From 15e5a7dbf101fe692a82fe34d361a720fdc74054 Mon Sep 17 00:00:00 2001 From: Nimisha Asthagiri Date: Wed, 23 Mar 2016 11:57:17 -0400 Subject: [PATCH 1/4] XSS Safe by default - vert_module.html --- lms/templates/vert_module.html | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/lms/templates/vert_module.html b/lms/templates/vert_module.html index c5b02ff55b..df882124e1 100644 --- a/lms/templates/vert_module.html +++ b/lms/templates/vert_module.html @@ -1,3 +1,4 @@ +<%page expression_filter="h"/> % if show_bookmark_button: <%include file='bookmark_button.html' args="bookmark_id=bookmark_id, is_bookmarked=bookmarked"/> @@ -6,7 +7,7 @@
% for idx, item in enumerate(items):
- ${item['content']} + ${item['content'] | n, unicode}
% endfor
From 6eec5ac4725faa1f8d7703552f423de036d571b9 Mon Sep 17 00:00:00 2001 From: Nimisha Asthagiri Date: Wed, 23 Mar 2016 13:35:50 -0400 Subject: [PATCH 2/4] XSS Safe Default - dashboard --- common/djangoapps/student/tests/tests.py | 11 +- lms/templates/dashboard.html | 15 +- .../dashboard/_dashboard_course_listing.html | 138 ++++++++++-------- .../_dashboard_status_verification.html | 1 + themes/edx.org/lms/templates/dashboard.html | 12 +- 5 files changed, 97 insertions(+), 80 deletions(-) diff --git a/common/djangoapps/student/tests/tests.py b/common/djangoapps/student/tests/tests.py index 0566460dd1..a688cc66f4 100644 --- a/common/djangoapps/student/tests/tests.py +++ b/common/djangoapps/student/tests/tests.py @@ -249,11 +249,14 @@ class DashboardTest(ModuleStoreTestCase): Test that the certificate verification status for courses is visible on the dashboard. """ self.client.login(username="jack", password="test") - self._check_verification_status_on('verified', 'You\'re enrolled as a verified student') - self._check_verification_status_on('honor', 'You\'re enrolled as an honor code student') + self._check_verification_status_on('verified', 'You're enrolled as a verified student') + self._check_verification_status_on('honor', 'You're enrolled as an honor code student') self._check_verification_status_off('audit', '') - self._check_verification_status_on('professional', 'You\'re enrolled as a professional education student') - self._check_verification_status_on('no-id-professional', 'You\'re enrolled as a professional education student') + self._check_verification_status_on('professional', 'You're enrolled as a professional education student') + self._check_verification_status_on( + 'no-id-professional', + 'You're enrolled as a professional education student', + ) @unittest.skipUnless(settings.ROOT_URLCONF == 'lms.urls', 'Test only valid in lms') def _check_verification_status_off(self, mode, value): diff --git a/lms/templates/dashboard.html b/lms/templates/dashboard.html index 54861f320e..c8c67aac69 100644 --- a/lms/templates/dashboard.html +++ b/lms/templates/dashboard.html @@ -1,12 +1,13 @@ +<%page expression_filter="h"/> <%inherit file="main.html" /> <%namespace name='static' file='static_content.html'/> <%! +from django.core.urlresolvers import reverse from django.utils.translation import ugettext as _ from django.template import RequestContext import third_party_auth from third_party_auth import pipeline -from django.core.urlresolvers import reverse -import json +from openedx.core.djangolib.js_utils import dump_js_escaped_json, js_escaped_string %> <% @@ -39,9 +40,9 @@ import json @@ -54,7 +55,7 @@ import json <%static:require_module module_name="js/views/message_banner" class_name="MessageBannerView"> var banner = new MessageBannerView({urgency: 'low', type: 'warning'}); $('#content').prepend(banner.$el); - banner.showMessage(${json.dumps(redirect_message)}) + banner.showMessage(${redirect_message | n, dump_js_escaped_json}) % endif @@ -117,7 +118,7 @@ import json

${_("Course-loading errors")}

% for course_dir, errors in errored_courses.items(): -

${course_dir | h}

+

${course_dir}