Whitelist allowed filters in /user (s1).
Properly escape discussion name in dashboard summaries (s5).