal_add_js('misc/progress.js', 'core', 'header', FALSE, FALSE);
 
   $url = url($batch['url'], array('query' => array('id' => $batch['id'])));
@@ -126,7 +126,7 @@ function _batch_progress_page_nojs() {
   $batch =& batch_get();
   $current_set = _batch_current_set();
 
-  drupal_set_title($current_set['title']);
+  drupal_set_title($current_set['title'], PASS_THROUGH);
 
   $new_op = 'do_nojs';
 

includes/common.inc

@@ -24,6 +24,27 @@
  */
 define('SAVED_DELETED', 3);
 
+/**
+ * @name Title text filtering flags
+ * @{
+ * Flags for use in drupal_set_title().
+ */
+
+/**
+ * Flag for drupal_set_title(); text is not sanitized, so run check_plain().
+ */
+define('CHECK_PLAIN', 0);
+
+/**
+ * Flag for drupal_set_title(); text has already been sanitized.
+ */
+define('PASS_THROUGH', -1);
+
+/**
+ * @} End of "Title text filtering flags".
+ */
+
+
 /**
  * Set content for a specified region.
  *
@@ -750,7 +771,7 @@ function fix_gpc_magic() {
  *   to escape HTML characters. Use this for any output that's displayed within
  *   a Drupal page.
  *   @code
- *     drupal_set_title($title = t("@name's blog", array('@name' => $account->name)));
+ *     drupal_set_title($title = t("@name's blog", array('@name' => $account->name)), PASS_THROUGH);
  *   @endcode
  *
  * - %variable, which indicates that the string should be HTML escaped and

includes/form.inc

@@ -2379,6 +2379,11 @@ function form_clean_id($id = NULL, $flush = FALSE) {
  * batch_process();
  * @endcode
  *
+ * Note - if the batch 'title', 'init_message', 'progress_message',
+ * or 'error_message' could contain any user input, it is the responsibility of
+ * the code calling batch_set() to sanitize them first with a function like
+ * check_plain() or filter_xss().
+ *
  * Sample batch operations:
  * @code
  * // Simple and artificial: load a node of a given type for a given user

includes/path.inc

@@ -196,15 +196,20 @@ function drupal_get_title() {
  * @param $title
  *   Optional string value to assign to the page title; or if set to NULL
  *   (default), leaves the current title unchanged.
+ * @param $output
+ *   Optional flag - normally should be left as CHECK_PLAIN. Only set to
+ *   PASS_THROUGH if you have already removed any possibly dangerous code
+ *   from $title using a function like check_plain() or filter_xss(). With this
+ *   flag the string will be passed through unchanged.
  *
  * @return
  *   The updated title of the current page.
  */
-function drupal_set_title($title = NULL) {
+function drupal_set_title($title = NULL, $output = CHECK_PLAIN) {
   static $stored_title;
 
   if (isset($title)) {
-    $stored_title = $title;
+    $stored_title = ($output == PASS_THROUGH) ? $title : check_plain($title);
   }
   return $stored_title;
 }

modules/aggregator/aggregator.pages.inc

@@ -37,7 +37,7 @@ function aggregator_page_source($arg1, $arg2 = NULL) {
   // $arg1 is $form_state and $arg2 is $feed. Otherwise, $arg1 is $feed.
   $feed = is_array($arg2) ? $arg2 : $arg1;
   $feed = (object)$feed;
-  drupal_set_title(check_plain($feed->title));
+  drupal_set_title($feed->title);
   $feed_source = theme('aggregator_feed_source', $feed);
 
   // It is safe to include the fid in the query because it's loaded from the

modules/block/block.admin.inc

@@ -174,7 +174,7 @@ function block_admin_configure(&$form_state, $module = NULL, $delta = 0) {
   // Get the block subject for the page title.
   $info = module_invoke($module, 'block', 'list');
   if (isset($info[$delta])) {
-    drupal_set_title(t("'%name' block", array('%name' => $info[$delta]['info'])));
+    drupal_set_title(t("'%name' block", array('%name' => $info[$delta]['info'])), PASS_THROUGH);
   }
 
   // Standard block configurations.

modules/blog/blog.pages.inc

@@ -12,7 +12,7 @@
 function blog_page_user($account) {
   global $user;
 
-  drupal_set_title($title = t("@name's blog", array('@name' => $account->name)));
+  drupal_set_title($title = t("@name's blog", array('@name' => $account->name)), PASS_THROUGH);
 
