                  if "_popup" in request.POST:
                      post_url_continue += "?_popup=1"
                  return HttpResponseRedirect(post_url_continue % pk_value)
              if "_popup" in request.POST:
                  if type(pk_value) is str: # Quote if string, so JavaScript doesn't think it's a variable.
                      pk_value = '"%s"' % pk_value.replace('"', '\\"')
                  return HttpResponse('<script type="text/javascript">opener.dismissAddAnotherPopup(window, %s, "%s");</script>' % \
                      (pk_value, force_unicode(new_object).replace('"', '\\"')))
              elif "_addanother" in request.POST:
                  request.user.message_set.create(message=msg + ' ' + (_("You may add another %s below.") % force_unicode(opts.verbose_name)))
                  return HttpResponseRedirect(request.path)
              else:
                  request.user.message_set.create(message=msg)
 
</s>
                return HttpResponse('<script type="text/javascript">opener.dismissAddAnotherPopup(window, "%s", "%s");</script>' % \
                    # escape() calls force_unicode.
                    (escape(pk_value), escape(new_object)))
                  if "_popup" in request.POST:
                      post_url_continue += "?_popup=1"
                  return HttpResponseRedirect(post_url_continue % pk_value)
              if "_popup" in request.POST:
                return HttpResponse('<script type="text/javascript">opener.dismissAddAnotherPopup(window, "%s", "%s");</script>' % \
                    # escape() calls force_unicode.
                    (escape(pk_value), escape(new_object)))
                return HttpResponse('<script type="text/javascript">opener.dismissAddAnotherPopup(window, "%s", "%s");</script>' % \
                    # escape() calls force_unicode.
                    (escape(pk_value), escape(new_object)))
                return HttpResponse('<script type="text/javascript">opener.dismissAddAnotherPopup(window, "%s", "%s");</script>' % \
                    # escape() calls force_unicode.
                    (escape(pk_value), escape(new_object)))
                return HttpResponse('<script type="text/javascript">opener.dismissAddAnotherPopup(window, "%s", "%s");</script>' % \
                    # escape() calls force_unicode.
                    (escape(pk_value), escape(new_object)))
              elif "_addanother" in request.POST:
                  request.user.message_set.create(message=msg + ' ' + (_("You may add another %s below.") % force_unicode(opts.verbose_name)))
                  return HttpResponseRedirect(request.path)
              else:
                  request.user.message_set.create(message=msg)
keep keep keep keep replace replace replace replace keep keep keep keep keep
 Fixed #5880 -- Fixed an XSS hole in the admin interface.
 * Escaped text that gets sent after saving the admin foreignkey popup form.
 * Added quotes around the second argument passed to `opener.dismissAddAnotherPopup` to make the function also work when a text field is used as the primary key.
 * Added a `html_unescape` javascript function to unescape the strings passed in to the `dismissAddAnotherPopup` function so that the added choice displays correctly in the dropdown box.


git-svn-id: http://code.djangoproject.com/svn/django/trunk@6691 bcc190cf-cafb-0310-a4f2-bffc1f526a37
django/contrib/admin/views/main.py