From e26f8f223a59b2b700b9dbdba4f7be3880bdc9a0 Mon Sep 17 00:00:00 2001
From: azanbinzahid <azan.zahid@arbisoft.com>
Date: Wed, 9 Dec 2020 18:01:58 +0500
Subject: [PATCH 01/12] PROD-2210

---
 common/lib/xmodule/xmodule/js/src/video/04_video_control.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/common/lib/xmodule/xmodule/js/src/video/04_video_control.js b/common/lib/xmodule/xmodule/js/src/video/04_video_control.js
index f80c0edd9f..fc6557160c 100644
--- a/common/lib/xmodule/xmodule/js/src/video/04_video_control.js
+++ b/common/lib/xmodule/xmodule/js/src/video/04_video_control.js
@@ -154,7 +154,7 @@
                 var endTime = (this.config.endTime !== null) ? this.config.endTime : params.duration;
                 // in case endTime is accidentally specified as being greater than the video
                 endTime = Math.min(endTime, params.duration);
-                this.videoControl.vidTimeEl.html(Time.format(params.time) + ' / ' + Time.format(endTime));
+                this.videoControl.vidTimeEl.text(Time.format(params.time) + ' / ' + Time.format(endTime));
             }
         }
     );

From f45b526692d1444735c376ccb70923b6d720eef4 Mon Sep 17 00:00:00 2001
From: Ali-D-Akbar <aliakbarit019@gmail.com>
Date: Thu, 10 Dec 2020 14:42:38 +0500
Subject: [PATCH 02/12] PROD-2188

PROD-2188
---
 lms/static/js/course_survey.js | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/lms/static/js/course_survey.js b/lms/static/js/course_survey.js
index 286cd26b13..90c65f09d8 100644
--- a/lms/static/js/course_survey.js
+++ b/lms/static/js/course_survey.js
@@ -23,22 +23,25 @@ $(function() {
         var cancel_submit = false;
 
         $inputs.each(function() {
+            var val, fieldLabel;
             /* see if it is a required field and - if so - make sure user presented all information */
             if (typeof $(this).attr('required') !== typeof undefined) {
-                var val = $(this).val();
+                val = $(this).val();
                 if (typeof(val) === 'string') {
                     if (val.trim().length === 0) {
-                        var field_label = $(this).parent().find('label');
+                        fieldLabel = $(this).parent().find('label');
                         $(this).parent().addClass('field-error');
-                        $('.status.message.submission-error .message-copy').append("<li class='error-item'>" + field_label.text() + '</li>');
+                        // eslint-disable-next-line max-len
+                        $('.status.message.submission-error .message-copy').append(edx.HtmlUtils.joinHtml(edx.HtmlUtils.HTML("<li class='error-item'>"), fieldLabel.text(), edx.HtmlUtils.HTML('</li>')).toString());
                         cancel_submit = true;
                     }
                 } else if (typeof(val) === 'object') {
                     /* for SELECT statements */
                     if (val === null || val.length === 0 || val[0] === '') {
-                        var field_label = $(this).parent().find('label');
+                        fieldLabel = $(this).parent().find('label');
                         $(this).parent().addClass('field-error');
-                        $('.status.message.submission-error .message-copy').append("<li class='error-item'>" + field_label.text() + '</li>');
+                        // eslint-disable-next-line max-len
+                        $('.status.message.submission-error .message-copy').append(edx.HtmlUtils.joinHtml(edx.HtmlUtils.HTML("<li class='error-item'>"), fieldLabel.text(), edx.HtmlUtils.HTML('</li>')).toString());
                         cancel_submit = true;
                     }
                 }
@@ -70,7 +73,7 @@ $(function() {
         json = $.parseJSON(jqXHR.responseText);
         $('.status.message.submission-error').addClass('is-shown').focus();
         $('.status.message.submission-error .message-copy').
-            html(gettext('There has been an error processing your survey.')).
+            text(gettext('There has been an error processing your survey.')).
             stop().
             css('display', 'block');
     });

From 7788b9ea623848eef3fc8e91490272220b611370 Mon Sep 17 00:00:00 2001
From: azanbinzahid <azan.zahid@arbisoft.com>
Date: Thu, 10 Dec 2020 15:01:59 +0500
Subject: [PATCH 03/12] PROD-2185

