From 6887ab1c260501e50e07547bb1a827dc189bd16f Mon Sep 17 00:00:00 2001 From: uzairr Date: Fri, 21 Aug 2020 12:36:08 +0500 Subject: [PATCH 01/12] Fix xss in course handout template PROD-2002 --- cms/templates/js/course_info_handouts.underscore | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/cms/templates/js/course_info_handouts.underscore b/cms/templates/js/course_info_handouts.underscore index 16d48118da..dfa78587dd 100644 --- a/cms/templates/js/course_info_handouts.underscore +++ b/cms/templates/js/course_info_handouts.underscore @@ -1,22 +1,22 @@ -<%= gettext("Edit") %> +<%- gettext("Edit") %> -

<%= gettext("Course Handouts") %>

+

<%- gettext("Course Handouts") %>

<%if (model.get('data') != null) { %>
<% } else {%> -

<%= gettext("You have no handouts defined") %>

+

<%- gettext("You have no handouts defined") %>

<% } %>
- <%= gettext("There is invalid code in your content. Please check to make sure it is valid HTML.") %> + <%- gettext("There is invalid code in your content. Please check to make sure it is valid HTML.") %>
- <%= gettext("Save") %> - <%= gettext("Cancel") %> + <%- gettext("Save") %> + <%- gettext("Cancel") %>
From 643736e6130b9abcbe664270f776d5793cc44763 Mon Sep 17 00:00:00 2001 From: uzairr Date: Fri, 21 Aug 2020 12:38:37 +0500 Subject: [PATCH 02/12] Fix xss in signatories templates PROD-2010 --- cms/templates/js/signatory-actions.underscore | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/cms/templates/js/signatory-actions.underscore b/cms/templates/js/signatory-actions.underscore index e0c4ab60c5..08c65d0ce1 100644 --- a/cms/templates/js/signatory-actions.underscore +++ b/cms/templates/js/signatory-actions.underscore @@ -1,6 +1,6 @@
- - + +
From e890ec6dd5136028ddbbbe46597d684d2977b5d5 Mon Sep 17 00:00:00 2001 From: uzairr Date: Fri, 21 Aug 2020 12:52:27 +0500 Subject: [PATCH 03/12] Fix xss in team member template PROD-2009 --- cms/templates/js/team-member.underscore | 30 ++++++++++++------------- 1 file changed, 15 insertions(+), 15 deletions(-) diff --git a/cms/templates/js/team-member.underscore b/cms/templates/js/team-member.underscore index afd20271b8..ec9fb356cf 100644 --- a/cms/templates/js/team-member.underscore +++ b/cms/templates/js/team-member.underscore @@ -1,11 +1,11 @@ -
  • +
  • - - <%= gettext("Current Role:") %> + + <%- gettext("Current Role:") %> - <%= roles[user.role] %> + <%- roles[user.role] %> <% if (is_current_user) { %> - <%= gettext("You!") %> + <%- gettext("You!") %> <% } %> @@ -13,11 +13,11 @@

    - <%= user.username %> + <%- user.username %> - "> - <%= user.email %> + "> + <%- user.email %>

