XSS Safe by default - vert_module.html

lms/templates/vert_module.html

@@ -1,3 +1,4 @@
+<%page expression_filter="h"/>
 
 % if show_bookmark_button:
     <%include file='bookmark_button.html' args="bookmark_id=bookmark_id, is_bookmarked=bookmarked"/>
@@ -6,7 +7,7 @@
 <div class="vert-mod">
 % for idx, item in enumerate(items):
   <div class="vert vert-${idx}" data-id="${item['id']}">
-    ${item['content']}
+    ${item['content'] | n, unicode}
   </div>
 % endfor
 </div>