---
 lms/static/js/customwmd.js | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lms/static/js/customwmd.js b/lms/static/js/customwmd.js
index e0ad1b5473..0f4cfccaee 100644
--- a/lms/static/js/customwmd.js
+++ b/lms/static/js/customwmd.js
@@ -201,8 +201,8 @@ Mostly adapted from math.stackexchange.com: http://cdn.sstatic.net/js/mathjax-ed
                               .append($("<textarea>")
                               .addClass("wmd-input")
                               .attr("id", wmdInputId)
-                              .html(initialText))
-                              .append($wmdPreviewContainer); // xss-lint: disable=javascript-jquery-html
+                              .html(initialText)) // xss-lint: disable=javascript-jquery-html
+                              .append($wmdPreviewContainer);
         $elem.append($wmdPanel);
       }
       converter = Markdown.getMathCompatibleConverter(postProcessor);

From 17261b9886256c2bcc55507372532f9da321ba22 Mon Sep 17 00:00:00 2001
From: azanbinzahid <azan.zahid@arbisoft.com>
Date: Thu, 10 Dec 2020 15:23:53 +0500
Subject: [PATCH 04/12] PROD-2143

---
 common/static/js/capa/chemical_equation_preview.js | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/common/static/js/capa/chemical_equation_preview.js b/common/static/js/capa/chemical_equation_preview.js
index 85a1c2ac67..d23d8e51d3 100644
--- a/common/static/js/capa/chemical_equation_preview.js
+++ b/common/static/js/capa/chemical_equation_preview.js
@@ -3,9 +3,16 @@
         function create_handler(saved_div) {
             return (function(response) {
                 if (response.error) {
-                    saved_div.html("<span class='error'>" + response.error + '</span>');
+                    edx.HtmlUtils.setHtml(
+                        saved_div,
+                        edx.HtmlUtils.joinHtml(
+                            edx.HtmlUtils.HTML("<span class='error'>"),
+                            response.error,
+                            edx.HtmlUtils.HTML('</span>')
+                        )
+                    );
                 } else {
-                    saved_div.html(response.preview);
+                    saved_div.html(edx.HtmlUtils.HTML(response.preview).toString());
                 }
             });
         }

From 7c60e39a72e48285bb14ba0a4b95d5f430006a0d Mon Sep 17 00:00:00 2001
From: azanbinzahid <azan.zahid@arbisoft.com>
Date: Thu, 10 Dec 2020 15:26:25 +0500
Subject: [PATCH 05/12] PROD-2184

---
 lms/static/js/leanModal.js | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/lms/static/js/leanModal.js b/lms/static/js/leanModal.js
index 468a36706d..586b63fdd6 100644
--- a/lms/static/js/leanModal.js
+++ b/lms/static/js/leanModal.js
@@ -20,7 +20,10 @@
             };
             var overlay = '<div id="lean_overlay"></div>';
             if ($('#lean_overlay').length === 0) {
-                $('body').append($(overlay));
+                edx.HtmlUtils.append(
+                    $('body'),
+                    $(overlay)
+                );
             }
 
             options = $.extend(defaults, options);  // eslint-disable-line no-param-reassign

From bee77a2c7f336b2b9d766a5274aea31d62556a65 Mon Sep 17 00:00:00 2001
From: azanbinzahid <azan.zahid@arbisoft.com>
Date: Thu, 10 Dec 2020 15:30:36 +0500
Subject: [PATCH 06/12] PROD-2190

---
 lms/static/js/learner_dashboard/views/collection_list_view.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lms/static/js/learner_dashboard/views/collection_list_view.js b/lms/static/js/learner_dashboard/views/collection_list_view.js
index 46a807ebc5..4237c4fe1c 100644
--- a/lms/static/js/learner_dashboard/views/collection_list_view.js
+++ b/lms/static/js/learner_dashboard/views/collection_list_view.js
@@ -33,7 +33,7 @@ class CollectionListView extends Backbone.View {
         this.$el.before(HtmlUtils.ensureHtml(this.getTitleHtml()).toString());
       }
 
-      this.$el.html(childList);
+      this.$el.html(HtmlUtils.HTML(childList).toString());
     }
   }
 

From 3ed0f7d8ea2c83dbc494e83029430a70c700326f Mon Sep 17 00:00:00 2001
From: azanbinzahid <azan.zahid@arbisoft.com>
Date: Thu, 10 Dec 2020 15:37:36 +0500
Subject: [PATCH 07/12] PROD-2196

