MSA-20-0015: Chapter name in book not always escaped with forceclean enabled
It was possible to include JavaScript in a book's chapter title, which was not escaped on the "Add new chapter" page.
Note: By default this functionality is only available to trusted users (such as teachers), but has been included as a security issue as a precaution, since it was not sanitized on sites with forceclean...