From 589073078db9fd1561df14d77321c8aa00e2ed63 Mon Sep 17 00:00:00 2001
From: Brion Vibber <brion@users.mediawiki.org>
Date: Sat, 30 Apr 2005 08:04:02 +0000
Subject: [PATCH] * (bug 1877) JavaScript error in page editing in some
 localizations Add wfEscapeJsString() function to do proper escaping of
 JavaScript string literals.

---
 includes/EditPage.php        |  5 +++--
 includes/GlobalFunctions.php | 24 ++++++++++++++++++++++++
 includes/Linker.php          |  6 +++---
 3 files changed, 30 insertions(+), 5 deletions(-)

diff --git a/includes/EditPage.php b/includes/EditPage.php
index 7f042cafec..4f3d6333d5 100644
--- a/includes/EditPage.php
+++ b/includes/EditPage.php
@@ -1028,7 +1028,7 @@ END
 			$image=$wgStylePath.'/common/images/'.$tool['image'];
 			$open=$tool['open'];
 			$close=$tool['close'];
-			$sample = addslashes( $tool['sample'] );
+			$sample = wfEscapeJsString( $tool['sample'] );
 
 			// Note that we use the tip both for the ALT tag and the TITLE tag of the image.
 			// Older browsers show a "speedtip" type message only for ALT.
@@ -1041,7 +1041,8 @@ END
 			$toolbar.="addButton('$image','$tip','$open','$close','$sample');\n";
 		}
 
-		$toolbar.="addInfobox('" . addslashes( wfMsg( "infobox" ) ) . "','" . addslashes(wfMsg("infobox_alert")) . "');\n";
+		$toolbar.="addInfobox('" . wfEscapeJsString( wfMsg( "infobox" ) ) .
+			"','" . wfEscapeJsString( wfMsg( "infobox_alert" ) ) . "');\n";
 		$toolbar.="document.writeln(\"</div>\");\n";
 
 		$toolbar.="/*]]>*/\n</script>";
diff --git a/includes/GlobalFunctions.php b/includes/GlobalFunctions.php
index 61a6abc455..59be1218d8 100644
--- a/includes/GlobalFunctions.php
+++ b/includes/GlobalFunctions.php
@@ -673,6 +673,30 @@ function wfQuotedPrintable( $string, $charset = '' ) {
 	return $out;
 }
 
+/**
+ * Returns an escaped string suitable for inclusion in a string literal
+ * for JavaScript source code.
+ * Illegal control characters are assumed not to be present.
+ *
+ * @param string $string
+ * @return string
+ */
+function wfEscapeJsString( $string ) {
+	// See ECMA 262 section 7.8.4 for string literal format
+	$pairs = array(
+		"\\" => "\\\\",
+		"\"" => "\\\"",
+		"\'" => "\\\'",
+		"\n" => "\\n",
+		"\r" => "\\r",
+		
+		# To avoid closing the element or CDATA section
+		"<" => "\\x3c",
+		">" => "\\x3e",
+	);
+	return strtr( $string, $pairs );
+}
+
 /**
  * @todo document
  * @return float
diff --git a/includes/Linker.php b/includes/Linker.php
index c65aa6d180..c0bff50b6b 100644
--- a/includes/Linker.php
+++ b/includes/Linker.php
@@ -719,13 +719,13 @@ class Linker {
 	/** @todo document */
 	function tocList($toc) {
 		return "<table id='toc' class='toc'><tr><td>" 
-			   . "<div id='toctitle'><h2>" . wfMsg('toc') . "</h2></div>\n"
+			   . "<div id='toctitle'><h2>" . wfMsgForContent('toc') . "</h2></div>\n"
 		     . $toc
 				 . "</ul>\n</td></tr></table>\n"
 				 . '<script type="text/javascript">'
 				 . ' if (window.showTocToggle) {'
-				 . ' var tocShowText = "' . addslashes( wfMsg('showtoc') ) . '";'
-				 . ' var tocHideText = "' . addslashes( wfMsg('hidetoc') ) . '"; '
+				 . ' var tocShowText = "' . wfEscapeJsString( wfMsgForContent('showtoc') ) . '";'
+				 . ' var tocHideText = "' . wfEscapeJsString( wfMsgForContent('hidetoc') ) . '";'
 				 . ' showTocToggle();'
 				 . ' } '
 				 . "</script>\n";
-- 
2.20.1