  // Handles related-objects functionality: lookup link for raw_id_admin=True
  // and Add Another links.
  
  function showRelatedObjectLookupPopup(triggeringLink) {
      var name = triggeringLink.id.replace(/^lookup_/, '');
      // IE doesn't like periods in the window name, so convert temporarily.
      name = name.replace(/\./g, '___');
      var href;
      if (triggeringLink.href.search(/\?/) >= 0) {
 
</s> remove                 if type(pk_value) is str: # Quote if string, so JavaScript doesn't think it's a variable.
                    pk_value = '"%s"' % pk_value.replace('"', '\\"')
                return HttpResponse('<script type="text/javascript">opener.dismissAddAnotherPopup(window, %s, "%s");</script>' % \
                    (pk_value, force_unicode(new_object).replace('"', '\\"')))
 </s> add                 return HttpResponse('<script type="text/javascript">opener.dismissAddAnotherPopup(window, "%s", "%s");</script>' % \
                    # escape() calls force_unicode.
                    (escape(pk_value), escape(new_object)))
function html_unescape(text) {
    // Unescape a string that was escaped using django.utils.html.escape.
    text = text.replace(/&lt;/g, '<');
    text = text.replace(/&gt;/g, '>');
    text = text.replace(/&quot;/g, '"');
    text = text.replace(/&#39;/g, "'");
    text = text.replace(/&amp;/g, '&');
    return text;
}

  // Handles related-objects functionality: lookup link for raw_id_admin=True
  // and Add Another links.
  
function html_unescape(text) {
    // Unescape a string that was escaped using django.utils.html.escape.
    text = text.replace(/&lt;/g, '<');
    text = text.replace(/&gt;/g, '>');
    text = text.replace(/&quot;/g, '"');
    text = text.replace(/&#39;/g, "'");
    text = text.replace(/&amp;/g, '&');
    return text;
}

  function showRelatedObjectLookupPopup(triggeringLink) {
      var name = triggeringLink.id.replace(/^lookup_/, '');
      // IE doesn't like periods in the window name, so convert temporarily.
      name = name.replace(/\./g, '___');
      var href;
      if (triggeringLink.href.search(/\?/) >= 0) {
keep keep add keep keep keep keep keep keep
 Fixed #5880 -- Fixed an XSS hole in the admin interface.
 * Escaped text that gets sent after saving the admin foreignkey popup form.
 * Added quotes around the second argument passed to `opener.dismissAddAnotherPopup` to make the function also work when a text field is used as the primary key.
 * Added a `html_unescape` javascript function to unescape the strings passed in to the `dismissAddAnotherPopup` function so that the added choice displays correctly in the dropdown box.


git-svn-id: http://code.djangoproject.com/svn/django/trunk@6691 bcc190cf-cafb-0310-a4f2-bffc1f526a37 
django/contrib/admin/media/js/admin/RelatedObjectLookups.js