www: add html_safe() for even safer html

src/www/guiconfig.inc

 <?php
 
 /*
-	Copyright (C) 2015 Franco Fichtner <franco@opnsense.org>
+	Copyright (C) 2015-2016 Franco Fichtner <franco@opnsense.org>
 	Copyright (C) 2014 Deciso B.V.
 	Copyright (C) 2004 Scott Ullrich
 	Copyright (C) 2003-2004 Manuel Kasper <mk@neon1.net>.
@@ -73,6 +73,12 @@ function get_current_theme()
 	return $theme;
 }
 
+function html_safe($text)
+{
+	/* gettext() embedded in JavaScript can cause syntax errors */
+	return htmlspecialchars($text, ENT_QUOTES | ENT_HTML401);
+}
+
 /* make sure nothing is cached */
 if (isset($omit_nocacheheaders) && $omit_nocacheheaders) {
 	header("Expires: 0");

src/www/widgets/widgets/system_information.widget.php

@@ -273,7 +273,7 @@ endforeach; ?>
 <script type="text/javascript">
 //<![CDATA[
 	function checkupdate() {
-		jQuery('#updatestatus').html('<span class="text-info"><?= gettext('Fetching... (may take up to 30 seconds)') ?></span>');
+		jQuery('#updatestatus').html('<span class="text-info"><?= html_safe(gettext('Fetching... (may take up to 30 seconds)')) ?></span>');
 		jQuery.ajax({
 			type: "POST",
 			url: '/widgets/widgets/system_information.widget.php',