Merge pull request #262 from Islandora/DonRichards-patch-1

As it's been weeks since approval and Diego removed his block, and since we have no better suggestions coming in, I'm going to merge this. If someone has a strong objection when it gets into the wild, we can talk about reverting, but having a fix that doesn't address all possible cases is better than not fixing at all.

api/XMLDocument.inc

@@ -141,7 +141,7 @@ class XMLDocument {
     $document = $this->createDOMDocument();
     // Load from XML or create the root node.
     isset($xml) ?
-        $document->loadXML($xml) :
+        $document->loadXML(islandora_sanitize_input_for_valid_xml($xml)) :
         $document->appendChild(new DOMElement($root_name, NULL, $namespaces->getDefaultURI()));
     $this->namespaces->addNamespacesAttributesTo($document->documentElement);
     return $document;

api/XMLFormProcessor.inc

@@ -46,7 +46,7 @@ class XMLFormProcessAction {
   public function __construct(ActionInterface $action, FormElement $element, $value = NULL) {
     $this->action = $action;
     $this->element = $element;
-    $this->value = $value;
+    $this->value = islandora_sanitize_input_for_valid_xml($value);
   }
 
   /**

builder/includes/datastream.form.inc

@@ -155,6 +155,7 @@ function xml_form_builder_datastream_form_metadata_form(array $form, array &$for
   $form['update'] = array(
     '#type' => 'submit',
     '#value' => t('Update'),
+    '#suffix' => '<div class="updatewarning"><span class="warning" title="Warning">' . t('All hidden characters will be filtered and not saved.') . '</span></div>',
     '#name' => 'update',
     '#submit' => array('xml_form_builder_datastream_form_metadata_form_submit'),
   );