Fix #11299: Custom menu links should be sanitised before output

If an administrator defines custom menu links (consisting of a caption
and URL) then these values should be escaped of special HTML characters
before being printed into the menu. This XSS issue is of no security
concern as it requires administrator access and manual modifications to
the configuration file.

Co-contributed-by: David Hicks <hickseydr@optusnet.com.au>
Signed-off-by: David Hicks <hickseydr@optusnet.com.au>

core/html_api.php

@@ -694,8 +694,8 @@ function prepare_custom_menu_options( $p_config ) {
 	foreach( $t_custom_menu_options as $t_custom_option ) {
 		$t_access_level = $t_custom_option[1];
 		if( access_has_project_level( $t_access_level ) ) {
-			$t_caption = lang_get_defaulted( $t_custom_option[0] );
-			$t_link = $t_custom_option[2];
+			$t_caption = string_html_specialchars( lang_get_defaulted( $t_custom_option[0] ) );
+			$t_link = string_attribute( $t_custom_option[2] );
 			$t_options[] = "<a href=\"$t_link\">$t_caption</a>";
 		}
 	}