    @@ -29,19 +29,19 @@ <% for (var i=0; i < actions.length; i++) { %> <% var action = actions[i]; %> <% if (action.notoggle) { %> - <%= gettext("Promote another member to Admin to remove your admin rights") %> + <%- gettext("Promote another member to Admin to remove your admin rights") %> <% } else { %> - + <% var template = (action.direction === 'add') ? gettext("Add {role} Access") : gettext("Remove {role} Access"); %> - <%= viewHelpers.format(template, {role: action.label}) %> + <%- viewHelpers.format(template, {role: action.label}) %> <% } %> <% } %>
    • -
  • aria-disabled="<%=!allow_delete%>"> - +
  • aria-disabled="<%-!allow_delete%>"> + - <%= viewHelpers.format(gettext("Delete the user, {username}"), {username:user.username}) %> + <%- viewHelpers.format(gettext("Delete the user, {username}"), {username:user.username}) %>
    • From 103a4f20a6c076d97c8a995c717e107066681890 Mon Sep 17 00:00:00 2001 From: uzairr Date: Fri, 21 Aug 2020 12:56:30 +0500 Subject: [PATCH 04/12] Fix xss in transcript template PROD-2012 --- .../transcripts-use-existing.underscore | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/cms/templates/js/video/transcripts/messages/transcripts-use-existing.underscore b/cms/templates/js/video/transcripts/messages/transcripts-use-existing.underscore index c884e8bf23..64c81664c4 100644 --- a/cms/templates/js/video/transcripts/messages/transcripts-use-existing.underscore +++ b/cms/templates/js/video/transcripts/messages/transcripts-use-existing.underscore @@ -1,16 +1,16 @@
    - <%= gettext("Confirm Timed Transcript") %> + <%- gettext("Confirm Timed Transcript") %>

    - <%= gettext("You changed a video URL, but did not change the timed transcript file. Do you want to use the current timed transcript or upload a new .srt transcript file?") %> + <%- gettext("You changed a video URL, but did not change the timed transcript file. Do you want to use the current timed transcript or upload a new .srt transcript file?") %>

    @@ -18,22 +18,22 @@ class="action setting-use-existing" type="button" name="setting-use-existing" - value="<%= gettext("Use Current Transcript") %>" - data-tooltip="<%= gettext("Use Current Transcript") %>" + value="<%- gettext("Use Current Transcript") %>" + data-tooltip="<%- gettext("Use Current Transcript") %>" > - <%= gettext("Use Current Transcript") %> + <%- gettext("Use Current Transcript") %>
    From ef014f5d7f05b1a746f7bb518cf3d7a61f8950f5 Mon Sep 17 00:00:00 2001 From: uzairr Date: Fri, 21 Aug 2020 13:00:30 +0500 Subject: [PATCH 05/12] Fix xss in transcript upload template PROD-2014 --- .../messages/transcripts-uploaded.underscore | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/cms/templates/js/video/transcripts/messages/transcripts-uploaded.underscore b/cms/templates/js/video/transcripts/messages/transcripts-uploaded.underscore index 4740d280e5..5f93f1d28c 100644 --- a/cms/templates/js/video/transcripts/messages/transcripts-uploaded.underscore +++ b/cms/templates/js/video/transcripts/messages/transcripts-uploaded.underscore @@ -1,16 +1,16 @@ -
    <%= gettext("Timed Transcript Uploaded Successfully") %>
    +
    <%- gettext("Timed Transcript Uploaded Successfully") %>

    -<%= gettext("EdX has a timed transcript for this video. If you want to replace this transcript, upload a new .srt transcript file. If you want to edit this transcript, you can download, edit, and re-upload the existing transcript.") %> +<%- gettext("EdX has a timed transcript for this video. If you want to replace this transcript, upload a new .srt transcript file. If you want to edit this transcript, you can download, edit, and re-upload the existing transcript.") %>

    - - "> - <%= gettext("Download Transcript for Editing") %> + "> + <%- gettext("Download Transcript for Editing") %>
    From 57823e16dccc841accc254c2eaeea47fd3d402bc Mon Sep 17 00:00:00 2001 From: uzairr Date: Fri, 21 Aug 2020 13:04:48 +0500 Subject: [PATCH 06/12] fix xss in transcript import template PROD-2018 --- .../messages/transcripts-import.underscore | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/cms/templates/js/video/transcripts/messages/transcripts-import.underscore b/cms/templates/js/video/transcripts/messages/transcripts-import.underscore index 7cc544488c..5229466112 100644 --- a/cms/templates/js/video/transcripts/messages/transcripts-import.underscore +++ b/cms/templates/js/video/transcripts/messages/transcripts-import.underscore @@ -1,16 +1,16 @@ -
    <%= gettext("No EdX Timed Transcript") %>
    +
    <%- gettext("No EdX Timed Transcript") %>