   $items = array();
 

modules/book/book.admin.inc

@@ -70,7 +70,7 @@ function book_admin_settings_validate($form, &$form_state) {
  * @ingroup forms.
  */
 function book_admin_edit($form_state, $node) {
-  drupal_set_title(check_plain($node->title));
+  drupal_set_title($node->title);
   $form = array();
   $form['#node'] = $node;
   _book_admin_table($node, $form);

modules/book/book.pages.inc

@@ -90,7 +90,7 @@ function book_export_html($nid) {
  * Menu callback; show the outline form for a single node.
  */
 function book_outline($node) {
-  drupal_set_title(check_plain($node->title));
+  drupal_set_title($node->title);
   return drupal_get_form('book_outline_form', $node);
 }
 

modules/comment/comment.module

@@ -1442,7 +1442,7 @@ function comment_form_box($edit, $title = NULL) {
 function comment_form_add_preview($form, &$form_state) {
   global $user;
   $edit = $form_state['values'];
-  drupal_set_title(t('Preview comment'));
+  drupal_set_title(t('Preview comment'), PASS_THROUGH);
   $output = '';
   $node = node_load($edit['nid']);
 

modules/contact/contact.pages.inc

@@ -164,7 +164,7 @@ function contact_user_page($account) {
     $output = t("You cannot send more than %number messages per hour. Please try again later.", array('%number' => variable_get('contact_hourly_threshold', 3)));
   }
   else {
-    drupal_set_title(check_plain($account->name));
+    drupal_set_title($account->name);
     $output = drupal_get_form('contact_mail_user', $account);
   }
 

modules/filter/filter.admin.inc

@@ -94,7 +94,7 @@ function theme_filter_admin_overview($form) {
  */
 function filter_admin_format_page($format = NULL) {
   if (!isset($format->name)) {
-    drupal_set_title(t("Add input format"));
+    drupal_set_title(t('Add input format'), PASS_THROUGH);
     $format = (object)array('name' => '', 'roles' => '', 'format' => '');
   }
   return drupal_get_form('filter_admin_format_form', $format);
@@ -302,7 +302,7 @@ function filter_admin_delete_submit($form, &$form_state) {
  * Menu callback; display settings defined by a format's filters.
  */
 function filter_admin_configure_page($format) {
-  drupal_set_title(t("Configure %format", array('%format' => $format->name)));
+  drupal_set_title(t("Configure %format", array('%format' => $format->name)), PASS_THROUGH);
   return drupal_get_form('filter_admin_configure', $format);
 }
 
@@ -343,7 +343,7 @@ function filter_admin_configure_submit($form, &$form_state) {
  * Menu callback; display form for ordering filters for a format.
  */
 function filter_admin_order_page($format) {
-  drupal_set_title(t("Rearrange %format", array('%format' => $format->name)));
+  drupal_set_title(t("Rearrange %format", array('%format' => $format->name)), PASS_THROUGH);
   return drupal_get_form('filter_admin_order', $format);
 }
 

modules/forum/forum.module

@@ -723,7 +723,7 @@ function template_preprocess_forums(&$variables) {
     }
   }
   drupal_set_breadcrumb($breadcrumb);
-  drupal_set_title(check_plain($title));
+  drupal_set_title($title);
 
   if ($variables['forums_defined'] = count($variables['forums']) || count($variables['parents'])) {
     // Format the "post new content" links listing.
@@ -784,7 +784,7 @@ function template_preprocess_forums(&$variables) {
 
   }
   else {
-    drupal_set_title(t('No forums defined'));
+    drupal_set_title(t('No forums defined'), PASS_THROUGH);
     $variables['links'] = array();
     $variables['forums'] = '';
     $variables['topics'] = '';

modules/node/node.module

@@ -1142,7 +1142,7 @@ function node_build_content($node, $teaser = FALSE, $page = FALSE) {
  */
 function node_show($node, $cid, $message = FALSE) {
   if ($message) {
-    drupal_set_title(t('Revision of %title from %date', array('%title' => $node->title, '%date' => format_date($node->revision_timestamp))));
+    drupal_set_title(t('Revision of %title from %date', array('%title' => $node->title, '%date' => format_date($node->revision_timestamp))), PASS_THROUGH);
   }
   $output = node_view($node, FALSE, TRUE);
 
@@ -1857,7 +1857,7 @@ function node_page_default() {
  * Menu callback; view a single node.
  */
 function node_page_view($node, $cid = NULL) {
-  drupal_set_title(check_plain($node->title));
+  drupal_set_title($node->title);
   return node_show($node, $cid);
 }
 

modules/node/node.pages.inc

@@ -11,7 +11,7 @@
  * Menu callback; presents the node editing form, or redirects to delete confirmation.
  */
 function node_page_edit($node) {
-  drupal_set_title(check_plain($node->title));
+  drupal_set_title($node->title);
   return drupal_get_form($node->type . '_node_form', $node);
 }
 
