Merge pull request #11900 from edx/nasthagiri/css-template

XSS Safe by default: dashboard, header, footer, navigation, help_modal

themes/edx.org/lms/templates/dashboard.html

@@ -1,3 +1,4 @@
+<%page expression_filter="h"/>
 <%inherit file="main.html" />
 <%namespace name='static' file='static_content.html'/>
 <%!
@@ -8,6 +9,7 @@ from third_party_auth import pipeline
 from microsite_configuration import microsite
 from django.core.urlresolvers import reverse
 import json
+from openedx.core.djangolib.js_utils import dump_js_escaped_json, js_escaped_string
 %>
 
 <%
@@ -40,9 +42,9 @@ import json
   <script type="text/javascript">
     $(document).ready(function() {
       edx.dashboard.legacy.init({
-        dashboard: "${reverse('dashboard')}",
-        signInUser: "${reverse('signin_user')}",
-        changeEmailSettings: "${reverse('change_email_settings')}"
+        dashboard: "${reverse('dashboard') | n, js_escaped_string}",
+        signInUser: "${reverse('signin_user') | n, js_escaped_string}",
+        changeEmailSettings: "${reverse('change_email_settings') | n, js_escaped_string}"
       });
     });
   </script>
@@ -55,7 +57,7 @@ import json
     <%static:require_module module_name="js/views/message_banner" class_name="MessageBannerView">
         var banner = new MessageBannerView({urgency: 'low', type: 'warning'});
         $('#content').prepend(banner.$el);
-        banner.showMessage(${json.dumps(redirect_message)})
+        banner.showMessage(${redirect_message | n, dump_js_escaped_json})
     </%static:require_module>
   % endif
 </%block>
@@ -118,7 +120,7 @@ import json
         <h2>${_("Course-loading errors")}</h2>
 
       % for course_dir, errors in errored_courses.items():
-         <h3>${course_dir | h}</h3>
+         <h3>${course_dir}</h3>
              <ul>
            % for (msg, err) in errors:
                <li>${msg}