Index: openacs-4/packages/acs-templating/tcl/widget-procs.tcl
===================================================================
RCS file: /usr/local/cvsroot/openacs-4/packages/acs-templating/tcl/widget-procs.tcl,v
diff -u -N -r1.53 -r1.54
--- openacs-4/packages/acs-templating/tcl/widget-procs.tcl	7 Sep 2015 16:09:16 -0000	1.53
+++ openacs-4/packages/acs-templating/tcl/widget-procs.tcl	7 Aug 2017 23:48:02 -0000	1.54
@@ -1,15 +1,19 @@
-# Form widgets for the ArsDigita Templating System
+ad_library {
+    Form widgets for the ArsDigita Templating System
 
-# Copyright (C) 1999-2000 ArsDigita Corporation
-# Authors: Karl Goldstein    (karlg@arsdigita.com)
-#          Stanislav Freidin (sfreidin@arsdigita.com)
+    @author Karl Goldstein    (karlg@arsdigita.com)
+    @author Stanislav Freidin (sfreidin@arsdigita.com)
      
-# $Id$
+    @cvs-id $Id$
+}
 
+# Copyright (C) 1999-2000 ArsDigita Corporation
+
 # This is free software distributed under the terms of the GNU Public
 # License.  Full text of the license is available from the GNU Project:
 # http://www.fsf.org/copyleft/gpl.html
 
+
 namespace eval template {}
 namespace eval template::widget {}
 namespace eval template::data {}
@@ -322,7 +326,7 @@
     if { $mode ne "edit" } {
         set output {}
         if { $value ne "" } {
-            append output "[ad_quotehtml $value]<input type=\"hidden\" name=\"$name\" value=\"[ad_quotehtml $value]\">"
+            append output "[ns_quotehtml $value]<input type=\"hidden\" name=\"$name\" value=\"[ns_quotehtml $value]\">"
         }
     } else {
         set output "<textarea name=\"$name\""
@@ -335,7 +339,7 @@
             }
         }
         
-        append output ">[ad_quotehtml $value]</textarea>"
+        append output ">[ns_quotehtml $value]</textarea>"
     }
     
     return $output
@@ -381,42 +385,42 @@
     if { ( $type eq "checkbox" || $type eq "radio" ) && [info exists element(value)] } {
         # This can be used in the form template in a <label for="id">...</label> tag.
         set attributes(id) "$element(form_id):elements:$element(name):$element(value)"
-    } elseif { $type eq "password" || $type eq "text" || $type eq "button" || $type eq "file"} { 
+    } elseif { $type in {"password" "text" "button" "file" }} { 
 	set attributes(id) "$element(name)" 
     }
 
-    
     # Handle display mode of visible normal form elements, i.e. not hidden, not submit, not button, not clear
     if { $element(mode) ne "edit" && $type ni { hidden submit button clear checkbox radio } } {
         set output ""
         if { [info exists element(value)] } {
-            append output [ad_quotehtml $element(value)]
-            append output "<input type=\"hidden\" name=\"$element(name)\" value=\"[ad_quotehtml $element(value)]\">"
+            append output [ns_quotehtml $element(value)]
+            append output [subst {<input type="hidden" name="$element(name)" value="[ns_quotehtml $element(value)]">}]
         }
     } else {
-        set output "<input type=\"$type\" name=\"$element(name)\""
+        set output [subst {<input type="$type" name="$element(name)"}]
 
         if { $element(mode) ne "edit" && $type ni { hidden submit button clear } } {
             append output " disabled"
-		}
+        }
 
         if { [info exists element(value)] } {
-            append output " value=\"[ad_quotehtml $element(value)]\""
+            append output [subst { value="[ns_quotehtml $element(value)]"}]
         } 
 
         foreach name [array names attributes] {
             if {$attributes($name) eq {}} {
                 append output " $name"
             } else {
-                append output " $name=\"$attributes($name)\""
+                append output [subst { $name="$attributes($name)"}]
             }
         }
 
         if { [info exists element(maxlength)] } {
-            append output " maxlength=\"$element(maxlength)\""
+            append output [subst { maxlength="$element(maxlength)"}]
         }
 
