Andal.LND/edx-platform
6
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #200 from edx/security-fix/fix-xss-in-templates

Browse Source 
Security fix/fix xss in templates
This commit is contained in:
Uzair Rasheed
2020-08-31 10:53:24 +05:00
committed by GitHub
parent a206e777af 8ba1d522df
commit 372254e3cb
12 changed files with 90 additions and 90 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
cms/templates/js/course_info_handouts.underscore
View File

@@ -1,22 +1,22 @@
<a href="#" class="edit-button"><span class="edit-icon"></span><%= gettext("Edit") %></a>
<a href="#" class="edit-button"><span class="edit-icon"></span><%- gettext("Edit") %></a>
<h2 class="title"><%= gettext("Course Handouts") %></h2>
<h2 class="title"><%- gettext("Course Handouts") %></h2>
<%if (model.get('data') != null) { %>
<div class="handouts-content">
</div>
<% } else {%>
<p><%= gettext("You have no handouts defined") %></p>
<p><%- gettext("You have no handouts defined") %></p>
<% } %>
<form class="edit-handouts-form" style="display: block;">
<div class="message message-status error" name="handout_html_error" id="handout_error">
<%= gettext("There is invalid code in your content. Please check to make sure it is valid HTML.") %>
<%- gettext("There is invalid code in your content. Please check to make sure it is valid HTML.") %>
</div>
<div class="row">
<textarea class="handouts-content-editor text-editor"></textarea>
</div>
<div class="row">
<a href="#" class="save-button"><%= gettext("Save") %></a>
<a href="#" class="cancel-button"><%= gettext("Cancel") %></a>
<a href="#" class="save-button"><%- gettext("Save") %></a>
<a href="#" class="cancel-button"><%- gettext("Cancel") %></a>
</div>
</form>

8
cms/templates/js/grading-editor.underscore
View File

@@ -1,12 +1,12 @@
<h3 class="modal-section-title"><%= gettext('Grading') %></h3>
<h3 class="modal-section-title"><%- gettext('Grading') %></h3>
<div class="modal-section-content grading-type">
<ul class="list-fields list-input">
<li class="field field-grading-type field-select">
<label for="grading_type" class="label"><%= gettext('Grade as:') %></label>
<label for="grading_type" class="label"><%- gettext('Grade as:') %></label>
<select class="input" id="grading_type">
<option value="notgraded"><%= gettext('Not Graded') %></option>
<option value="notgraded"><%- gettext('Not Graded') %></option>
<% _.each(graderTypes, function(grader) { %>
<option value="<%= grader %>"><%= grader %></option>
<option value="<%- grader %>"><%- grader %></option>
<% }); %>
</select>
</li>

10
cms/templates/js/metadata-string-entry.underscore
View File

@@ -1,8 +1,8 @@
<div class="wrapper-comp-setting">
<label class="label setting-label" for="<%= uniqueId %>"><%= model.get('display_name') %></label>
<input class="input setting-input" type="text" id="<%= uniqueId %>" value='<%= model.get("value") %>'/>
<button class="action setting-clear inactive" type="button" name="setting-clear" value="<%= gettext("Clear") %>" data-tooltip="<%= gettext("Clear") %>">
<span class="icon fa fa-undo" aria-hidden="true"></span><span class="sr">"<%= gettext("Clear Value") %>"</span>
<label class="label setting-label" for="<%- uniqueId %>"><%- model.get('display_name') %></label>
<input class="input setting-input" type="text" id="<%- uniqueId %>" value='<%- model.get("value") %>'/>
<button class="action setting-clear inactive" type="button" name="setting-clear" value="<%- gettext("Clear") %>" data-tooltip="<%- gettext("Clear") %>">
<span class="icon fa fa-undo" aria-hidden="true"></span><span class="sr">"<%- gettext("Clear Value") %>"</span>
</button>
</div>
<span class="tip setting-help"><%= model.get('help') %></span>
<span class="tip setting-help"><%- model.get('help') %></span>

6
cms/templates/js/section-name-edit.underscore
View File

@@ -1,5 +1,5 @@
<form class="section-name-edit">
<input type="text" value="<%= name %>" autocomplete="off"/>
<input type="submit" class="save-button" value="<%= gettext("Save") %>" />
<input type="button" class="cancel-button" value="<%= gettext("Cancel") %>" />
<input type="text" value="<%- name %>" autocomplete="off"/>
<input type="submit" class="save-button" value="<%- gettext("Save") %>" />
<input type="button" class="cancel-button" value="<%- gettext("Cancel") %>" />
</form>

