I found next bug. It shows some code at top of page (and quoting doesn't work) when I add </script> to post. I think javascript code should be inside html comment "<!-- ... //-->", quick patch:
--- manifest_old.xml 2009-02-17 19:00:14.781250000 +0100
+++ manifest.xml 2009-02-17 19:00:32.875000000 +0100
@@ -58,7 +58,7 @@
if ($forum_db->num_rows($pun_quote_result))
{
- $forum_head['pun_quote_js'] .= '<script type="text/javascript">';
+ $forum_head['pun_quote_js'] .= '<script type="text/javascript"><!--';
$forum_head['pun_quote_js'] .= 'var pun_quote_posts = new Array();';
$forum_head['pun_quote_js'] .= 'var pun_quote_authors = new Array();';
@@ -70,7 +70,7 @@
$forum_head['pun_quote_js'] .= 'pun_quote_authors['.$pun_quote_curr_message['id'].'] = "'.$pun_quote_curr_message['poster'].'";';
}
- $forum_head['pun_quote_js'] .= '</script>';
+ $forum_head['pun_quote_js'] .= '//--></script>';
}
}
edit: you can see demo of this bug at top of page
edit2: it doesn't solve problem when there's
in the post. Why don't you just encode all html chars using forum_htmlencode and then decode them back in javascript file?