diff --git a/cms/templates/base.html b/cms/templates/base.html index 0ec319c1fa..1a81e9192c 100644 --- a/cms/templates/base.html +++ b/cms/templates/base.html @@ -1,5 +1,6 @@ ## -*- coding: utf-8 -*- <%! from django.utils.translation import ugettext as _ %> +<%! from django.template.defaultfilters import escapejs %> <%namespace name='static' file='static_content.html'/> @@ -14,7 +15,7 @@ <%block name="title"> | % if context_course: <% ctx_loc = context_course.location %> - ${context_course.display_name_with_default} | + ${context_course.display_name_with_default | h} | % endif edX Studio @@ -329,7 +330,7 @@ @@ -37,7 +38,7 @@ require(["domReady!", "jquery", "jquery.form", "js/views/course_rerun"], functio

${_("You are creating a re-run from:")} - ${source_course_key.org} ${source_course_key.course} ${source_course_key.run} + ${source_course_key.org | h} ${source_course_key.course | h} ${source_course_key.run | h} ${display_name}

@@ -79,7 +80,7 @@ require(["domReady!", "jquery", "jquery.form", "js/views/course_rerun"], functio
  • - + ${_("The name of the organization sponsoring the new course. (This name is often the same as the original organization name.)")} ${_("Note: No spaces or special characters are allowed.")} @@ -90,7 +91,7 @@ require(["domReady!", "jquery", "jquery.form", "js/views/course_rerun"], functio
  • - + ${_("The unique number that identifies the new course within the organization. (This number is often the same as the original course number.)")} ${_("Note: No spaces or special characters are allowed.")} diff --git a/cms/templates/course_info.html b/cms/templates/course_info.html index 7a44f142e3..71e3149566 100644 --- a/cms/templates/course_info.html +++ b/cms/templates/course_info.html @@ -1,5 +1,6 @@ -<%! +<%! from django.utils.translation import ugettext as _ + from django.template.defaultfilters import escapejs %> <%inherit file="base.html" /> <%def name="online_help_token()"><% return "updates" %> @@ -20,7 +21,7 @@ <%block name="jsextra"> diff --git a/lms/templates/main.html b/lms/templates/main.html index 4c5d50ef1c..c3895de287 100644 --- a/lms/templates/main.html +++ b/lms/templates/main.html @@ -11,7 +11,7 @@ <%! from microsite_configuration import page_title_breadcrumbs %> <%namespace name='static' file='static_content.html'/> -<%! from django.utils import html %> +<%! from django.utils.http import urlquote_plus %> ## Define a couple of helper functions to make life easier when ## embedding theme conditionals into templates. All inheriting @@ -148,7 +148,7 @@ <%def name="login_query()">${ u"?course_id={0}&enrollment_action={1}".format( - html.escape(course_id), - html.escape(enrollment_action) + urlquote_plus(course_id), + urlquote_plus(enrollment_action) ) if course_id and enrollment_action else "" } diff --git a/lms/templates/peer_grading/peer_grading.html b/lms/templates/peer_grading/peer_grading.html index 172360c9e2..d868347445 100644 --- a/lms/templates/peer_grading/peer_grading.html +++ b/lms/templates/peer_grading/peer_grading.html @@ -41,7 +41,7 @@ criteria.{end_li_tag} %if problem['closed']: ${problem['problem_name']} %else: - ${problem['problem_name']} + ${problem['problem_name']} %endif diff --git a/lms/templates/peer_grading/peer_grading_problem.html b/lms/templates/peer_grading/peer_grading_problem.html index 52c6f6ced0..67d575dc4f 100644 --- a/lms/templates/peer_grading/peer_grading_problem.html +++ b/lms/templates/peer_grading/peer_grading_problem.html @@ -1,6 +1,6 @@ <%! from django.utils.translation import ugettext as _ %>
    -
    +
    @@ -48,7 +48,7 @@

