From 7b260f7b83b3fcc3ca1f84513f06923845f0464d Mon Sep 17 00:00:00 2001
From: mohrt <mohrt@localhost>
Date: Wed, 9 Jun 2004 14:54:31 +0000
Subject: [PATCH] added escapement of '</' to javascript escaping

---
 NEWS                             | 2 ++
 libs/plugins/modifier.escape.php | 4 ++--
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/NEWS b/NEWS
index a6efb6b2..e72af752 100644
--- a/NEWS
+++ b/NEWS
@@ -1,3 +1,5 @@
+  - added escapement of '</' to '<\/' in escape:javascript
+    modifier (c960657, Monte)
   - added obfuscation of protocol-string in {mailto} when using hex-
     encoding (bharat, messju)
   - enhanced auto-generated filenames for templates_c and cache (messju)
diff --git a/libs/plugins/modifier.escape.php b/libs/plugins/modifier.escape.php
index 855b1d14..0a0270c5 100644
--- a/libs/plugins/modifier.escape.php
+++ b/libs/plugins/modifier.escape.php
@@ -57,8 +57,8 @@ function smarty_modifier_escape($string, $esc_type = 'html')
             return $return;
 
         case 'javascript':
-            // escape quotes and backslashes and newlines
-            return strtr($string, array('\\'=>'\\\\',"'"=>"\\'",'"'=>'\\"',"\r"=>'\\r',"\n"=>'\\n'));
+            // escape quotes and backslashes, newlines, etc.
+            return strtr($string, array('\\'=>'\\\\',"'"=>"\\'",'"'=>'\\"',"\r"=>'\\r',"\n"=>'\\n','</'=>'<\/'));
             
         case 'mail':
             // safe way to display e-mail address on a web page