  }
  
  function dismissAddAnotherPopup(win, newId, newRepr) {
      var name = win.name.replace(/___/g, '.');
      var elem = document.getElementById(name);
      if (elem) {
          if (elem.nodeName == 'SELECT') {
              var o = new Option(newRepr, newId);
              elem.options[elem.options.length] = o;
 
</s> remove                 if type(pk_value) is str: # Quote if string, so JavaScript doesn't think it's a variable.
                    pk_value = '"%s"' % pk_value.replace('"', '\\"')
                return HttpResponse('<script type="text/javascript">opener.dismissAddAnotherPopup(window, %s, "%s");</script>' % \
                    (pk_value, force_unicode(new_object).replace('"', '\\"')))
 </s> add                 return HttpResponse('<script type="text/javascript">opener.dismissAddAnotherPopup(window, "%s", "%s");</script>' % \
                    # escape() calls force_unicode.
                    (escape(pk_value), escape(new_object)))
    // newId and newRepr are expected to have previously been escaped by
    // django.utils.html.escape.
    newId = html_unescape(newId);
    newRepr = html_unescape(newRepr);
  }
  
  function dismissAddAnotherPopup(win, newId, newRepr) {
    // newId and newRepr are expected to have previously been escaped by
    // django.utils.html.escape.
    newId = html_unescape(newId);
    newRepr = html_unescape(newRepr);
      var name = win.name.replace(/___/g, '.');
      var elem = document.getElementById(name);
      if (elem) {
          if (elem.nodeName == 'SELECT') {
              var o = new Option(newRepr, newId);
              elem.options[elem.options.length] = o;
keep keep add keep keep keep keep keep keep
 Fixed #5880 -- Fixed an XSS hole in the admin interface.
 * Escaped text that gets sent after saving the admin foreignkey popup form.
 * Added quotes around the second argument passed to `opener.dismissAddAnotherPopup` to make the function also work when a text field is used as the primary key.
 * Added a `html_unescape` javascript function to unescape the strings passed in to the `dismissAddAnotherPopup` function so that the added choice displays correctly in the dropdown box.


git-svn-id: http://code.djangoproject.com/svn/django/trunk@6691 bcc190cf-cafb-0310-a4f2-bffc1f526a37 
django/contrib/admin/media/js/admin/RelatedObjectLookups.js