Revert 'Allow filter by child terms', only line to keep is the one that prevents XSS