fixes #1311 #1312 better transmit the tags array from PHP to TPL/JS

* the quotes needs to be escaped
* simpler (for orphans) to transmit array in the JS instead of HTML attribute (we might need to do the same for the whole list of tags)

admin/tags.php

@@ -63,6 +63,7 @@ $warning_tags = "";
 
 $orphan_tags = get_orphan_tags();
 
+$orphan_tag_names_array = '[]';
 $orphan_tag_names = array();
 foreach ($orphan_tags as $tag)
 {
@@ -75,15 +76,26 @@ if (count($orphan_tag_names) > 0)
     l10n('You have %d orphan tags %s'),
     count($orphan_tag_names),
     '<a 
-      data-tags=\'["'.implode('" ,"', $orphan_tag_names).'"]\' 
       class="icon-eye"
       data-url="'.get_root_url().'admin.php?page=tags&amp;action=delete_orphans&amp;pwg_token='.get_pwg_token().'">'
       .l10n('Review').'</a>'
     );
+
+  $orphan_tag_names_array = '["';
+  $orphan_tag_names_array.= implode(
+    '" ,"',
+    array_map(
+      'htmlentities',
+      $orphan_tag_names,
+      array_fill(0 , count($orphan_tag_names) , ENT_QUOTES)
+    )
+  );
+  $orphan_tag_names_array.= '"]';
 }
 
 $template->assign(
   array(
+    'orphan_tag_names_array' => $orphan_tag_names_array,
     'warning_tags' => $warning_tags,
     'message_tags' => $message_tags
     )

admin/themes/default/js/tags.js

@@ -7,7 +7,7 @@ $('#select-100').prop('checked', true)
 //Orphan tags
 $('.tag-warning p a').on('click', () => {
   let url = $('.tag-warning p a').data('url');
-  let tags = $('.tag-warning p a').data('tags');
+  let tags = orphan_tag_names;
   let str_orphans = str_orphan_tags.replace('%s1', tags.length).replace('%s2', tags.join(', '));
   $.confirm({
     content : str_orphans,

admin/themes/default/template/tags.tpl

@@ -1,5 +1,6 @@
 {footer_script}
 var pwg_token = "{$PWG_TOKEN}";
+var orphan_tag_names = {$orphan_tag_names_array};
 var str_delete = '{'Delete tag "%s"?'|@translate}';
 var str_delete_tags = '{'Delete tags \{%s\}?'|@translate}';
 var str_yes_delete_confirmation = "{'Yes, delete'|@translate}";
@@ -149,7 +150,7 @@ var str_tag_found = '{'<b>%d</b> tag found'|@translate}';
   <div></div> <a></a>
 </div>
 
-<div class='tag-container' data-tags='{json_encode($data)}' data-per_page={$per_page}>
+<div class='tag-container' data-tags='{$data|@json_encode|escape:html}' data-per_page={$per_page}>
   {foreach from=$first_tags item=tag}
   <div class='tag-box' data-id='{$tag.id}' data-selected='0'>
     {tagContent