4
cms/templates/js/signatory-actions.underscore
View File

@@ -1,6 +1,6 @@
<div class="collection-edit">
<div class="actions custom-signatory-action">
<button class="signatory-panel-save action action-primary" type="submit"><%= gettext("Save") %></button>
<button class="signatory-panel-close action action-secondary action-cancel"><%= gettext("Cancel") %></button>
<button class="signatory-panel-save action action-primary" type="submit"><%- gettext("Save") %></button>
<button class="signatory-panel-close action action-secondary action-cancel"><%- gettext("Cancel") %></button>
</div>
</div>

30
cms/templates/js/team-member.underscore
View File

@@ -1,11 +1,11 @@
<li class="user-item" data-email="<%= user.email %>">
<li class="user-item" data-email="<%- user.email %>">
<span class="wrapper-ui-badge">
<span class="flag flag-role flag-role-<%= user.role %> is-hanging">
<span class="label sr"><%= gettext("Current Role:") %></span>
<span class="flag flag-role flag-role-<%- user.role %> is-hanging">
<span class="label sr"><%- gettext("Current Role:") %></span>
<span class="value">
<%= roles[user.role] %>
<%- roles[user.role] %>
<% if (is_current_user) { %>
<span class="msg-you"><%= gettext("You!") %></span>
<span class="msg-you"><%- gettext("You!") %></span>
<% } %>
</span>
</span>
@@ -13,11 +13,11 @@
<div class="item-metadata">
<h3 class="user-name">
<span class="user-username"><%= user.username %></span>
<span class="user-username"><%- user.username %></span>
<span class="user-email">
<a class="action action-email" href="mailto:<%= user.email %>"
title="<%= viewHelpers.format(gettext("send an email message to {email}"), {email: user.email})%>">
<%= user.email %>
<a class="action action-email" href="mailto:<%- user.email %>"
title="<%- viewHelpers.format(gettext("send an email message to {email}"), {email: user.email})%>">
<%- user.email %>
</a>
</span>
</h3>
@@ -29,19 +29,19 @@
<% for (var i=0; i < actions.length; i++) { %>
<% var action = actions[i]; %>
<% if (action.notoggle) { %>
<span class="admin-role notoggleforyou"><%= gettext("Promote another member to Admin to remove your admin rights") %></span>
<span class="admin-role notoggleforyou"><%- gettext("Promote another member to Admin to remove your admin rights") %></span>
<% } else { %>
<a href="#" class="make-<%= action.to_role %> admin-role <%= action.direction %>-admin-role">
<a href="#" class="make-<%- action.to_role %> admin-role <%- action.direction %>-admin-role">
<% var template = (action.direction === 'add') ? gettext("Add {role} Access") : gettext("Remove {role} Access"); %>
<%= viewHelpers.format(template, {role: action.label}) %></span>
<%- viewHelpers.format(template, {role: action.label}) %></span>
</a>
<% } %>
<% } %>
</li>
<li class="action action-delete <%=!allow_delete ? "is-disabled" : "" %> aria-disabled="<%=!allow_delete%>">
<a href="#" class="delete remove-user action-icon" data-id="<%= user.email %>">
<li class="action action-delete <%-!allow_delete ? "is-disabled" : "" %> aria-disabled="<%-!allow_delete%>">
<a href="#" class="delete remove-user action-icon" data-id="<%- user.email %>">
<span class="icon fa fa-trash-o" aria-hidden="true"></span>
<span class="sr"><%= viewHelpers.format(gettext("Delete the user, {username}"), {username:user.username}) %></span>
<span class="sr"><%- viewHelpers.format(gettext("Delete the user, {username}"), {username:user.username}) %></span>
</a>
</li>
</ul>

14
cms/templates/js/video/transcripts/messages/transcripts-import.underscore
View File