---
 .../js/components/header/views/header.js      | 47 +++++++++++--------
 1 file changed, 27 insertions(+), 20 deletions(-)

diff --git a/lms/static/js/components/header/views/header.js b/lms/static/js/components/header/views/header.js
index 2c4ca36211..0f584f5242 100644
--- a/lms/static/js/components/header/views/header.js
+++ b/lms/static/js/components/header/views/header.js
@@ -3,26 +3,33 @@
  */
 (function(define) {
     'use strict';
-    define(['backbone', 'text!templates/components/header/header.underscore'],
-           function(Backbone, headerTemplate) {
-               var HeaderView = Backbone.View.extend({
-                   initialize: function(options) {
-                       this.template = _.template(headerTemplate);
-                       this.headerActionsView = options.headerActionsView;
-                       this.listenTo(this.model, 'change', this.render);
-                       this.render();
-                   },
+    define([
+        'backbone',
+        'text!templates/components/header/header.underscore',
+        'edx-ui-toolkit/js/utils/html-utils'
+    ],
+    function(Backbone, headerTemplate, HtmlUtils) {
+        var HeaderView = Backbone.View.extend({
+            initialize: function(options) {
+                this.template = HtmlUtils.template(headerTemplate);
+                this.headerActionsView = options.headerActionsView;
+                this.listenTo(this.model, 'change', this.render);
+                this.render();
+            },
 
-                   render: function() {
-                       var json = this.model.attributes;
-                       this.$el.html(this.template(json));
-                       if (this.headerActionsView) {
-                           this.headerActionsView.setElement(this.$('.page-header-secondary')).render();
-                       }
-                       return this;
-                   }
-               });
+            render: function() {
+                var json = this.model.attributes;
+                HtmlUtils.setHtml(
+                    this.$el,
+                    this.template(json)
+                );
+                if (this.headerActionsView) {
+                    this.headerActionsView.setElement(this.$('.page-header-secondary')).render();
+                }
+                return this;
+            }
+        });
 
-               return HeaderView;
-           });
+        return HeaderView;
+    });
 }).call(this, define || RequireJS.define);

From 6d7752b5c1ab42fc614f83ffbb7cea3c9282e51f Mon Sep 17 00:00:00 2001
From: azanbinzahid <azan.zahid@arbisoft.com>
Date: Fri, 11 Dec 2020 15:52:21 +0500
Subject: [PATCH 08/12] PROD-2212

---
 .../static/js/capa/drag_and_drop/targets.js   | 56 +++++++++----------
 1 file changed, 26 insertions(+), 30 deletions(-)

diff --git a/common/static/js/capa/drag_and_drop/targets.js b/common/static/js/capa/drag_and_drop/targets.js
index ffbf47f1e8..a6787d3d5d 100644
--- a/common/static/js/capa/drag_and_drop/targets.js
+++ b/common/static/js/capa/drag_and_drop/targets.js
@@ -1,5 +1,5 @@
 (function(requirejs, require, define) {
-    define([], function() {
+    define(['edx-ui-toolkit/js/utils/html-utils'], function(HtmlUtils) {
         return {
             initializeBaseTargets: initializeBaseTargets,
             initializeTargetField: initializeTargetField,
@@ -76,17 +76,19 @@
             }
 
             $targetEl = $(
-            '<div ' +
-                'style=" ' +
-                    'display: block; ' +
-                    'position: absolute; ' +
-                    'width: ' + obj.w + 'px; ' +
-                    'height: ' + obj.h + 'px; ' +
-                    'top: ' + obj.y + 'px; ' +
-                    'left: ' + obj.x + 'px; ' +
-                    borderCss +
-                '" ' +
-            'aria-dropeffect=""></div>'
+                HtmlUtils.joinHtml(
+                    HtmlUtils.HTML('<div style="display: block; position: absolute; width: '),
+                    obj.w,
+                    HtmlUtils.HTML('px; height: '),
+                    obj.h,
+                    HtmlUtils.HTML('px; top: '),
+                    obj.y,
+                    HtmlUtils.HTML('px; left: '),
+                    obj.x,
+                    HtmlUtils.HTML('px; '),
+                    borderCss,
+                    HtmlUtils.HTML('"aria-dropeffect=""></div>')
+                ).toString()
         );
             if (fromTargetField === true) {
                 $targetEl.appendTo(draggableObj.iconEl);
@@ -100,23 +102,17 @@
 
