This is a Drupal 8 followup for the security issue fixed here: http://drupal.org/SA-CORE-2013-002
Credit for the patch/fix: Damien Tournoud, pwolanin, David_Rothstein, Heine, Bèr Kessels
Drupal 7 patch is here: http://drupalcode.org/project/drupal.git/patch/3a24da1b40f5e05876ad77750...