Use {unsafe:…|encodeJS} for outputting JavaScript strings

Author: Cyperghost

wcfsetup/install/files/acp/templates/pageBoxOrder.tpl

@@ -131,7 +131,7 @@
 		const boxes = new Map();
 		{foreach from=$boxes key=position item=boxData}
 			{if $position != 'mainMenu'}
-				boxes.set('{$position}', [{implode from=$boxData item=box}{ boxId: {$box->boxID}, name: '{unsafe:$box->name|encodeJS}', isDisabled: {if $box->isDisabled}true{else}false{/if} }{/implode}]);
+				boxes.set('{unsafe:$position|encodeJS}', [{implode from=$boxData item=box}{ boxId: {$box->boxID}, name: '{unsafe:$box->name|encodeJS}', isDisabled: {if $box->isDisabled}true{else}false{/if} }{/implode}]);
 			{/if}
 		{/foreach}