@@ -59,7 +59,7 @@ function node_add($type) {
     // Initialize settings:
     $node = array('uid' => $user->uid, 'name' => (isset($user->name) ? $user->name : ''), 'type' => $type, 'language' => '');
 
-    drupal_set_title(t('Create @name', array('@name' => $types[$type]->name)));
+    drupal_set_title(t('Create @name', array('@name' => $types[$type]->name)), PASS_THROUGH);
     $output = drupal_get_form($type . '_node_form', $node);
   }
 
@@ -381,7 +381,7 @@ function node_preview($node) {
       $cloned_node->build_mode = NODE_BUILD_PREVIEW;
       $output = theme('node_preview', $cloned_node);
     }
-    drupal_set_title(t('Preview'));
+    drupal_set_title(t('Preview'), PASS_THROUGH);
 
     return $output;
   }
@@ -504,7 +504,7 @@ function node_delete_confirm_submit($form, &$form_state) {
  * Generate an overview table of older revisions of a node.
  */
 function node_revision_overview($node) {
-  drupal_set_title(t('Revisions for %title', array('%title' => $node->title)));
+  drupal_set_title(t('Revisions for %title', array('%title' => $node->title)), PASS_THROUGH);
 
   $header = array(t('Revision'), array('data' => t('Operations'), 'colspan' => 2));
 

modules/openid/openid.pages.inc

@@ -28,7 +28,7 @@ function openid_authentication_page() {
  * Menu callback; Manage OpenID identities for the specified user.
  */
 function openid_user_identities($account) {
-  drupal_set_title(check_plain($account->name));
+  drupal_set_title($account->name);
   drupal_add_css(drupal_get_path('module', 'openid') . '/openid.css', 'module');
 
   // Check to see if we got a response

modules/path/path.admin.inc

@@ -66,7 +66,7 @@ function path_admin_overview($keys = NULL) {
 function path_admin_edit($pid = 0) {
   if ($pid) {
     $alias = path_load($pid);
-    drupal_set_title(check_plain($alias['dst']));
+    drupal_set_title($alias['dst']);
     $output = drupal_get_form('path_admin_form', $alias);
   }
   else {

modules/poll/poll.pages.inc

@@ -28,7 +28,7 @@ function poll_page() {
  * Callback for the 'votes' tab for polls you can see other votes on
  */
 function poll_votes($node) {
-  drupal_set_title(check_plain($node->title));
+  drupal_set_title($node->title);
   $output = t('This table lists all the recorded votes for this poll. If anonymous users are allowed to vote, they will be identified by the IP address of the computer they used when they voted.');
 
   $header[] = array('data' => t('Visitor'), 'field' => 'u.name');
@@ -51,7 +51,7 @@ function poll_votes($node) {
  * Callback for the 'results' tab for polls you can vote on
  */
 function poll_results($node) {
-  drupal_set_title(check_plain($node->title));
+  drupal_set_title($node->title);
   $node->show_results = TRUE;
   return node_show($node, 0);
 }

modules/profile/profile.admin.inc

@@ -175,7 +175,7 @@ function profile_field_form(&$form_state, $arg = NULL) {
         drupal_not_found();
         return;
       }
-      drupal_set_title(t('edit %title', array('%title' => $edit['title'])));
+      drupal_set_title(t('edit %title', array('%title' => $edit['title'])), PASS_THROUGH);
       $form['fid'] = array('#type' => 'value',
         '#value' => $fid,
       );
@@ -193,7 +193,7 @@ function profile_field_form(&$form_state, $arg = NULL) {
       return;
     }
     $type = $arg;
-    drupal_set_title(t('add new %type', array('%type' => $types[$type])));
+    drupal_set_title(t('add new %type', array('%type' => $types[$type])), PASS_THROUGH);
     $edit = array('name' => 'profile_');
     $form['type'] = array('#type' => 'value', '#value' => $type);
   }

modules/profile/profile.pages.inc

@@ -73,7 +73,7 @@ function profile_browse() {
       $title = check_plain($field->page);
     }
 
-    drupal_set_title($title);
+    drupal_set_title($title, PASS_THROUGH);
     return $output;
   }
   else if ($name && !$field->fid) {
@@ -99,7 +99,7 @@ function profile_browse() {
     $output = theme('profile_wrapper', $content);
     $output .= theme('pager', NULL, 20);
 
-    drupal_set_title(t('User list'));
+    drupal_set_title(t('User list'), PASS_THROUGH);
     return $output;
   }
 }