    - + ${_("This submission has explicit, offensive, or (I suspect) plagiarized content. ")}
    diff --git a/lms/templates/shoppingcart/receipt.html b/lms/templates/shoppingcart/receipt.html index 7a35bc014f..f393473143 100644 --- a/lms/templates/shoppingcart/receipt.html +++ b/lms/templates/shoppingcart/receipt.html @@ -52,7 +52,7 @@ % if item.status == "purchased": ${item.qty} ${item.line_desc} - ${_('View Course')} + ${_('View Course')} ${"{0:0.2f}".format(item.unit_cost)} % if item.list_price != None: ${"{0:0.2f}".format(item.list_price)} diff --git a/lms/templates/staff_problem_info.html b/lms/templates/staff_problem_info.html index 6bed4a7d68..75d2789d7c 100644 --- a/lms/templates/staff_problem_info.html +++ b/lms/templates/staff_problem_info.html @@ -1,4 +1,5 @@ <%! from django.utils.translation import ugettext as _ %> +<%! from django.template.defaultfilters import escapejs %> <%namespace name='static' file='/static_content.html'/> ## The JS for this is defined in xqa_interface.html @@ -9,10 +10,10 @@ ${block_content} Edit % if xqa_key: / QA % endif
    @@ -58,10 +59,10 @@ ${block_content}

    ${_('Actions')}

    - - + +
    -
    +
    [ ${_('Reset Student Attempts')} % if has_instructor_access: @@ -72,7 +73,7 @@ ${block_content} % endif ]
    -
    +
    @@ -106,7 +107,7 @@ category = ${category | h}
    - +
    @@ -129,7 +130,7 @@ $(function () { null, %endif { - 'location': '${location.to_deprecated_string()}', + 'location': '${location | escapejs}', 'xqa_key': '${xqa_key}', 'category': '${category}', 'user': '${user}' diff --git a/lms/templates/sysadmin_dashboard_gitlogs.html b/lms/templates/sysadmin_dashboard_gitlogs.html index fbc3ea3b77..6217114a78 100644 --- a/lms/templates/sysadmin_dashboard_gitlogs.html +++ b/lms/templates/sysadmin_dashboard_gitlogs.html @@ -75,7 +75,7 @@ textarea { %if course_id is not None: ## Translators: Git is a version-control system; see http://git-scm.com/about -

    ${_('Recent git load activity for {course_id}').format(course_id=course_id)}

    +

    ${_('Recent git load activity for {course_id}').format(course_id=course_id) | h}

    %if error_msg:

    ${_('Error')}:

    ${error_msg}

    @@ -100,15 +100,13 @@ textarea { %> % for cil in logs: <% - course_id_string = cil.course_id.to_deprecated_string() if cil.course_id else None - # Appropriate datetime string for current locale and timezone date = get_time_display(cil.created.replace(tzinfo=UTC), DEFAULT_DATE_TIME_FORMAT, coerce_tz=settings.TIME_ZONE) %> ${date} - ${course_id_string} + ${cil.course_id | h} ${cil.git_log} %endfor diff --git a/lms/templates/verify_student/midcourse_photo_reverification.html b/lms/templates/verify_student/midcourse_photo_reverification.html index e1bca374e2..177c7ca8ce 100644 --- a/lms/templates/verify_student/midcourse_photo_reverification.html +++ b/lms/templates/verify_student/midcourse_photo_reverification.html @@ -174,7 +174,7 @@
  • - +
    • diff --git a/lms/templates/verify_student/verified.html b/lms/templates/verify_student/verified.html index 8059db32f1..d90da34f35 100644 --- a/lms/templates/verify_student/verified.html +++ b/lms/templates/verify_student/verified.html @@ -1,5 +1,6 @@ <%! from django.utils.translation import ugettext as _ %> <%! from django.core.urlresolvers import reverse %> +<%! from django.template.defaultfilters import escapejs %> <%inherit file="../main.html" /> <%namespace name='static' file='/static_content.html'/> @@ -14,7 +15,7 @@ var submitToPaymentProcessing = function(event) { var xhr = $.post( "${create_order_url}", { - "course_id" : "${course_id}", + "course_id" : "${course_id | escapejs}", }, function(data) { for (prop in data) {