@@ -1,16 +1,16 @@
<div class="transcripts-message-status status-error"><span class="icon fa fa-remove" aria-hidden="true"></span><%= gettext("No EdX Timed Transcript") %></div>
<div class="transcripts-message-status status-error"><span class="icon fa fa-remove" aria-hidden="true"></span><%- gettext("No EdX Timed Transcript") %></div>
<p class="transcripts-message">
<%= gettext("EdX doesn't have a timed transcript for this video in Studio, but we found a transcript on YouTube. You can import the YouTube transcript or upload your own .srt transcript file.") %>
<%- gettext("EdX doesn't have a timed transcript for this video in Studio, but we found a transcript on YouTube. You can import the YouTube transcript or upload your own .srt transcript file.") %>
</p>
<div class="transcripts-file-uploader"></div>
<p class="transcripts-error-message is-invisible">
<%= gettext("Error.") %>
<%- gettext("Error.") %>
</p>
<div class="wrapper-transcripts-buttons">
<button class="action setting-import" type="button" name="setting-import" value="<%= gettext("Import YouTube Transcript") %>" data-tooltip="<%= gettext("Import YouTube Transcript") %>">
<span><%= gettext("Import YouTube Transcript") %></span>
<button class="action setting-import" type="button" name="setting-import" value="<%- gettext("Import YouTube Transcript") %>" data-tooltip="<%- gettext("Import YouTube Transcript") %>">
<span><%- gettext("Import YouTube Transcript") %></span>
</button>
<button class="action setting-upload" type="button" name="setting-upload" value="<%= gettext("Upload New Transcript") %>" data-tooltip="<%= gettext("Upload New .srt Transcript") %>">
<span><%= gettext("Upload New Transcript") %></span>
<button class="action setting-upload" type="button" name="setting-upload" value="<%- gettext("Upload New Transcript") %>" data-tooltip="<%- gettext("Upload New .srt Transcript") %>">
<span><%- gettext("Upload New Transcript") %></span>
</button>
</div>

14
cms/templates/js/video/transcripts/messages/transcripts-not-found.underscore
View File

@@ -1,16 +1,16 @@
<div class="transcripts-message-status status-error"><span class="icon fa fa-remove" aria-hidden="true"></span><%= gettext("No Timed Transcript") %></div>
<div class="transcripts-message-status status-error"><span class="icon fa fa-remove" aria-hidden="true"></span><%- gettext("No Timed Transcript") %></div>
<p class="transcripts-message">
<%= gettext("EdX doesn\'t have a timed transcript for this video. Please upload an .srt file.") %>
<%- gettext("EdX doesn\'t have a timed transcript for this video. Please upload an .srt file.") %>
</p>
<div class="transcripts-file-uploader"></div>
<p class="transcripts-error-message is-invisible">
<%= gettext("Error.") %>
<%- gettext("Error.") %>
</p>
<div class="wrapper-transcripts-buttons">
<button class="action setting-upload" type="button" name="setting-upload" value="<%= gettext("Upload New Transcript") %>" data-tooltip="<%= gettext("Upload New Transcript") %>">
<%= gettext("Upload New Transcript") %>
<button class="action setting-upload" type="button" name="setting-upload" value="<%- gettext("Upload New Transcript") %>" data-tooltip="<%- gettext("Upload New Transcript") %>">
<%- gettext("Upload New Transcript") %>
</button>
<a class="action setting-download is-disabled" aria-disabled="true" href="javascropt: void(0);" data-tooltip="<%= gettext("Download Transcript for Editing") %>">
<%= gettext("Download Transcript for Editing") %>
<a class="action setting-download is-disabled" aria-disabled="true" href="javascropt: void(0);" data-tooltip="<%- gettext("Download Transcript for Editing") %>">
<%- gettext("Download Transcript for Editing") %>
</a>
</div>

14
cms/templates/js/video/transcripts/messages/transcripts-replace.underscore
View File

@@ -1,17 +1,17 @@
<div class="transcripts-message-status status-error">
<span class="icon fa fa-remove" aria-hidden="true"></span>
<%= gettext("Timed Transcript Conflict") %>
<%- gettext("Timed Transcript Conflict") %>
</div>
<p class="transcripts-message">
<%= gettext("The timed transcript for this video on edX is out of date, but YouTube has a current timed transcript for this video.") %>
<%- gettext("The timed transcript for this video on edX is out of date, but YouTube has a current timed transcript for this video.") %>
<strong>
<%= gettext("Do you want to replace the edX transcript with the YouTube transcript?") %>
<%- gettext("Do you want to replace the edX transcript with the YouTube transcript?") %>
</strong>
</p>
<p class="transcripts-error-message is-invisible">
<%= gettext("Error.") %>
<%- gettext("Error.") %>
</p>
<div class="wrapper-transcripts-buttons">
@@ -19,11 +19,11 @@
class="action setting-replace"
type="button"
name="setting-replace"
value="<%= gettext("Yes, replace the edX transcript with the YouTube transcript") %>"
data-tooltip="<%= gettext("Yes, replace the edX transcript with the YouTube transcript") %>"
value="<%- gettext("Yes, replace the edX transcript with the YouTube transcript") %>"
data-tooltip="<%- gettext("Yes, replace the edX transcript with the YouTube transcript") %>"
>
<span>
<%= gettext("Yes, replace the edX transcript with the YouTube transcript") %>
<%- gettext("Yes, replace the edX transcript with the YouTube transcript") %>
</span>
</button>
</div>

