Merge pull request #11887 from edx/dan-f/make-cms-404-safe

Make CMS 404 template safe by default

cms/templates/404.html

@@ -1,4 +1,8 @@
-<%! from django.utils.translation import ugettext as _ %>
+<%page expression_filter="h"/>
+<%!
+from django.utils.translation import ugettext as _
+from openedx.core.djangolib.markup import Text, HTML
+%>
 <%inherit file="base.html" />
 <%block name="title">${_("Page Not Found")}</%block>
 <%block name="bodyclass">view-util util-404</%block>
@@ -11,12 +15,14 @@
       <h1 class="title title-1">${_("Page not found")}</h1>
     </header>
     <article class="content-primary" role="main">
-      <p>${_('The page that you were looking for was not found.')}
-       ${_('Go back to the {homepage} or let us know about any pages that may have been moved at {email}.').format(
-            homepage='<a href="/">homepage</a>',
-            email=u'<a href="mailto:{address}">{address}</a>'.format(
-                address=settings.TECH_SUPPORT_EMAIL,
-            ))}
+      <p>
+      ${_('The page that you were looking for was not found.')}
+      ${Text(_('Go back to the {homepage} or let us know about any pages that may have been moved at {email}.')).format(
+        homepage=HTML('<a href="/">homepage</a>'),
+        email=HTML('<a href="mailto:{address}">{address}</a>'.format(
+          address=Text(settings.TECH_SUPPORT_EMAIL)
+        ))
+      )}
       </p>
     </article>
   </section>