Index: includes/common.inc
===================================================================
RCS file: /cvs/drupal/drupal/includes/common.inc,v
retrieving revision 1.394.2.12
diff -u -p -r1.394.2.12 common.inc
--- includes/common.inc	2 Dec 2005 10:30:27 -0000	1.394.2.12
+++ includes/common.inc	13 Mar 2006 21:25:13 -0000
@@ -945,7 +945,7 @@ function format_name($object) {
       $name = $object->name;
     }
 
-    $output = l($name, 'user/'. $object->uid, array('title' => t('View user profile.')));
+    $output = l(check_plain($name), 'user/'. $object->uid, array('title' => t('View user profile.')));
   }
   else if ($object->name) {
     // Sometimes modules display content composed by people who are
@@ -953,10 +953,10 @@ function format_name($object) {
     // aggregator modules). This clause enables modules to display
     // the true author of the content.
     if ($object->homepage) {
-      $output = '<a href="'. $object->homepage .'">'. $object->name .'</a>';
+      $output = '<a href="'. check_url($object->homepage) .'">'. check_plain($object->name) .'</a>';
     }
     else {
-      $output = $object->name;
+      $output = check_plain($object->name);
     }
 
     $output .= ' ('. t('not verified') .')';
Index: modules/book.module
===================================================================
RCS file: /cvs/drupal/drupal/modules/book.module,v
retrieving revision 1.262.2.4
diff -u -p -r1.262.2.4 book.module
--- modules/book.module	23 Jan 2005 22:39:24 -0000	1.262.2.4
+++ modules/book.module	13 Mar 2006 21:25:13 -0000
@@ -412,7 +412,7 @@ function book_view(&$node, $teaser = FAL
   $node = book_content($node, $teaser);
 
   if (!$teaser && $node->moderate) {
-    $node->body .= '<div class="log"><div class="title">'. t('Log') .':</div>'. $node->log .'</div>';
+    $node->body .= '<div class="log"><div class="title">'. t('Log') .':</div>'. check_output($node->log, $node->format) .'</div>';
   }
 }
 
Index: themes/engines/xtemplate/xtemplate.engine
===================================================================
RCS file: /cvs/drupal/drupal/themes/engines/xtemplate/Attic/xtemplate.engine,v
retrieving revision 1.6.2.2
diff -u -p -r1.6.2.2 xtemplate.engine
--- themes/engines/xtemplate/xtemplate.engine	24 Dec 2004 06:40:12 -0000	1.6.2.2
+++ themes/engines/xtemplate/xtemplate.engine	13 Mar 2006 21:25:14 -0000
@@ -179,7 +179,7 @@ function xtemplate_page($content, $title
 
   // only parse the mission block if we are on the frontpage ...
   if ($_GET["q"] == variable_get("site_frontpage", "node") && theme_get_setting('toggle_mission') && ($mission = theme_get_setting('mission'))) {
-    $xtemplate->template->assign("mission", $mission);
+    $xtemplate->template->assign("mission", filter_xss($mission));
     $xtemplate->template->parse("header.mission");
   }