From 270ad693eb06f1294ba7582001e1a16e65ccff33 Mon Sep 17 00:00:00 2001
From: Kamil Tekiela <tekiela246@gmail.com>
Date: Sat, 15 Oct 2022 01:03:09 +0100
Subject: [PATCH] Replace uses of escapeJsString with json_encode

Signed-off-by: Kamil Tekiela <tekiela246@gmail.com>
---
 libraries/classes/Config/FormDisplay.php   | 13 ++++++-------
 libraries/classes/Header.php               | 14 ++++----------
 templates/config/form_display/display.twig |  6 +++---
 3 files changed, 13 insertions(+), 20 deletions(-)

diff --git a/libraries/classes/Config/FormDisplay.php b/libraries/classes/Config/FormDisplay.php
index f2f7edf381..1cf3552d52 100644
--- a/libraries/classes/Config/FormDisplay.php
+++ b/libraries/classes/Config/FormDisplay.php
@@ -436,22 +436,22 @@ class FormDisplay
         $this->setComments($systemPath, $opts);
 
         // send default value to form's JS
-        $jsLine = '\'' . $translatedPath . '\': ';
+        $jsLine = '';
         switch ($type) {
             case 'text':
             case 'short_text':
             case 'number_text':
             case 'password':
-                $jsLine .= '\'' . Sanitize::escapeJsString($valueDefault) . '\'';
+                $jsLine = (string) $valueDefault;
                 break;
             case 'checkbox':
-                $jsLine .= $valueDefault ? 'true' : 'false';
+                $jsLine = (bool) $valueDefault;
                 break;
             case 'select':
                 $valueDefaultJs = is_bool($valueDefault)
                 ? (int) $valueDefault
                 : $valueDefault;
-                $jsLine .= '[\'' . Sanitize::escapeJsString($valueDefaultJs) . '\']';
+                $jsLine = (array) $valueDefaultJs;
                 break;
             case 'list':
                 $val = $valueDefault;
@@ -459,12 +459,11 @@ class FormDisplay
                     unset($val['wrapper_params']);
                 }
 
-                $jsLine .= '\'' . Sanitize::escapeJsString(implode("\n", $val))
-                . '\'';
+                $jsLine = implode("\n", $val);
                 break;
         }
 
-        $jsDefault[] = $jsLine;
+        $jsDefault[$translatedPath] = $jsLine;
 
         return $this->formDisplayTemplate->displayInput(
             $translatedPath,
diff --git a/libraries/classes/Header.php b/libraries/classes/Header.php
index e23146b458..4f4111325e 100644
--- a/libraries/classes/Header.php
+++ b/libraries/classes/Header.php
@@ -16,14 +16,15 @@ use function defined;
 use function gmdate;
 use function header;
 use function htmlspecialchars;
-use function implode;
 use function ini_get;
-use function is_bool;
+use function json_encode;
 use function sprintf;
 use function strlen;
 use function strtolower;
 use function urlencode;
 
+use const JSON_HEX_TAG;
+
 /**
  * Class used to output the HTTP and HTML headers
  */
@@ -201,15 +202,8 @@ class Header
     public function getJsParamsCode(): string
     {
         $params = $this->getJsParams();
-        foreach ($params as $key => $value) {
-            if (is_bool($value)) {
-                $params[$key] = $key . ':' . ($value ? 'true' : 'false') . '';
-            } else {
-                $params[$key] = $key . ':"' . Sanitize::escapeJsString($value) . '"';
-            }
-        }
 
-        return 'window.CommonParams.setAll({' . implode(',', $params) . '});';
+        return 'window.CommonParams.setAll(' . json_encode($params, JSON_HEX_TAG) . ');';
     }
 
     /**
diff --git a/templates/config/form_display/display.twig b/templates/config/form_display/display.twig
index a121a72870..9503dacf58 100644
--- a/templates/config/form_display/display.twig
+++ b/templates/config/form_display/display.twig
@@ -68,9 +68,9 @@
       'error_value_lte': '{{ 'Value must be less than or equal to %s!'|trans|e('js') }}',
     });
 
-    $.extend(window.defaultValues, {
-      {{ js_default|join(",\n      ")|raw }}
-    });
+    $.extend(window.defaultValues,
+      {{ js_default|json_encode(constant('JSON_HEX_TAG'))|raw }}
+    );
   });
   if (typeof window.configScriptLoaded !== 'undefined' && window.configInlineParams) {
     window.Config.loadInlineConfig();