default theme's REQUEST_URI should be attribute_escape (d)

[whooami]

Unescaped, same as what was just fixed in 2.2.x but not yet in RC3.

<form style="display:inline;" method="post" name="hicolor" id="hicolor" action="<?php echo $_SERVER['REQUEST_URI']; ?>">

I thought you were continuing to support this branch.

[Otto42]

The change is in trac: [5680], but doesn't seem to have made it into the ZIP file on the release archive page. Don't know why, but I think that RC3 just needs to be rebuilt from SVN or something. Or go to RC4.

[Cimmo]

well if it's enough to rebuilt from SVN why we are still here with RC3?

[Nazgul]

Fixed by r5680.

[Cimmo]

So? 2.0.11rc3 still hasn't the fix

[rob1n]

The 2.0.11 final will have it.