switch to using sanitize() instead of h() to escape message bodies. This
is not quite as safe as there is no guarantee that the HTML scanner it
uses will find everything, but is does allow benign HTML tags to be
displayed again.
has decided to report this XSS problem to a public mailing list. Unfortunately
it means that some functionality (links in messages etc) has been lost for now.
that we aren't duplicating everything in the user controller.
This also makes per-user RSS feeds work, and makes links to specific posts
work properly so that the RSS feeds behave sensibly.
