Andal.LND/edx-platform
6
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #192 from edx/security-fix/fix-xss-edit-member

Browse Source 
Fix xss in edit member template
This commit is contained in:
Uzair Rasheed
2020-07-30 10:59:21 +05:00
committed by GitHub
parent 00f4ea3fc3 6b8f903188
commit 32fae72852
1 changed files with 7 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
lms/djangoapps/teams/static/teams/templates/edit-team-member.underscore
View File

@@ -1,16 +1,16 @@
<li class="team-member">
<a class="member-profile" href="<%= memberProfileUrl %>">
<img class="image-url" src="<%= imageUrl %>" alt="<%= username %>'s profile page" />
<a class="member-profile" href="<%= memberProfileUrl /* xss-lint: disable=underscore-not-escaped */%>">
<img class="image-url" src="<%= imageUrl /* xss-lint: disable=underscore-not-escaped */%>" alt="<%= username /* xss-lint: disable=underscore-not-escaped */%>'s profile page" />
</a>
<div class="member-info-container">
<span class="primary"><%= username %></span>
<span class="primary"><%= username /* xss-lint: disable=underscore-not-escaped */%></span>
<div class="secondary">
<span id="date-joined"><%= dateJoined %></span>
<span id="date-joined"><%= dateJoined /* xss-lint: disable=underscore-not-escaped */%></span>
<span> | </span>
<span id="last-active"><%= lastActive %></span>
<span id="last-active"><%= lastActive /* xss-lint: disable=underscore-not-escaped */%></span>
</div>
</div>
<button class="action-remove-member" data-username="<%= username %>">
<%- gettext("Remove") %><span class="sr">&nbsp;<%= username %></span>
<button class="action-remove-member" data-username="<%= username /* xss-lint: disable=underscore-not-escaped */%>">
<%- gettext("Remove") %><span class="sr">&nbsp;<%= username /* xss-lint: disable=underscore-not-escaped */%></span>
</button>
</li>