A) Preparation: 1. As admin, go to mod_resource and mod_url admin settings and enable the "in frame" display format. B) Without the patch applied: 1. Create "File" resource with title = name" onmouseover="javascript:alert('hey') and set the display format to "in frame". Upload image file as attachment. 2. View the activity and hover the frames, you should get the "hey" alert. 3. View html source and confirm that the frame has the onmouseover injected together with the title attribute (don't confuse it with the <title> tag, it's the "title" attribute of the 2nd frame. 4. Repeat previous steps (1-3) for a "URL" resource. 5. Repeat above steps with display format = Embed. C) With the patch applied: 1. Visit the "File" resource created in B), and hover the frames. Now you should NOT get the "hey" alert anymore. 2. View the html source and confirm that the double quotes in the tittle attribute are now escaped, hence now everything is the title (no onmouseover injection anymore). 3. Repeat previous steps (1-2) for the existing "URL" resource. 4. Repeat above steps with display format = Embed. That's all!