From eddc178ee13c0e6b6887fdb1bf1426fbf3a24184 Mon Sep 17 00:00:00 2001
From: nacin <nacin@1a063a9b-81f0-0310-95a4-ce76da25c4cd>
Date: Sat, 13 Feb 2010 03:12:51 +0000
Subject: [PATCH] Escape thousandsSeparator and decimalPoint JS variables, see
 #12005

git-svn-id: http://svn.automattic.com/wordpress/trunk@13078 1a063a9b-81f0-0310-95a4-ce76da25c4cd
---
 wp-admin/admin-header.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/wp-admin/admin-header.php b/wp-admin/admin-header.php
index fec9451c7e..62b74788ca 100644
--- a/wp-admin/admin-header.php
+++ b/wp-admin/admin-header.php
@@ -35,7 +35,7 @@ $admin_body_class = preg_replace('/[^a-z0-9_-]+/i', '-', $hook_suffix);
 //<![CDATA[
 addLoadEvent = function(func){if(typeof jQuery!="undefined")jQuery(document).ready(func);else if(typeof wpOnload!='function'){wpOnload=func;}else{var oldonload=wpOnload;wpOnload=function(){oldonload();func();}}};
 var userSettings = {'url':'<?php echo SITECOOKIEPATH; ?>','uid':'<?php if ( ! isset($current_user) ) $current_user = wp_get_current_user(); echo $current_user->ID; ?>','time':'<?php echo time() ?>'};
-var ajaxurl = '<?php echo admin_url('admin-ajax.php'); ?>', pagenow = '<?php echo substr($pagenow, 0, -4); ?>', typenow = '<?php echo $typenow; ?>', adminpage = '<?php echo $admin_body_class; ?>',  thousandsSeparator = '<?php echo $wp_locale->number_format['thousands_sep']; ?>', decimalPoint = '<?php echo $wp_locale->number_format['decimal_point']; ?>';
+var ajaxurl = '<?php echo admin_url('admin-ajax.php'); ?>', pagenow = '<?php echo substr($pagenow, 0, -4); ?>', typenow = '<?php echo $typenow; ?>', adminpage = '<?php echo $admin_body_class; ?>',  thousandsSeparator = '<?php echo addslashes( $wp_locale->number_format['thousands_sep'] ); ?>', decimalPoint = '<?php echo addslashes( $wp_locale->number_format['decimal_point'] ); ?>';
 //]]>
 </script>
 <?php