From 7077c933a40825fab79f0213b314938ebde1b38e Mon Sep 17 00:00:00 2001 From: Eric Fischer Date: Wed, 23 Mar 2016 12:01:25 -0400 Subject: [PATCH] Make verify_student templates safe Fixes safe_template_linter errors for everything under verify_student. Includes fixes to Jasmine tests and usage of HtmlUtils functionality. --- lms/static/js/spec/main.js | 3 ++ .../js/verify_student/views/step_view.js | 2 +- lms/templates/verify_student/error.underscore | 2 +- .../verify_student/face_photo_step.underscore | 4 +-- .../verify_student/id_photo_step.underscore | 2 +- .../verify_student/incourse_reverify.html | 1 + .../incourse_reverify.underscore | 4 +-- .../verify_student/intro_step.underscore | 10 ++++-- .../make_payment_step.underscore | 30 ++++++++++------- .../make_payment_step_ab_testing.underscore | 32 ++++++++++++------- .../verify_student/missed_deadline.html | 1 + .../verify_student/pay_and_verify.html | 27 ++++++++++------ .../payment_confirmation_step.underscore | 9 +++++- lms/templates/verify_student/reverify.html | 1 + .../verify_student/reverify_not_allowed.html | 1 + .../review_photos_step.underscore | 2 +- .../test/fake_softwaresecure_response.html | 8 +++-- 17 files changed, 92 insertions(+), 47 deletions(-) diff --git a/lms/static/js/spec/main.js b/lms/static/js/spec/main.js index 4b5505fdb2..97f57f521f 100644 --- a/lms/static/js/spec/main.js +++ b/lms/static/js/spec/main.js @@ -364,6 +364,9 @@ // Set global variables that the payment code is expecting to be defined window._ = require('underscore'); window._.str = require('underscore.string'); + window.edx = edx || {}; + window.edx.HtmlUtils = require('edx-ui-toolkit/js/utils/html-utils'); + window.edx.StringUtils = require('edx-ui-toolkit/js/utils/string-utils'); } }, 'js/verify_student/views/intro_step_view': { diff --git a/lms/static/js/verify_student/views/step_view.js b/lms/static/js/verify_student/views/step_view.js index b752e0393b..fd5e941cb5 100644 --- a/lms/static/js/verify_student/views/step_view.js +++ b/lms/static/js/verify_student/views/step_view.js @@ -35,7 +35,7 @@ this.updateContext( this.templateContext() ).done( function( templateContext ) { // Render the template into the DOM - $( this.el ).html( _.template( templateHtml)( templateContext ) ); + edx.HtmlUtils.setHtml( $(this.el), edx.HtmlUtils.template(templateHtml)( templateContext ) ); // Allow subclasses to install custom event handlers this.postRender(); diff --git a/lms/templates/verify_student/error.underscore b/lms/templates/verify_student/error.underscore index 4939e7add3..730a17cceb 100644 --- a/lms/templates/verify_student/error.underscore +++ b/lms/templates/verify_student/error.underscore @@ -7,7 +7,7 @@ <%- errorTitle %>
-

<%= errorMsg %>

+

<%- errorMsg %>

diff --git a/lms/templates/verify_student/face_photo_step.underscore b/lms/templates/verify_student/face_photo_step.underscore index 381cbce274..2ea1b5b113 100644 --- a/lms/templates/verify_student/face_photo_step.underscore +++ b/lms/templates/verify_student/face_photo_step.underscore @@ -16,7 +16,7 @@

<%- gettext( "Take Your Photo" ) %>

-

<%= _.sprintf( gettext( "When your face is in position, use the camera button %(icon)s below to take your photo." ), { icon: '(icon)' } ) %>

+

<%= HtmlUtils.interpolateHtml( gettext( "When your face is in position, use the camera button {icon} below to take your photo." ), { icon: HtmlUtils.HTML('(icon)') } ) %>

@@ -31,7 +31,7 @@
  • <%- gettext( "The photo of your face matches the photo on your ID." ) %>
    • -

    <%= _.sprintf( gettext( "To use the current photo, select the camera button %(icon)s. To take another photo, select the retake button %(icon)s." ), { icon: '(icon)' } ) %>

    +

    <%= HtmlUtils.interpolateHtml( gettext( "To use the current photo, select the camera button {icon}. To take another photo, select the retake button {icon}." ), { icon: HtmlUtils.HTML('(icon)') } ) %>

