Add escaping necessary to deal with tips and example text that contain apostrophes...

diff --git a/includes/Skin.php b/includes/Skin.php
index 9e45784..a163ad0 100644 (file)
--- a/includes/Skin.php
+++ b/includes/Skin.php
@@ -2340,17 +2340,17 @@ class Skin {
                        $image=$wgUploadPath."/".$tool["image"];
                        $open=$tool["open"];
                        $close=$tool["close"];
-                       $sample=$tool["sample"];
+                       $sample = addslashes( $tool["sample"] );
 
                        // Note that we use the tip both for the ALT tag and the TITLE tag of the image.
                        // Older browsers show a "speedtip" type message only for ALT.
                        // Ideally these should be different, realistically they
                        // probably don't need to be.
-                       $tip=$tool["tip"];
+                       $tip = addslashes( $tool["tip"] );
                        $toolbar.="addButton('$image','$tip','$open','$close','$sample');\n";
                }
 
-               $toolbar.="addInfobox('".addslashes(wfMsg("infobox"))."');\n";
+               $toolbar.="addInfobox('" . addslashes( wfMsg( "infobox" ) ) . "');\n";
                $toolbar.="document.writeln(\"</div>\");\n</script>";
                return $toolbar;
        }

diff --git a/stylesheets/wikibits.js b/stylesheets/wikibits.js
index 237b85c..155e060 100644 (file)
--- a/stylesheets/wikibits.js
+++ b/stylesheets/wikibits.js
@@ -101,9 +101,10 @@ function addInfobox(infoText) {
                 && (clientPC.indexOf('webtv')==-1) && (clientPC.indexOf('hotjava')==-1)
                && (clientPC.indexOf('khtml')==-1) && (clientPC.indexOf('gecko')==-1));
        if(!document.selection && !is_nav) {
+               infoText=escapeQuotesHTML(infoText);
                document.write("<form name='infoform' id='infoform'>"+
-                       "<input size=80 id='infobox' name='infobox' value='"+
-                       infoText+"' READONLY></form>");
+                       "<input size=80 id='infobox' name='infobox' value=\""+
+                       infoText+"\" READONLY></form>");
        }
 
 }
@@ -111,11 +112,19 @@ function addInfobox(infoText) {
 function escapeQuotes(text) {
        var re=new RegExp("'","g");
        text=text.replace(re,"\\'");
+       re=new RegExp('"',"g");
+       text=text.replace(re,'&quot;');
        re=new RegExp("\\n","g");
        text=text.replace(re,"\\n");
        return text;
 }
 
+function escapeQuotesHTML(text) {
+       var re=new RegExp('"',"g");
+       text=text.replace(re,"&quot;");
+       return text;
+}
+
 // apply tagOpen/tagClose to selection in textarea,
 // use sampleText instead of selection if there is none
 // copied and adapted from phpBB