This module was doing some extra (unnecessary) filtering which caused html characters to be double escaped - e.g. & turned into &.

To reproduce this and make sure it's still "safe" try entering text like <script>alert('nodes link text');</script>& into the "Nodes: Link text:" or "Title text:".

There was also a problem with the menu type of the new menu entry and an unnecessary variable assignment in an if statement, which I cleaned up.

Comments

todd nienkerk’s picture

Status: Needs review » Closed (won't fix)

Committed and released as 6.x-1.5.

todd nienkerk’s picture

Status: Closed (won't fix) » Fixed

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.