    -<%= gettext("EdX doesn't have a timed transcript for this video in Studio, but we found a transcript on YouTube. You can import the YouTube transcript or upload your own .srt transcript file.") %> +<%- gettext("EdX doesn't have a timed transcript for this video in Studio, but we found a transcript on YouTube. You can import the YouTube transcript or upload your own .srt transcript file.") %>

    - -
    From 4481908b020aa209b85fa30193be0e66b67f15dc Mon Sep 17 00:00:00 2001 From: uzairr Date: Fri, 21 Aug 2020 13:06:35 +0500 Subject: [PATCH 07/12] fix xss in edit section template PROD-2011 --- cms/templates/js/section-name-edit.underscore | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/cms/templates/js/section-name-edit.underscore b/cms/templates/js/section-name-edit.underscore index cfbd64fffe..97034f1e55 100644 --- a/cms/templates/js/section-name-edit.underscore +++ b/cms/templates/js/section-name-edit.underscore @@ -1,5 +1,5 @@
    - - " /> - " /> + + " /> + " />
    From ec5a1be52b01ec21d8fe08719d0d83f2e05fc1ac Mon Sep 17 00:00:00 2001 From: uzairr Date: Fri, 21 Aug 2020 13:08:43 +0500 Subject: [PATCH 08/12] fix xss in transcript replace template PROD-2013 --- .../messages/transcripts-replace.underscore | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/cms/templates/js/video/transcripts/messages/transcripts-replace.underscore b/cms/templates/js/video/transcripts/messages/transcripts-replace.underscore index fa63c200b6..ddd91aa1d5 100644 --- a/cms/templates/js/video/transcripts/messages/transcripts-replace.underscore +++ b/cms/templates/js/video/transcripts/messages/transcripts-replace.underscore @@ -1,17 +1,17 @@
    - <%= gettext("Timed Transcript Conflict") %> + <%- gettext("Timed Transcript Conflict") %>

    - <%= gettext("The timed transcript for this video on edX is out of date, but YouTube has a current timed transcript for this video.") %> + <%- gettext("The timed transcript for this video on edX is out of date, but YouTube has a current timed transcript for this video.") %> - <%= gettext("Do you want to replace the edX transcript with the YouTube transcript?") %> + <%- gettext("Do you want to replace the edX transcript with the YouTube transcript?") %>

    @@ -19,11 +19,11 @@ class="action setting-replace" type="button" name="setting-replace" - value="<%= gettext("Yes, replace the edX transcript with the YouTube transcript") %>" - data-tooltip="<%= gettext("Yes, replace the edX transcript with the YouTube transcript") %>" + value="<%- gettext("Yes, replace the edX transcript with the YouTube transcript") %>" + data-tooltip="<%- gettext("Yes, replace the edX transcript with the YouTube transcript") %>" > - <%= gettext("Yes, replace the edX transcript with the YouTube transcript") %> + <%- gettext("Yes, replace the edX transcript with the YouTube transcript") %>
    From 636240a4000b36822b36368468cd1b6a5d24796b Mon Sep 17 00:00:00 2001 From: uzairr Date: Fri, 21 Aug 2020 13:11:43 +0500 Subject: [PATCH 09/12] fix xss in metadata template PROD-2015 --- cms/templates/js/metadata-string-entry.underscore | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/cms/templates/js/metadata-string-entry.underscore b/cms/templates/js/metadata-string-entry.underscore index 538528afc2..d2946818b2 100644 --- a/cms/templates/js/metadata-string-entry.underscore +++ b/cms/templates/js/metadata-string-entry.underscore @@ -1,8 +1,8 @@
    - - -
    -<%= model.get('help') %> +<%- model.get('help') %> From 1c737b3dd9df9ecef5a0b96ce020f4551838406b Mon Sep 17 00:00:00 2001 From: uzairr Date: Fri, 21 Aug 2020 13:17:38 +0500 Subject: [PATCH 10/12] fix xblock outline template PROD-2019 --- cms/templates/js/xblock-outline.underscore | 36 +++++++++++----------- 1 file changed, 18 insertions(+), 18 deletions(-) diff --git a/cms/templates/js/xblock-outline.underscore b/cms/templates/js/xblock-outline.underscore index 59ee9a9816..0312389fbf 100644 --- a/cms/templates/js/xblock-outline.underscore +++ b/cms/templates/js/xblock-outline.underscore @@ -1,13 +1,13 @@ <% if (parentInfo) { %> -
  • +
  • <% if (includesChildren) { %> -

