Prevent XSS in unknown tool display, update to actually use show_error_message instead of replying with plain text.
Merge.
Another instance of tool_id reflected xss (in data_source_redirect).
Merge.
Merge next stable.