? storm--899970-10.patch
? storm--899970-4.patch
? storm--918750-5.patch
? storm--924002-11.patch
Index: storm.module
===================================================================
RCS file: /cvs/drupal-contrib/contributions/modules/storm/storm.module,v
retrieving revision 1.10.4.61
diff -u -p -r1.10.4.61 storm.module
--- storm.module	21 Sep 2010 22:27:07 -0000	1.10.4.61
+++ storm.module	27 Nov 2010 14:20:17 -0000
@@ -700,6 +700,11 @@ function storm_icon_l($icon, $path, $tit
 
 function storm_icon($icon, $title) {
   global $base_path;
+
+  // Running checkplain on these variables means that we can call storm_icon without further sanitising
+  $icon = check_plain($icon);
+  $title = check_plain($title);
+
   $icon = str_replace(' ', '_', $icon);
 
   if (variable_get('storm_icons_display', TRUE) == TRUE) {
Index: stormtask/stormtask.theme.inc
===================================================================
RCS file: /cvs/drupal-contrib/contributions/modules/storm/stormtask/stormtask.theme.inc,v
retrieving revision 1.3.4.28
diff -u -p -r1.3.4.28 stormtask.theme.inc
--- stormtask/stormtask.theme.inc	27 Oct 2010 13:47:33 -0000	1.3.4.28
+++ stormtask/stormtask.theme.inc	27 Nov 2010 14:20:26 -0000
@@ -25,9 +25,9 @@ function theme_stormtask_tasks($form) {
 
     $data = array(
       theme('indentation', $form['tasks'][$key]['task_depth_'. $key]['#value']) . drupal_render($form['tasks'][$key]['task_description_'. $key]),
-      check_markup(drupal_render($form['tasks'][$key]['task_category_'. $key])),
-      check_markup(drupal_render($form['tasks'][$key]['task_status_'. $key])),
-      check_markup(drupal_render($form['tasks'][$key]['task_priority_'. $key])),
+      drupal_render($form['tasks'][$key]['task_category_'. $key]),
+      drupal_render($form['tasks'][$key]['task_status_'. $key]),
+      drupal_render($form['tasks'][$key]['task_priority_'. $key]),
       array(
         'data' => sprintf('%.2f', drupal_render($form['tasks'][$key]['task_duration_'. $key])) .' '. substr($durationunit, 0, 1), 
         'style' => 'text-align: right'),