    " + title="<%- interpolate( gettext('Collapse/Expand this %(xblock_type)s'), { xblock_type: xblockTypeDisplayName }, true ) %>" > @@ -17,7 +17,7 @@ <% } %> <% if (xblockInfo.get('studio_url') && xblockInfo.get('category') !== 'chapter') { %> - <%- xblockInfo.get('display_name') %> + <%- xblockInfo.get('display_name') %> <% } else { %> <%- xblockInfo.get('display_name') %> @@ -28,9 +28,9 @@
    @@ -40,7 +40,7 @@ <% if (xblockInfo.get('release_date')) { %>
    - <%= gettext('Released:') %> <%= xblockInfo.get('release_date') %> + <%- gettext('Released:') %> <%- xblockInfo.get('release_date') %>
    <% } %> @@ -54,30 +54,30 @@ <% } %> <% if (!parentInfo && xblockInfo.get('child_info') && xblockInfo.get('child_info').children.length === 0) { %>
    -

    <%= gettext("You haven't added any content to this course yet.") %> - + - <%= addChildLabel %> + <%- addChildLabel %>

    <% } else { %> -
      +
      <% if (childType) { %>
      - - <%= addChildLabel %> + <%- addChildLabel %>
      <% } %> From ffd585cfab9f9b38f8798ea98bf26e3d2293daa0 Mon Sep 17 00:00:00 2001 From: uzairr Date: Fri, 21 Aug 2020 13:19:46 +0500 Subject: [PATCH 11/12] fix xss in grading editor template PROD-2024 --- cms/templates/js/grading-editor.underscore | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/cms/templates/js/grading-editor.underscore b/cms/templates/js/grading-editor.underscore index 7db05aa5ff..243de60361 100644 --- a/cms/templates/js/grading-editor.underscore +++ b/cms/templates/js/grading-editor.underscore @@ -1,12 +1,12 @@ -

      <%= gettext('Grading') %>

      +

      <%- gettext('Grading') %>

      • - +
        • From 8ba1d522df261e1c80d4828ec8f7d80f2e59afec Mon Sep 17 00:00:00 2001 From: uzairr Date: Fri, 21 Aug 2020 13:31:49 +0500 Subject: [PATCH 12/12] fix xss in transcript not found template PROD-2017 --- .../messages/transcripts-not-found.underscore | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/cms/templates/js/video/transcripts/messages/transcripts-not-found.underscore b/cms/templates/js/video/transcripts/messages/transcripts-not-found.underscore index 6bb74c635e..daa33a1f69 100644 --- a/cms/templates/js/video/transcripts/messages/transcripts-not-found.underscore +++ b/cms/templates/js/video/transcripts/messages/transcripts-not-found.underscore @@ -1,16 +1,16 @@ -
        <%= gettext("No Timed Transcript") %>
        +
        <%- gettext("No Timed Transcript") %>

        -<%= gettext("EdX doesn\'t have a timed transcript for this video. Please upload an .srt file.") %> +<%- gettext("EdX doesn\'t have a timed transcript for this video. Please upload an .srt file.") %>

        - - "> - <%= gettext("Download Transcript for Editing") %> + "> + <%- gettext("Download Transcript for Editing") %>