14
cms/templates/js/video/transcripts/messages/transcripts-uploaded.underscore
View File

@@ -1,16 +1,16 @@
<div class="transcripts-message-status"><span class="icon fa fa-check" aria-hidden="true"></span><%= gettext("Timed Transcript Uploaded Successfully") %></div>
<div class="transcripts-message-status"><span class="icon fa fa-check" aria-hidden="true"></span><%- gettext("Timed Transcript Uploaded Successfully") %></div>
<p class="transcripts-message">
<%= gettext("EdX has a timed transcript for this video. If you want to replace this transcript, upload a new .srt transcript file. If you want to edit this transcript, you can download, edit, and re-upload the existing transcript.") %>
<%- gettext("EdX has a timed transcript for this video. If you want to replace this transcript, upload a new .srt transcript file. If you want to edit this transcript, you can download, edit, and re-upload the existing transcript.") %>
</p>
<div class="transcripts-file-uploader"></div>
<p class="transcripts-error-message is-invisible">
<%= gettext("Error.") %>
<%- gettext("Error.") %>
</p>
<div class="wrapper-transcripts-buttons">
<button class="action setting-upload" type="button" name="setting-upload" value="<%= gettext("Upload New Transcript") %>" data-tooltip="<%= gettext("Upload New Transcript") %>">
<span><%= gettext("Upload New Transcript") %></span>
<button class="action setting-upload" type="button" name="setting-upload" value="<%- gettext("Upload New Transcript") %>" data-tooltip="<%- gettext("Upload New Transcript") %>">
<span><%- gettext("Upload New Transcript") %></span>
</button>
<a class="action setting-download" href="/transcripts/download?locator=<%= component_locator %>" data-tooltip="<%= gettext("Download Transcript for Editing") %>">
<span><%= gettext("Download Transcript for Editing") %></span>
<a class="action setting-download" href="/transcripts/download?locator=<%- component_locator %>" data-tooltip="<%- gettext("Download Transcript for Editing") %>">
<span><%- gettext("Download Transcript for Editing") %></span>
</a>
</div>

18
cms/templates/js/video/transcripts/messages/transcripts-use-existing.underscore
View File

@@ -1,16 +1,16 @@
<div class="transcripts-message-status status-error">
<span class="icon fa fa-remove" aria-hidden="true"></span>
<%= gettext("Confirm Timed Transcript") %>
<%- gettext("Confirm Timed Transcript") %>
</div>
<p class="transcripts-message">
<%= gettext("You changed a video URL, but did not change the timed transcript file. Do you want to use the current timed transcript or upload a new .srt transcript file?") %>
<%- gettext("You changed a video URL, but did not change the timed transcript file. Do you want to use the current timed transcript or upload a new .srt transcript file?") %>
</p>
<div class="transcripts-file-uploader"></div>
<p class="transcripts-error-message is-invisible">
<%= gettext("Error.") %>
<%- gettext("Error.") %>
</p>
<div class="wrapper-transcripts-buttons">
@@ -18,22 +18,22 @@
class="action setting-use-existing"
type="button"
name="setting-use-existing"
value="<%= gettext("Use Current Transcript") %>"
data-tooltip="<%= gettext("Use Current Transcript") %>"
value="<%- gettext("Use Current Transcript") %>"
data-tooltip="<%- gettext("Use Current Transcript") %>"
>
<span>
<%= gettext("Use Current Transcript") %>
<%- gettext("Use Current Transcript") %>
</span>
</button>
<button
class="action setting-upload"
type="button"
name="setting-upload"
value="<%= gettext("Upload New Transcript") %>"
data-tooltip="<%= gettext("Upload New Transcript") %>"
value="<%- gettext("Upload New Transcript") %>"
data-tooltip="<%- gettext("Upload New Transcript") %>"
>
<span>
<%= gettext("Upload New Transcript") %>
<%- gettext("Upload New Transcript") %>
</span>
</button>
</div>

