diff --git a/common/djangoapps/third_party_auth/templates/third_party_auth/post_custom_auth_entry.html b/common/djangoapps/third_party_auth/templates/third_party_auth/post_custom_auth_entry.html
index c68835d59c..d62cb05c6e 100644
--- a/common/djangoapps/third_party_auth/templates/third_party_auth/post_custom_auth_entry.html
+++ b/common/djangoapps/third_party_auth/templates/third_party_auth/post_custom_auth_entry.html
@@ -2,7 +2,7 @@
- {% trans "Please wait" %}
+ {% trans "Please wait" as tmsg %}{{tmsg|force_escape}}
diff --git a/common/lib/xmodule/xmodule/js/src/collapsible.js b/common/lib/xmodule/xmodule/js/src/collapsible.js
index 767ca8c96e..3430648e2a 100644
--- a/common/lib/xmodule/xmodule/js/src/collapsible.js
+++ b/common/lib/xmodule/xmodule/js/src/collapsible.js
@@ -29,7 +29,7 @@
// Standard longform + shortfom pattern.
el.find('.longform').hide();
- el.find('.shortform').append(linkTop, linkBottom);
+ el.find('.shortform').append(linkTop, linkBottom); // xss-lint: disable=javascript-jquery-append
// Custom longform + shortform text pattern.
short_custom = el.find('.shortform-custom');
@@ -40,7 +40,14 @@
open_text = $(elt).data('open-text');
close_text = $(elt).data('close-text');
- $(elt).append("" + open_text + '');
+ edx.HtmlUtils.append(
+ $(elt),
+ edx.HtmlUtils.joinHtml(
+ edx.HtmlUtils.HTML(""),
+ gettext(open_text),
+ edx.HtmlUtils.HTML('')
+ )
+ );
$(elt).find('.full-custom').click(function(event) {
Collapsible.toggleFull(event, open_text, close_text);
diff --git a/lms/static/js/api_admin/views/catalog_preview.js b/lms/static/js/api_admin/views/catalog_preview.js
index 4393933528..2ce1a58e13 100644
--- a/lms/static/js/api_admin/views/catalog_preview.js
+++ b/lms/static/js/api_admin/views/catalog_preview.js
@@ -6,8 +6,9 @@
'underscore',
'gettext',
'text!../../../templates/api_admin/catalog-results.underscore',
- 'text!../../../templates/api_admin/catalog-error.underscore'
- ], function(Backbone, _, gettext, catalogResultsTpl, catalogErrorTpl) {
+ 'text!../../../templates/api_admin/catalog-error.underscore',
+ 'edx-ui-toolkit/js/utils/html-utils'
+ ], function(Backbone, _, gettext, catalogResultsTpl, catalogErrorTpl, HtmlUtils) {
return Backbone.View.extend({
events: {
@@ -20,9 +21,8 @@
},
render: function() {
- this.$('#id_query').after(
- ''
- );
+ // eslint-disable-next-line
+ this.$('#id_query').after(HtmlUtils.joinHtml(HtmlUtils.HTML('')).toString());
return this;
},
@@ -44,7 +44,10 @@
method: 'GET',
success: _.bind(this.renderCourses, this),
error: _.bind(function() {
- this.$('.preview-results').html(_.template(catalogErrorTpl)({}));
+ HtmlUtils.setHtml(
+ this.$('.preview-results'),
+ HtmlUtils.template(catalogErrorTpl)({})
+ );
}, this)
});
},
@@ -54,10 +57,13 @@
* courses API.
*/
renderCourses: function(data) {
- this.$('.preview-results').html(_.template(catalogResultsTpl)({
- courses: data.results,
- catalogApiUrl: this.catalogApiUrl
- }));
+ HtmlUtils.setHtml(
+ this.$('.preview-results'),
+ HtmlUtils.template(catalogResultsTpl)({
+ courses: data.results,
+ catalogApiUrl: this.catalogApiUrl
+ })
+ );
}
});
});
diff --git a/lms/static/js/discovery/views/filter_bar.js b/lms/static/js/discovery/views/filter_bar.js
index 5f8ba9dc87..2bc0561075 100644
--- a/lms/static/js/discovery/views/filter_bar.js
+++ b/lms/static/js/discovery/views/filter_bar.js
@@ -5,8 +5,9 @@
'backbone',
'gettext',
'js/discovery/models/filter',
- 'js/discovery/views/filter_label'
- ], function($, _, Backbone, gettext, Filter, FilterLabel) {
+ 'js/discovery/views/filter_label',
+ 'edx-ui-toolkit/js/utils/html-utils'
+ ], function($, _, Backbone, gettext, Filter, FilterLabel, HtmlUtils) {
'use strict';
return Backbone.View.extend({
@@ -20,7 +21,7 @@
},
initialize: function() {
- this.tpl = _.template($(this.templateId).html());
+ this.tpl = HtmlUtils.template($(this.templateId).html());
this.render();
this.listenTo(this.collection, 'remove', this.hideIfEmpty);
this.listenTo(this.collection, 'add', this.addFilter);
@@ -28,7 +29,10 @@
},
render: function() {
- this.$el.html(this.tpl());
+ HtmlUtils.setHtml(
+ this.$el,
+ this.tpl()
+ );
this.$ul = this.$el.find('ul');
this.$el.addClass('is-animated');
return this;