         append output " >"
+
     }
 
     return $output
@@ -505,12 +509,12 @@
     # I changed this by saying that field is multiple whenever element(values) 
     # exists and is not null.
     if { [info exists element(values)] && $element(values) ne "" } {
-      ns_log notice "hidden form element with multiple values: <$element(values)>"
+      #ns_log notice "hidden form element with multiple values: <$element(values)>"
       set output {}
       set count 0
       foreach itemvalue $element(values) {
 	append output [subst {
-	  <input type="hidden" id="$element(form_id):$element(name):$count" name="$element(name)" value="[ad_quotehtml $itemvalue]">
+	  <input type="hidden" id="$element(form_id):$element(name):$count" name="$element(name)" value="[ns_quotehtml $itemvalue]">
 	}]
         incr count
       }
@@ -661,7 +665,7 @@
 
             if { [info exists values($value)] } {
                 lappend selected_list $label
-                append output "<input type=\"hidden\" name=\"$widget_name\" value=\"[ad_quotehtml $value]\">"
+                append output [subst {<input type="hidden" name="$widget_name" value="[ns_quotehtml $value]">}]
             }
         }
 
@@ -678,37 +682,37 @@
                     set label [lindex $option 0]
                     set value [lindex $option 1]
 
-                    append output " <input type=\"$widget_type\" name=\"$widget_name\" value=\"[ad_quotehtml $value]\""
+                    append output [subst { <input type="$widget_type" name="$widget_name" value="[ns_quotehtml $value]"}]
                     if { [info exists values($value)] } {
-                        append output " checked=\"checked\""
+                        append output [subst { checked="checked"}]
                     }
 
-                    append output ">$label<br>\n"
+                    append output [subst {>[ns_quotehtml $label]<br>\n}]
                 }
             }
             default {
-                append output "<select name=\"$widget_name\" id=\"$widget_name\" "
+                append output [subst {<select name="$widget_name" id="$widget_name" }]
 
                 foreach name [array names attributes] {
                     if {$attributes($name) eq {}} {
-                        append output " $name=\"$name\""
+                        append output [subst { $name="$name"}]
                     } else {
-                        append output " $name=\"$attributes($name)\""
+                        append output [subst { $name="$attributes($name)"}]
                     }
                 }
                 append output ">\n"
 
                 foreach option $options_list {
+                    lassign $option label value
 
-                    set label [lindex $option 0]
-                    set value [lindex $option 1]
-
-                    append output " <option value=\"[ad_quotehtml $value]\""
+                    append output [subst { <option value="[ns_quotehtml $value]"}]
                     if { [info exists values($value)] } {
-                        append output " selected=\"selected\""
+                        append output [subst { selected="selected"}]
                     }
-
-                    append output ">$label</option>\n"
+                    # Whe option element contains "normal" character data,
+                    # which must not contain any "<". For details, see:
+                    # https://www.w3.org/TR/html-markup/syntax.html#normal-character-data
+                    append output [subst {>[string map {< "&lt;" > "&gt;"} $label]</option>\n}]
                 }
                 append output "</select>"
             }
@@ -1074,8 +1078,8 @@
 	    append output [template::util::select_text::get_property select_value $element(value)]
 	    append output "&nbsp;"
 	    append output [template::util::select_text::get_property text_value $element(value)]          
-	    append output "<input type=\"hidden\" name=\"$element(id).text\" value=\"[ad_quotehtml $text]\">"
-	    append output "<input type=\"hidden\" name=\"$element(id)\" value=\"[ad_quotehtml $select]\">"
+	    append output "<input type=\"hidden\" name=\"$element(id).text\" value=\"[ns_quotehtml $text]\">"
+	    append output "<input type=\"hidden\" name=\"$element(id)\" value=\"[ns_quotehtml $select]\">"
 	}
     }
     
@@ -1295,13 +1299,13 @@
     set output {}
     
     # edit mode
-    set checkbox_text "<input type=checkbox name=$element(name)"
+    set checkbox_text [subst {<input type="checkbox" name="$element(name)"}]
 
     foreach name [array names attributes] {
 	if {$attributes($name) eq {}} {
 	    append checkbox_text " $name"
 	} else {
-	    append checkbox_text " $name=\"$attributes($name)\""
+	    append checkbox_text [subst { $name="$attributes($name)"}]
 	}
     }
     
@@ -1328,3 +1332,11 @@
     
     return $output
 }
+
+#
+# Local variables:
+#    mode: tcl
+#    tcl-indent-level: 4
+#    indent-tabs-mode: nil
+# End:
+