36
cms/templates/js/xblock-outline.underscore
View File

@@ -1,13 +1,13 @@
<% if (parentInfo) { %>
<li class="outline-item outline-item-<%= xblockType %> <%= includesChildren ? 'is-collapsible' : '' %> is-draggable <%= isCollapsed ? 'is-collapsed' : '' %>"
data-parent="<%= parentInfo.get('id') %>" data-locator="<%= xblockInfo.get('id') %>">
<li class="outline-item outline-item-<%- xblockType %> <%- includesChildren ? 'is-collapsible' : '' %> is-draggable <%- isCollapsed ? 'is-collapsed' : '' %>"
data-parent="<%- parentInfo.get('id') %>" data-locator="<%- xblockInfo.get('id') %>">
<span class="draggable-drop-indicator draggable-drop-indicator-before"><span class="icon fa fa-caret-right" aria-hidden="true"></span></span>
<div class="wrapper-xblock-header">
<div class="wrapper-xblock-header-primary">
<% if (includesChildren) { %>
<h3 class="xblock-title expand-collapse <%= isCollapsed ? 'expand' : 'collapse' %>"
title="<%= interpolate(
<h3 class="xblock-title expand-collapse <%- isCollapsed ? 'expand' : 'collapse' %>"
title="<%- interpolate(
gettext('Collapse/Expand this %(xblock_type)s'), { xblock_type: xblockTypeDisplayName }, true
) %>"
>
@@ -17,7 +17,7 @@
<% } %>
<% if (xblockInfo.get('studio_url') && xblockInfo.get('category') !== 'chapter') { %>
<a href="<%= xblockInfo.get('studio_url') %>"><%- xblockInfo.get('display_name') %></a>
<a href="<%- xblockInfo.get('studio_url') %>"><%- xblockInfo.get('display_name') %></a>
<% } else { %>
<span class="wrapper-xblock-field is-editable" data-field="display_name">
<span class="xblock-field-value"><%- xblockInfo.get('display_name') %></span>
@@ -28,9 +28,9 @@
<div class="item-actions">
<ul class="actions-list">
<li class="action-item action-delete">
<a href="#" data-tooltip="<%= gettext('Delete') %>" class="delete-button action-button">
<a href="#" data-tooltip="<%- gettext('Delete') %>" class="delete-button action-button">
<span class="icon fa fa-remove" aria-hidden="true"></span>
<span class="sr"><%= gettext('Delete') %></span>
<span class="sr"><%- gettext('Delete') %></span>
</a>
</li>
</ul>
@@ -40,7 +40,7 @@
<% if (xblockInfo.get('release_date')) { %>
<div class="meta-info">
<span class="icon fa fa-clock-o" aria-hidden="true"></span>
<%= gettext('Released:') %> <%= xblockInfo.get('release_date') %>
<%- gettext('Released:') %> <%- xblockInfo.get('release_date') %>
</div>
<% } %>
@@ -54,30 +54,30 @@
<% } %>
<% if (!parentInfo && xblockInfo.get('child_info') && xblockInfo.get('child_info').children.length === 0) { %>
<div class="no-content add-xblock-component">
<p><%= gettext("You haven't added any content to this course yet.") %>
<a href="#" class="button button-new" data-category="<%= childCategory %>"
data-parent="<%= xblockInfo.get('id') %>" data-default-name="<%= defaultNewChildName %>"
title="<%= interpolate(
<p><%- gettext("You haven't added any content to this course yet.") %>
<a href="#" class="button button-new" data-category="<%- childCategory %>"
data-parent="<%- xblockInfo.get('id') %>" data-default-name="<%- defaultNewChildName %>"
title="<%- interpolate(
gettext('Click to add a new %(xblock_type)s'), { xblock_type: defaultNewChildName }, true
) %>"
>
<span class="icon fa fa-plus" aria-hidden="true"></span><%= addChildLabel %>
<span class="icon fa fa-plus" aria-hidden="true"></span><%- addChildLabel %>
</a>
</p>
</div>
<% } else { %>
<ol class="sortable-list sortable-<%= xblockType %>-list">
<ol class="sortable-list sortable-<%- xblockType %>-list">
</ol>
<% if (childType) { %>
<div class="add-xblock-component">
<a href="#" class="button button-new" data-category="<%= childCategory %>"
data-parent="<%= xblockInfo.get('id') %>" data-default-name="<%= defaultNewChildName %>"
title="<%= interpolate(
<a href="#" class="button button-new" data-category="<%- childCategory %>"
data-parent="<%- xblockInfo.get('id') %>" data-default-name="<%- defaultNewChildName %>"
title="<%- interpolate(
gettext('Click to add a new %(xblock_type)s'), { xblock_type: defaultNewChildName }, true
) %>"
>
<span class="icon fa fa-plus" aria-hidden="true"></span><%= addChildLabel %>
<span class="icon fa fa-plus" aria-hidden="true"></span><%- addChildLabel %>
</a>
</div>
<% } %>