jslint: insecure

js/erp5_loader.js

@@ -4483,7 +4483,7 @@
       app.util.loader("", "status_dict.forwarding");
       answer = util.parse(response);
       id = answer.id;
-      decode = /^[^\/]*%2[^\/]*$/.test(id);
+      decode = /%[0-9a-f]{2}/i..test(id);
       goto_page = decode ? id : window.encodeURIComponent(id);
 
       $.mobile.changePage(obj.state.callback.replace("__id__", goto_page));
@@ -6422,7 +6422,8 @@
     hash = $.mobile.path.parseUrl(
       url.replace($.mobile.dialogHashKey, "")
     ).hash.replace("#", "");
-    decode = /^[^\/]*%2[^\/]*$/.test(hash);
+    // decode = /^[^\/]*%2[^\/]*$/.test(hash);
+    decode = /%[0-9a-f]{2}/i.test(hash);
     backup = 0;
 
     // decode (allowing URI encoded identifiers)