From 48e2299e47dfedc578e9349d9d7b85cde1fac62c Mon Sep 17 00:00:00 2001
From: Daniel Friedman <dfriedman58@gmail.com>
Date: Wed, 23 Mar 2016 11:21:50 -0400
Subject: [PATCH] Make CMS activation_invalid template safe by default

---
 cms/templates/activation_invalid.html | 24 ++++++++++++++++++------
 1 file changed, 18 insertions(+), 6 deletions(-)

diff --git a/cms/templates/activation_invalid.html b/cms/templates/activation_invalid.html
index fd9e5a9e5f..bdb135ee3b 100644
--- a/cms/templates/activation_invalid.html
+++ b/cms/templates/activation_invalid.html
@@ -1,10 +1,18 @@
-<%! from django.utils.translation import ugettext as _ %>
+<%!
+from openedx.core.djangolib.markup import HTML, Text
+from django.utils.translation import ugettext as _
+%>
+<%page expression_filter="h"/>
 <%inherit file="base.html" />
 
 <%block name="content">
 <div class="wrapper-mast wrapper sr">
   <header class="mast">
-    <h1 class="page-header">${_("{studio_name} Account Activation").format(studio_name=settings.STUDIO_SHORT_NAME)}</h1>
+    <h1 class="page-header">
+      ${_("{studio_name} Account Activation").format(
+        studio_name=Text(settings.STUDIO_SHORT_NAME)
+      )}
+    </h1>
   </header>
 </div>
 
@@ -18,10 +26,14 @@
         <h1 class="title">${_("Your account activation is invalid")}</h1>
         <div class="copy">
           <p>${_("We're sorry. Something went wrong with your activation. Check to make sure the URL you went to was correct, as e-mail programs will sometimes split it into two lines.")}</p>
-          <p>${_("If you still have issues, contact {platform_name} Support. In the meantime, you can also return to {link_start}the {studio_name} homepage.{link_end}").format(
-              platform_name=settings.PLATFORM_NAME, studio_name=settings.STUDIO_NAME,
-              link_start='<a href="/">', link_end="</a>"
-            )}</p>
+          <p>
+            ${_("If you still have issues, contact {platform_name} Support. In the meantime, you can also return to {link_start}the {studio_name} homepage.{link_end}").format(
+              platform_name=Text(settings.PLATFORM_NAME),
+              studio_name=Text(settings.STUDIO_NAME),
+              link_start=HTML('<a href="/">'),
+              link_end=HTML('</a>')
+            )}
+          </p>
         </div>
       </div>
     </div>