Fix edx-platform templates for xss.

This is part 2 of a multiple PR to escape edx-platform templates to prevent xss attack. PROD-465
2019-07-05 04:58:19 +05:00
parent 92c7a43011
commit 30d8dfb5dd
26 changed files with 84 additions and 35 deletions
--- a/lms/templates/debug/run_python_form.html
+++ b/lms/templates/debug/run_python_form.html
@@ -1,3 +1,4 @@
+<%page expression_filter="h"/>
 <%! from django.utils.translation import ugettext as _ %>
 <html><body>
 <div>
@@ -5,7 +6,7 @@
 <form method='post'>
    <input type="hidden" name="csrfmiddlewaretoken" value="${ csrf_token }">
    <div>
-        <textarea name='code' rows='20' cols='80'>${code|h}</textarea>
+        <textarea name='code' rows='20' cols='80'>${code}</textarea>
    </div>
    <input type='submit' value='Run it!'/>
 </form>
@@ -14,7 +15,7 @@
 <div>
    <p>${_("Results:")}</p>
    <pre>
-${results|h}
+${results}
 </pre>
 </div>
 %endif