             if (state.config.onePerTarget === false) {
                 $numTextEl = $(
-                '<div ' +
-                    'style=" ' +
-                        'display: block; ' +
-                        'position: absolute; ' +
-                        'width: 24px; ' +
-                        'height: 24px; ' +
-                        'top: ' + obj.y + 'px; ' +
-                        'left: ' + (obj.x + obj.w - 24) + 'px; ' +
-                        'border: 1px solid black; ' +
-                        'text-align: center; ' +
-                        'z-index: 500; ' +
-                        'background-color: white; ' +
-                        'font-size: 0.95em; ' +
-                        'color: #009fe2; ' +
-                    '" ' +
-                '>0</div>'
-            );
+                    HtmlUtils.joinHtml(
+                        HtmlUtils.HTML('<div style=" display: block; position: absolute;'),
+                        HtmlUtils.HTML('width: 24px; height: 24px; top: '),
+                        obj.y,
+                        HtmlUtils.HTML('px; left: '),
+                        obj.x,
+                        obj.w - 24,
+                        HtmlUtils.HTML('px; border: 1px solid black; text-align: center; z-index: 500;'),
+                        HtmlUtils.HTML('background-color: white; font-size: 0.95em; color: #009fe2; ">0</div>')
+                    ).toString()
+                );
             } else {
                 $numTextEl = null;
             }
@@ -263,7 +259,7 @@
 
         function updateNumTextEl() {
             if (this.numTextEl !== null) {
-                this.numTextEl.html(this.draggableList.length);
+                this.numTextEl.text(this.draggableList.length);
             }
         }
     }); // End-of: define([], function () {

From 6c514eb9dc4f3a70b46e50b5a90c569cb7fe2313 Mon Sep 17 00:00:00 2001
From: azanbinzahid <azan.zahid@arbisoft.com>
Date: Fri, 11 Dec 2020 16:42:21 +0500
Subject: [PATCH 09/12] PROD-2200

---
 lms/static/js/edxnotes/views/tab_panel.js | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/lms/static/js/edxnotes/views/tab_panel.js b/lms/static/js/edxnotes/views/tab_panel.js
index 0f9dd45034..4cc67fd41b 100644
--- a/lms/static/js/edxnotes/views/tab_panel.js
+++ b/lms/static/js/edxnotes/views/tab_panel.js
@@ -1,13 +1,14 @@
 (function(define, undefined) {
     'use strict';
     define(['gettext', 'underscore', 'backbone', 'js/edxnotes/views/note_item',
-        'common/js/components/views/paging_header', 'common/js/components/views/paging_footer'],
-function(gettext, _, Backbone, NoteItemView, PagingHeaderView, PagingFooterView) {
+        'common/js/components/views/paging_header', 'common/js/components/views/paging_footer',
+        'edx-ui-toolkit/js/utils/html-utils'],
+function(gettext, _, Backbone, NoteItemView, PagingHeaderView, PagingFooterView, HtmlUtils) {
     var TabPanelView = Backbone.View.extend({
         tagName: 'section',
         className: 'tab-panel',
         title: '',
-        titleTemplate: _.template('<h2 class="sr"><%- text %></h2>'),
+        titleTemplate: HtmlUtils.template('<h2 class="sr"><%- text %></h2>'),
         attributes: {
             tabindex: -1
         },
@@ -25,7 +26,10 @@ function(gettext, _, Backbone, NoteItemView, PagingHeaderView, PagingFooterView)
         },
 
         render: function() {
-            this.$el.html(this.getTitle());
+            HtmlUtils.setHtml(
+                this.$el,
+                this.getTitle()
+            );
             this.renderView(this.pagingHeaderView);
             this.renderContent();
             this.renderView(this.pagingFooterView);

From cd1d07b081d12e65833355a526e0dad342c93105 Mon Sep 17 00:00:00 2001
From: azanbinzahid <azan.zahid@arbisoft.com>
Date: Fri, 11 Dec 2020 16:49:23 +0500
Subject: [PATCH 10/12] PROD-2210

---
 lms/static/js/edxnotes/views/tab_item.js | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/lms/static/js/edxnotes/views/tab_item.js b/lms/static/js/edxnotes/views/tab_item.js
index b6d1dc814a..b5ca38c7ba 100644
--- a/lms/static/js/edxnotes/views/tab_item.js
+++ b/lms/static/js/edxnotes/views/tab_item.js
@@ -1,7 +1,8 @@
 (function(define, undefined) {
     'use strict';
-    define(['gettext', 'underscore', 'jquery', 'backbone', 'js/edxnotes/utils/template'],
-function(gettext, _, $, Backbone, templateUtils) {
+    define(['gettext', 'underscore',
+        'jquery', 'backbone', 'js/edxnotes/utils/template', 'edx-ui-toolkit/js/utils/html-utils'],
+function(gettext, _, $, Backbone, templateUtils, HtmlUtils) {
     var TabItemView = Backbone.View.extend({
         tagName: 'li',
         className: 'tab',
@@ -34,7 +35,7 @@ function(gettext, _, $, Backbone, templateUtils) {
 
         render: function() {
             var html = this.template(this.model.toJSON());
-            this.$el.html(html);
+            this.$el.html(HtmlUtils.HTML(html).toString());
             return this;
         },
 

