diff --git a/modes/binary.inc b/modes/binary.inc index c8db783..6d61eb9 100644 --- a/modes/binary.inc +++ b/modes/binary.inc @@ -41,7 +41,7 @@ function advpoll_voting_binary_form(&$form_state, $node, $teaser, $page, $status foreach ($node->choice as $i => $choice) { // Don't show blank choices or write-in votes if the setting is disabled. if ($choice['label'] && ($node->show_writeins || !$choice['writein'])) { - $list[$i] = _advpoll_choice_markup($choice['label'], $node->format, $check) . ($choice['writein'] ? ' ' . t('(write-in)') : ''); + $list[$i] = _advpoll_choice_markup(filter_xss($choice['label']), $node->format, $check) . ($choice['writein'] ? ' ' . t('(write-in)') : ''); } } // Add write-in checkbox/radio if write-ins are enabled and user has permission. @@ -185,7 +185,7 @@ function advpoll_view_results_binary($node, $teaser, $page) { foreach ($votes as $i => $count) { $choice = $node->choice[$i]; $percentage = floor(100 * $votes[$i] / $total_votes); - $output .= theme('advpoll_bar', _advpoll_choice_markup($choice['label'], $node->format, FALSE), $percentage, format_plural($count, '1 vote', '@count votes'), $choice); + $output .= theme('advpoll_bar', _advpoll_choice_markup(filter_xss($choice['label']), $node->format, FALSE), $percentage, format_plural($count, '1 vote', '@count votes'), $choice); } } diff --git a/modes/ranking.inc b/modes/ranking.inc index b796f73..7316d3e 100644 --- a/modes/ranking.inc +++ b/modes/ranking.inc @@ -267,7 +267,7 @@ function advpoll_view_results_ranking($node, $teaser, $page) { // Loop through all choices with this ranking. foreach ($ranking[$i]->choices as $choice) { - $label = isset($node->choice[$choice]) ? _advpoll_choice_markup($node->choice[$choice]['label'], $node->format, FALSE) . ($node->choice[$choice]['writein'] ? ' ' . t('(write-in)') : '') : t('(deleted)'); + $label = isset($node->choice[$choice]) ? _advpoll_choice_markup(filter_xss($node->choice[$choice]['label']), $node->format, FALSE) . ($node->choice[$choice]['writein'] ? ' ' . t('(write-in)') : '') : t('(deleted)'); $this_rank .= ($first_one ? '' : ', ') . $label; $first_one = FALSE; } @@ -285,7 +285,7 @@ function advpoll_view_results_ranking($node, $teaser, $page) { // Loop through all choices with this ranking. foreach ($ranking[$i]->choices as $choice) { - $label = isset($node->choice[$choice]) ? _advpoll_choice_markup($node->choice[$choice]['label'], $node->format, FALSE) . ($node->choice[$choice]['writein'] ? ' ' . t('(write-in)') : '') : t('(deleted)'); + $label = isset($node->choice[$choice]) ? _advpoll_choice_markup(filter_xss($node->choice[$choice]['label']), $node->format, FALSE) . ($node->choice[$choice]['writein'] ? ' ' . t('(write-in)') : '') : t('(deleted)'); $output .= ($first_one ? '' : ', ') . $label; $first_one = FALSE; }