Issue #1363358 by David_Rothstein: Fixed Shortcut set titles are double-escaped with check_plain().

2 files changed, 25 insertions, 3 deletions

diff --git a/CHANGELOG.txt b/CHANGELOG.txt
index 4f58527e2..26f193178 100644
--- a/CHANGELOG.txt
+++ b/CHANGELOG.txt
@@ -1,6 +1,10 @@
 
 Drupal 7.16, xxxx-xx-xx (development version)
 -----------------------
+- Fixed a bug which caused shortcut set titles to be double-escaped. The fix
+  replaces the "Edit shortcuts" menu item's title callback entry in hook_menu()
+  with a new function that does not escape HTML characters (data structure
+  change).
 - Modified the Update manager module to allow drupal.org to collect usage
   statistics for individual modules and themes, rather than only for entire
   projects.
diff --git a/modules/shortcut/shortcut.module b/modules/shortcut/shortcut.module
index 4c67a1416..71284bb84 100644
--- a/modules/shortcut/shortcut.module
+++ b/modules/shortcut/shortcut.module
@@ -86,7 +86,7 @@ function shortcut_menu() {
     'title' => 'Edit shortcuts',
     'page callback' => 'drupal_get_form',
     'page arguments' => array('shortcut_set_customize', 4),
-    'title callback' => 'shortcut_set_title',
+    'title callback' => 'shortcut_set_title_callback',
     'title arguments' => array(4),
     'access callback' => 'shortcut_set_edit_access',
     'access arguments' => array(4),
@@ -735,9 +735,15 @@ function shortcut_toolbar_pre_render($toolbar) {
 }
 
 /**
- * Returns the title of a shortcut set.
+ * Returns the sanitized title of a shortcut set.
  *
- * Title callback for the editing pages for shortcut sets.
+ * Deprecated. This function was previously used as a menu item title callback
+ * but has been replaced by shortcut_set_title_callback() (which does not
+ * sanitize the title, since the menu system does that automatically). In
+ * Drupal 7, use that function for title callbacks, and call check_plain()
+ * directly if you need a sanitized title. In Drupal 8, this function will be
+ * restored as a title callback and therefore will no longer sanitize its
+ * output.
  *
  * @param $shortcut_set
  *   An object representing the shortcut set, as returned by
@@ -747,3 +753,15 @@ function shortcut_set_title($shortcut_set) {
   return check_plain($shortcut_set->title);
 }
 
+/**
+ * Returns the title of a shortcut set.
+ *
+ * Title callback for the editing pages for shortcut sets.
+ *
+ * @param $shortcut_set
+ *   An object representing the shortcut set, as returned by
+ *   shortcut_set_load().
+ */
+function shortcut_set_title_callback($shortcut_set) {
+  return $shortcut_set->title;
+}