added escapement of '</' to javascript escaping

NEWS

@@ -1,3 +1,5 @@
+  - added escapement of '</' to '<\/' in escape:javascript
+    modifier (c960657, Monte)
   - added obfuscation of protocol-string in {mailto} when using hex-
     encoding (bharat, messju)
   - enhanced auto-generated filenames for templates_c and cache (messju)

libs/plugins/modifier.escape.php

@@ -57,8 +57,8 @@ function smarty_modifier_escape($string, $esc_type = 'html')
             return $return;
 
         case 'javascript':
-            // escape quotes and backslashes and newlines
-            return strtr($string, array('\\'=>'\\\\',"'"=>"\\'",'"'=>'\\"',"\r"=>'\\r',"\n"=>'\\n'));
+            // escape quotes and backslashes, newlines, etc.
+            return strtr($string, array('\\'=>'\\\\',"'"=>"\\'",'"'=>'\\"',"\r"=>'\\r',"\n"=>'\\n','</'=>'<\/'));
             
         case 'mail':
             // safe way to display e-mail address on a web page