Not sure if $taboo was getting sanitized or not. Possibly an SQL injection vulnerability that allows maliciously crafted group names to inject SQL at a later date when the group CP is loaded. Unconfirmed, theoretical fix.

     1

// UK lang variables

     2

     3

tinyMCE.addToLang('',{

     4

fullscreen_desc : 'Toggle fullscreen mode'

     5

});