From 4a54aa8054dd298de82a7b65cb17b5aeff395488 Mon Sep 17 00:00:00 2001
From: Ali-D-Akbar <aliakbarit019@gmail.com>
Date: Fri, 11 Dec 2020 18:37:38 +0500
Subject: [PATCH 11/12] PROD-2157

---
 common/lib/xmodule/xmodule/backcompat_module.py | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/common/lib/xmodule/xmodule/backcompat_module.py b/common/lib/xmodule/xmodule/backcompat_module.py
index cb9314f90e..3f86df9426 100644
--- a/common/lib/xmodule/xmodule/backcompat_module.py
+++ b/common/lib/xmodule/xmodule/backcompat_module.py
@@ -9,6 +9,8 @@ from functools import wraps
 
 from lxml import etree
 
+from openedx.core.djangolib.markup import Text
+
 from .x_module import XModuleDescriptor
 
 log = logging.getLogger(__name__)
@@ -74,8 +76,8 @@ class SemanticSectionDescriptor(XModuleDescriptor):
         the child element
         """
         xml_object = etree.fromstring(xml_data)
-        system.error_tracker("WARNING: the <{0}> tag is deprecated.  Please do not use in new content."
-                             .format(xml_object.tag))
+        system.error_tracker(Text("WARNING: the <{tag}> tag is deprecated.  Please do not use in new content.")
+                             .format(tag=xml_object.tag))
 
         if len(xml_object) == 1:
             for (key, val) in xml_object.items():
@@ -98,8 +100,8 @@ class TranslateCustomTagDescriptor(XModuleDescriptor):
         """
 
         xml_object = etree.fromstring(xml_data)
-        system.error_tracker('WARNING: the <{tag}> tag is deprecated.  '
-                             'Instead, use <customtag impl="{tag}" attr1="..." attr2="..."/>. '
+        system.error_tracker(Text('WARNING: the <{tag}> tag is deprecated.  '
+                             'Instead, use <customtag impl="{tag}" attr1="..." attr2="..."/>. ')
                              .format(tag=xml_object.tag))
 
         tag = xml_object.tag

From a5982c7e09b29756f6e975eea1755f108e9127a5 Mon Sep 17 00:00:00 2001
From: Ali-D-Akbar <aliakbarit019@gmail.com>
Date: Mon, 14 Dec 2020 14:41:07 +0500
Subject: [PATCH 12/12] PROD-2160

---
 .../xmodule/js/fixtures/imageinput.underscore    | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/common/lib/xmodule/xmodule/js/fixtures/imageinput.underscore b/common/lib/xmodule/xmodule/js/fixtures/imageinput.underscore
index bafdd797c9..a6ec5dc894 100644
--- a/common/lib/xmodule/xmodule/js/fixtures/imageinput.underscore
+++ b/common/lib/xmodule/xmodule/js/fixtures/imageinput.underscore
@@ -2,24 +2,24 @@
 <!-- ${width}  = 300   -->
 <!-- ${height} = 400   -->
 
-<div class="imageinput capa_inputtype" id="inputtype_<%=id%>">
+<div class="imageinput capa_inputtype" id="inputtype_<%-id%>">
     <input
         type="hidden"
         class="imageinput"
         src=""
-        name="input_<%=id%>"
-        id="input_<%=id%>"
+        name="input_<%-id%>"
+        id="input_<%-id%>"
         value=""
     />
 
     <div style="position:relative;">
         <div
-            id="imageinput_<%=id%>"
-            style="width: <%=width%>px; height: <%=height%>px; position: relative; left: 0; top: 0; visibility: hidden;"
+            id="imageinput_<%-id%>"
+            style="width: <%-width%>px; height: <%-height%>px; position: relative; left: 0; top: 0; visibility: hidden;"
         >
             <!-- image will go here -->
         </div>
-        <div id="answer_<%=id%>" data-width="100" data-height="100"></div>
+        <div id="answer_<%-id%>" data-width="100" data-height="100"></div>
     </div>
 
 
@@ -27,8 +27,8 @@
         <span
             class="unanswered"
             style="display: inline-block;"
-            id="status_<%=id%>"
-            aria-describedby="input_<%=id%>"
+            id="status_<%-id%>"
+            aria-describedby="input_<%-id%>"
         >
             <span class="sr">Status: unanswered</span>
         </span>