From c6a140fcf03153faf3a19ad1e831e32ca7a52481 Mon Sep 17 00:00:00 2001
From: Sebastien Ros <none@none>
Date: Fri, 22 Feb 2013 18:08:52 -0800
Subject: [PATCH] Fixing javasccript encoding issues

Work Items: 19471

--HG--
branch : 1.x
---
 .../Views/DatePickerLocalization.cshtml        | 17 +++++++++--------
 .../Views/TimePickerLocalization.cshtml        | 18 +++++++++---------
 2 files changed, 18 insertions(+), 17 deletions(-)

diff --git a/src/Orchard.Web/Modules/Orchard.jQuery/Views/DatePickerLocalization.cshtml b/src/Orchard.Web/Modules/Orchard.jQuery/Views/DatePickerLocalization.cshtml
index 4b44f0611..ffc3ec0dd 100644
--- a/src/Orchard.Web/Modules/Orchard.jQuery/Views/DatePickerLocalization.cshtml
+++ b/src/Orchard.Web/Modules/Orchard.jQuery/Views/DatePickerLocalization.cshtml
@@ -32,12 +32,13 @@
         .Replace("Y", "y")
         .Replace("M", "m")
         ;
+        
 }
 
 @functions {
 
     private string FormatJsList(string csv) {
-        return "'" + String.Join("', '", csv.Split(',').Select(x => x.Trim())) + "'";
+        return "'" + String.Join("', '", csv.Split(',').Select(x => HttpUtility.JavaScriptStringEncode(x.Trim()))) + "'";
     }
 
 }
@@ -45,21 +46,21 @@
 //<![CDATA[
     $(function() {
         $.datepicker.regional[''] = {
-            closeText: '@T("Done")', // Display text for close link
-            prevText: '@T("Prev")', // Display text for previous month link
-            nextText: '@T("Next")', // Display text for next month link
-            currentText: '@T("Today")', // Display text for current month link
+            closeText: '@HttpUtility.JavaScriptStringEncode(T("Done").Text)', // Display text for close link
+            prevText: '@HttpUtility.JavaScriptStringEncode(T("Prev").Text)', // Display text for previous month link
+            nextText: '@HttpUtility.JavaScriptStringEncode(T("Next").Text)', // Display text for next month link
+            currentText: '@HttpUtility.JavaScriptStringEncode(T("Today").Text)', // Display text for current month link
             monthNames: [@Html.Raw(monthNames)], // Names of months for drop-down and formatting
             monthNamesShort: [@Html.Raw(monthNamesShort)], // For formatting
             dayNames: [@Html.Raw(dayNames)], // For formatting
             dayNamesShort: [@Html.Raw(dayNamesShort)], // For formatting
             dayNamesMin: [@Html.Raw(dayNamesMin)], // Column headings for days starting at Sunday
-            weekHeader: '@T("Wk")', // Column header for week of the year
-            dateFormat: '@dateFormat', // See format options on parseDate
+            weekHeader: '@HttpUtility.JavaScriptStringEncode(T("Wk").Text)', // Column header for week of the year
+            dateFormat: '@HttpUtility.JavaScriptStringEncode(dateFormat)', // See format options on parseDate
             firstDay: @dateTimeLocalization.FirstDay, // The first day of the week, Sun = 0, Mon = 1, ...
             isRTL: @(cultureInfo.TextInfo.IsRightToLeft ? "true" : "false"), // True if right-to-left language, false if left-to-right
             showMonthAfterYear: @(dateTimeLocalization.ShowMonthAfterYear ? "true" : "false"), // True if the year select precedes month, false for month then year
-            yearSuffix: '@dateTimeLocalization.YearSuffix' // Additional text to append to the year in the month headers
+            yearSuffix: '@HttpUtility.JavaScriptStringEncode(dateTimeLocalization.YearSuffix)' // Additional text to append to the year in the month headers
         };
 
         $.datepicker.setDefaults($.datepicker.regional['']);
diff --git a/src/Orchard.Web/Modules/Orchard.jQuery/Views/TimePickerLocalization.cshtml b/src/Orchard.Web/Modules/Orchard.jQuery/Views/TimePickerLocalization.cshtml
index 1453d5550..1a1bd44e2 100644
--- a/src/Orchard.Web/Modules/Orchard.jQuery/Views/TimePickerLocalization.cshtml
+++ b/src/Orchard.Web/Modules/Orchard.jQuery/Views/TimePickerLocalization.cshtml
@@ -9,12 +9,12 @@
     }
 
     WorkContext.SetState("TimePickerLocalization", new object());
-        
+
     Style.Require("jQueryUI_TimePicker");
     Script.Require("jQueryUI_TimePicker");
 
     var cultureInfo = CultureInfo.GetCultureInfo(WorkContext.CurrentCulture);
-    
+
     var timeFormat = cultureInfo.DateTimeFormat.ShortTimePattern
         .Replace("H", "h");
 
@@ -26,13 +26,13 @@
     $(function() {
 
         $.timepicker.regional[''] = {
-            timeOnlyTitle: '@T("Choose time")',
-            timeText: '@T("Time")',
-            hourText: '@T("Hour")',
-            minuteText: '@T("Minute")',
-            currentText: '@T("Now")', // Display text for current time link
-            closeText: '@T("Done")', // Display text for close link
-            timeFormat: '@timeFormat',
+            timeOnlyTitle: '@HttpUtility.JavaScriptStringEncode(T("Choose time").Text)',
+            timeText: '@HttpUtility.JavaScriptStringEncode(T("Time").Text)',
+            hourText: '@HttpUtility.JavaScriptStringEncode(T("Hour").Text)',
+            minuteText: '@HttpUtility.JavaScriptStringEncode(T("Minute").Text)',
+            currentText: '@HttpUtility.JavaScriptStringEncode(T("Now").Text)', // Display text for current time link
+            closeText: '@HttpUtility.JavaScriptStringEncode(T("Done").Text)', // Display text for close link
+            timeFormat: '@HttpUtility.JavaScriptStringEncode(timeFormat)',
             amNames: ['@cultureInfo.DateTimeFormat.AMDesignator', 'AM', 'A'],
             pmNames: ['@cultureInfo.DateTimeFormat.PMDesignator', 'PM', 'P'],
             ampm: @ampm,