[SECURITY] XSS in colorpicker wizard

Encode user-input in JavaScript context for colorpicker.

Change-Id: If3da2b476a98efa67815bf84095843ab2f65949f
Fixes: #42772
Releases: 6.2, 6.1, 6.0, 4.7, 4.5
Security-Commit: 53916aedfe2f09c5659cc2e28c8089df8c72e259
Security-Bulletin: TYPO3-CORE-SA-2013-004
Reviewed-on: https://review.typo3.org/26214
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader
[SECURITY] XSS in header link of all content elements

The second typolink parameter, that is the target, can be abused to
introduce XSS code into the generated link. Escaping the parameter
with quoteJSvalue solves the problem.a

Change-Id: I716b206571bcba4ad71817641beea0350e4b9fa0
Fixes: #31206
Releases: 6.2, 6.1, 6.0, 4.7, 4.5
Security-Commit: 821a9edaec8d3d19e2d43a4e82d4d94e25d5517b
Security-Bulletin: TYPO3-CORE-SA-2013-004
Reviewed-on: https://review.typo3.org/26215
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader