XSS security issue

This was reported to the security team by grendzy, but the module has since been abandoned. Noting the issue and patch here so that it can be fixed if the project is ever rehabilitated.

Steps to reproduce:
-- Create a vocab with script in name and help text
-- Enable vocab on /admin/settings/user_tags
-- Navigate to /user/1/edit/tags
-- Navigate to /user/1
-- Navigate to /tags
-- Navigate to /tag/user/1

Index: user_tags.module
===================================================================
RCS file: /cvs/drupal-contrib/contributions/modules/user_tags/user_tags.module,v
retrieving revision 1.15.4.1
diff -u -p -r1.15.4.1 user_tags.module
--- user_tags.module 4 Mar 2009 20:27:28 -0000 1.15.4.1
+++ user_tags.module 20 Oct 2009 04:48:04 -0000
@@ -188,7 +188,7 @@ function user_tags_page_list() {
     foreach ($tid as $term_tid => $term_name) {
       $rows[] = array(l($term_name, "tag/user/$term_tid"));
     }
-    $output .= theme('table', array(t('Tags')), $rows, array(), $vocabs[$vid]->name);
+    $output .= theme('table', array(t('Tags')), $rows, array(), check_plain($vocabs[$vid]->name));
   }

   return $output;
@@ -210,7 +210,7 @@ function user_tags_page_users($tid) {
     drupal_goto('tags');
   }
   else {
-    drupal_set_title($term->name);
+    drupal_set_title(check_plain($term->name));
     $result = db_query('SELECT tu.tid, td.name as termname, u.uid, u.name as username FROM {users} u INNER JOIN {term_user} t ON u.uid = t.uid
                         AND t.tid = %d INNER JOIN {term_user} tu ON u.uid = tu.uid INNER JOIN {term_data} td ON td.tid = tu.tid
                         ORDER BY u.name, td.weight, td.name', $tid);
@@ -292,7 +292,7 @@ function user_tags_form_tags($category,

       $typed_string = implode(', ', $typed_terms) . (array_key_exists('tags', $terms) ? $terms['tags'][$vocabulary->vid] : NULL);
       if ($vocabulary->help) {
-        $help = $vocabulary->help;
+        $help = filter_xss_admin($vocabulary->help);
       }
       else {
         $help = t('A comma-separated list of terms describing this content.  Example: funny, bungee jumping, "Company, Inc.".');
@@ -317,7 +317,7 @@ function user_tags_form_tags($category,
         }
       }

-      $form['taxonomy']['tags'][$vocabulary->vid] = taxonomy_form($vocabulary->vid, array_keys($default_terms), $vocabulary->help);
+      $form['taxonomy']['tags'][$vocabulary->vid] = taxonomy_form($vocabulary->vid, array_keys($default_terms), filter_xss_admin($vocabulary->help));
       $form['taxonomy']['tags'][$vocabulary->vid]['#weight'] = $vocabulary->weight;
       $form['taxonomy']['tags'][$vocabulary->vid]['#required'] = $vocabulary->required;
     }
@@ -432,7 +432,7 @@ function user_tags_view_tags($account) {
   );
   foreach ($list as $key => $terms) {
     $account->content['tags']['vid-'.$key] = array(
-      '#title' => $vocs[$key]->name,
+      '#title' => check_plain($vocs[$key]->name),
       '#type' => 'user_profile_item',
       '#value' => implode(', ', $terms)
     );