XSS vulnerability when users create polls

This should have been submitted as a security report!

greggles reminded me that only modules with stable releases (which this doesn't have) are covered by the security procedures, all others should be handled via issues in the respective issue queues. I apologize for jumping the gun.

re #2 - that's only partially accurate. The Security Team does appreciate getting issues reported in private first, but in cases where the policy says it can be fixed in public it's an acceptable (but not preferred) practice to just report the issue in public. By reporting it to the private security.drupal.org tracker it is possible for the maintainer to get some level of advanced warning so they can prepare a fix quickly before the issue is public to the whole world.

Relevant issue: #939032: Roll out a release of Advanced Poll for D6 and avoid confusion about different D6 branches (6.x-1.x, 6.x-2.x and 6.x-3.x)

However by looking at that issue it would seem unlikely to be resolved any time soon.

Following is the patch for 7.x-3.x-dev.

Rerolling the patch to work with current state of 7.x-3.x branch.
It works for me.

Thank you!