Select widget prone to double encoding

Problem/Motivation

This is coming from #1665818: Ampersands and other characters are not displayed correctly in <select> widgets in the Entity reference queue but the bug reported there can be found in core now that ER is in core.

When implementing hook_options_list() and passing the options through check_plain(), any options with ampersands or < and > symbols end up double encoded in select widgets.

Quoting Damien Tournoud in #1665818-19: Ampersands and other characters are not displayed correctly in <select> widgets:

Core does a strip_tags() without a decode_entities()

Proposed resolution

Add decode_entities() to the strip_tags block in _options_prepare_options().

Remaining tasks

• Needs tests.
• Update taxonomy module so the term reference field does a check_plain() in its hook_options_list() implementation?

User interface changes

n/a

API changes

TBD

Potentially related issues

• #1261474: Special characters in list field Allowed Values List