Yeah it does work because of the check I added in core. I also added a check so you can't set the parent to itself to prevent it happening again.
" within category-descriptions/-titles
It seems like
"results in some issues if it gets used within category-description or -title because it doesn't get escaped when showing within admin-page even so it works correct on user-scope.
"><a>test</a>within the description or title...
Looks like we need
data.title = validator.sanitize(data.title).escape();like we do for topic titles.