clean up the onselect callback

This makes sure the provided callback is using alphanumerics only. I'm
not sure this is needed, but better safe than sorry.

lib/scripts/media.js

@@ -257,7 +257,7 @@ var dw_mediamanager = {
         edid = String.prototype.match.call(document.location, /&edid=([^&]+)/);
         edid = edid ? edid[1] : 'wiki__text';
         cb   = String.prototype.match.call(document.location, /&onselect=([^&]+)/);
-        cb   = cb ? cb[1] : 'dw_mediamanager_item_select';
+        cb   = cb ? cb[1].replace(/[^\w]+/, '') : 'dw_mediamanager_item_select';
 
         opener[cb](edid, id, opts, dw_mediamanager.align);
         if(!dw_mediamanager.keepopen) {