feat(popupdoc): Escape unsafe variables {title, descr, tconfirm} in popupdoc() (refs #4914)