From 75cddbae99ca9a2e0875e16e7998f6986b4019a3 Mon Sep 17 00:00:00 2001
From: Damien Metzger <damien.metzger@prestashop.com>
Date: Thu, 27 Jun 2013 16:41:38 +0200
Subject: [PATCH] // Protected smarty variable in JS

---
 modules/blockcart/blockcart.tpl                   | 2 +-
 modules/blocksearch/blocksearch-instantsearch.tpl | 4 ++--
 modules/blocksearch/blocksearch-top.tpl           | 3 +--
 themes/default/header.tpl                         | 8 ++++----
 themes/default/modules/blockcart/blockcart.tpl    | 2 +-
 5 files changed, 9 insertions(+), 10 deletions(-)

diff --git a/modules/blockcart/blockcart.tpl b/modules/blockcart/blockcart.tpl
index 81a08943e..0e30c8fe6 100644
--- a/modules/blockcart/blockcart.tpl
+++ b/modules/blockcart/blockcart.tpl
@@ -29,7 +29,7 @@
 {if $ajax_allowed}
 <script type="text/javascript">
 var CUSTOMIZE_TEXTFIELD = {$CUSTOMIZE_TEXTFIELD};
-var img_dir = '{$img_dir}';
+var img_dir = '{$img_dir|addslashes}';
 </script>
 {/if}
 <script type="text/javascript">
diff --git a/modules/blocksearch/blocksearch-instantsearch.tpl b/modules/blocksearch/blocksearch-instantsearch.tpl
index 53163f296..bfba4fd34 100644
--- a/modules/blocksearch/blocksearch-instantsearch.tpl
+++ b/modules/blocksearch/blocksearch-instantsearch.tpl
@@ -23,7 +23,7 @@
 			if($(this).val().length > 0){
 				stopInstantSearchQueries();
 				instantSearchQuery = $.ajax({
-					url: '{if $search_ssl == 1}{$link->getPageLink('search', true)}{else}{$link->getPageLink('search')}{/if}',
+					url: '{if $search_ssl == 1}{$link->getPageLink('search', true)|addslashes}{else}{$link->getPageLink('search')|addslashes}{/if}',
 					data: {
 						instantSearch: 1,
 						id_lang: {$cookie->id_lang},
@@ -64,7 +64,7 @@
 		$('document').ready( function() {
 			$("#search_query_{$blocksearch_type}")
 				.autocomplete(
-					'{if $search_ssl == 1}{$link->getPageLink('search', true)}{else}{$link->getPageLink('search')}{/if}', {
+					'{if $search_ssl == 1}{$link->getPageLink('search', true)|addslashes}{else}{$link->getPageLink('search')|addslashes}{/if}', {
 						minChars: 3,
 						max: 10,
 						width: 500,
diff --git a/modules/blocksearch/blocksearch-top.tpl b/modules/blocksearch/blocksearch-top.tpl
index 7bb21b555..5a5918662 100644
--- a/modules/blocksearch/blocksearch-top.tpl
+++ b/modules/blocksearch/blocksearch-top.tpl
@@ -35,7 +35,6 @@
 {else}
 <!-- Block search module TOP -->
 <div id="search_block_top">
-
 	<form method="get" action="{$link->getPageLink('search')|escape:'html'}" id="searchbox">
 		<p>
 			<label for="search_query_top"><!-- image on background --></label>
@@ -44,7 +43,7 @@
 			<input type="hidden" name="orderway" value="desc" />
 			<input class="search_query" type="text" id="search_query_top" name="search_query" value="{if isset($smarty.get.search_query)}{$smarty.get.search_query|htmlentities:$ENT_QUOTES:'utf-8'|stripslashes}{/if}" />
 			<input type="submit" name="submit_search" value="{l s='Search' mod='blocksearch'}" class="button" />
-	</p>
+		</p>
 	</form>
 </div>
 {include file="$self/blocksearch-instantsearch.tpl"}
diff --git a/themes/default/header.tpl b/themes/default/header.tpl
index 2778ee57e..22011c52c 100644
--- a/themes/default/header.tpl
+++ b/themes/default/header.tpl
@@ -43,10 +43,10 @@
 		<link rel="icon" type="image/vnd.microsoft.icon" href="{$favicon_url}?{$img_update_time}" />
 		<link rel="shortcut icon" type="image/x-icon" href="{$favicon_url}?{$img_update_time}" />
 		<script type="text/javascript">
-			var baseDir = '{$content_dir}';
-			var baseUri = '{$base_uri}';
-			var static_token = '{$static_token}';
-			var token = '{$token}';
+			var baseDir = '{$content_dir|addslashes}';
+			var baseUri = '{$base_uri|addslashes}';
+			var static_token = '{$static_token|addslashes}';
+			var token = '{$token|addslashes}';
 			var priceDisplayPrecision = {$priceDisplayPrecision*$currency->decimals};
 			var priceDisplayMethod = {$priceDisplay};
 			var roundMode = {$roundMode};
diff --git a/themes/default/modules/blockcart/blockcart.tpl b/themes/default/modules/blockcart/blockcart.tpl
index 0e0594955..940892195 100644
--- a/themes/default/modules/blockcart/blockcart.tpl
+++ b/themes/default/modules/blockcart/blockcart.tpl
@@ -29,7 +29,7 @@
 {if $ajax_allowed}
 <script type="text/javascript">
 var CUSTOMIZE_TEXTFIELD = {$CUSTOMIZE_TEXTFIELD};
-var img_dir = '{$img_dir}';
+var img_dir = '{$img_dir|addslashes}';
 </script>
 {/if}
 <script type="text/javascript">