    diff --git a/lms/templates/verify_student/id_photo_step.underscore b/lms/templates/verify_student/id_photo_step.underscore index 7c24b5a76a..ea356ae224 100644 --- a/lms/templates/verify_student/id_photo_step.underscore +++ b/lms/templates/verify_student/id_photo_step.underscore @@ -19,7 +19,7 @@
  • <%- gettext( "Ensure that you can see your photo and read your name" ) %>
  • <%- gettext( "Make sure your ID is well-lit" ) %>
  • - <%= _.sprintf( gettext( "Once in position, use the camera button %(icon)s to capture your ID" ), { icon: '()' } ) %> + <%= HtmlUtils.interpolateHtml( gettext( "Once in position, use the camera button {icon} to capture your ID" ), { icon: HtmlUtils.HTML('()') } ) %>
  • <%- gettext( "Use the retake photo button if you are not pleased with your photo" ) %>
    • diff --git a/lms/templates/verify_student/incourse_reverify.html b/lms/templates/verify_student/incourse_reverify.html index d107275575..fc451529b7 100644 --- a/lms/templates/verify_student/incourse_reverify.html +++ b/lms/templates/verify_student/incourse_reverify.html @@ -1,3 +1,4 @@ +<%page expression_filter="h"/> <%! from django.utils.translation import ugettext as _ %> diff --git a/lms/templates/verify_student/incourse_reverify.underscore b/lms/templates/verify_student/incourse_reverify.underscore index f842e43f67..d252aece06 100644 --- a/lms/templates/verify_student/incourse_reverify.underscore +++ b/lms/templates/verify_student/incourse_reverify.underscore @@ -17,7 +17,7 @@
  • <%- gettext( "Make sure your face is well-lit" ) %>
  • <%- gettext( "Be sure your entire face is inside the frame" ) %>
  • - <%= _.sprintf( gettext( "Once in position, use the camera button %(icon)s to capture your photo" ), { icon: '()' } ) %> + <%= HtmlUtils.interpolateHtml( gettext( "Once in position, use the camera button {icon} to capture your photo" ), { icon: HtmlUtils.HTML('()') } ) %>
  • <%- gettext( "Can we match the photo you took with the one on your ID?" ) %>
  • <%- gettext( "Use the retake photo button if you are not pleased with your photo" ) %>
    • @@ -44,7 +44,7 @@
    - +
    diff --git a/lms/templates/verify_student/intro_step.underscore b/lms/templates/verify_student/intro_step.underscore index 6822162881..578ec363ac 100644 --- a/lms/templates/verify_student/intro_step.underscore +++ b/lms/templates/verify_student/intro_step.underscore @@ -2,9 +2,13 @@
    <% if ( hasPaid ) { %>

    - <%= _.sprintf( - gettext( "Thanks for returning to verify your ID in: %(courseName)s"), - { courseName: '' + courseName + '' } + <%= HtmlUtils.interpolateHtml( + gettext( "Thanks for returning to verify your ID in: {courseName}"), + { courseName: HtmlUtils.joinHtml( + HtmlUtils.HTML(''), + courseName, + HtmlUtils.HTML('') + ) } ) %>

    <% } else { %> diff --git a/lms/templates/verify_student/make_payment_step.underscore b/lms/templates/verify_student/make_payment_step.underscore index 4f572426c1..dcd4c7fb1c 100644 --- a/lms/templates/verify_student/make_payment_step.underscore +++ b/lms/templates/verify_student/make_payment_step.underscore @@ -2,17 +2,25 @@
    <% if ( !upgrade ) { %>

    - <%= _.sprintf( - gettext( "You are enrolling in: %(courseName)s"), - { courseName: '' + courseName + '' } - ) %> + <%= HtmlUtils.interpolateHtml( + gettext( "You are enrolling in: {courseName}"), + { courseName: HtmlUtils.joinHtml( + HtmlUtils.HTML(''), + courseName, + HtmlUtils.HTML('') + ) } + ) %>

    <% } else { %>

    - <%= _.sprintf( - gettext( "You are upgrading your enrollment for: %(courseName)s"), - { courseName: '' + courseName + '' } - ) %> + <%= HtmlUtils.interpolateHtml( + gettext( "You are upgrading your enrollment for: {courseName}"), + { courseName: HtmlUtils.joinHtml( + HtmlUtils.HTML(''), + courseName, + HtmlUtils.HTML('') + ) } + ) %>

    <%- gettext( "You can now enter your payment information and complete your enrollment." ) %> @@ -89,9 +97,9 @@

    <%- gettext( "You have already verified your ID!" ) %>

    - <%= _.sprintf( - gettext( "Your verification status is good until %(verificationGoodUntil)s." ), - { verificationGoodUntil: verificationGoodUntil } + <%- StringUtils.interpolate( + gettext( "Your verification status is good until {verificationGoodUntil}." ), + { verificationGoodUntil: verificationGoodUntil } ) %>

    diff --git a/lms/templates/verify_student/make_payment_step_ab_testing.underscore b/lms/templates/verify_student/make_payment_step_ab_testing.underscore index 7afa00adeb..bf09bdbc9c 100644 --- a/lms/templates/verify_student/make_payment_step_ab_testing.underscore +++ b/lms/templates/verify_student/make_payment_step_ab_testing.underscore @@ -6,17 +6,25 @@ <% } else if ( !upgrade ) { %>

    - <%= _.sprintf( - gettext( "You are enrolling in %(courseName)s"), - { courseName: '' + courseName + '' } - ) %> + <%= HtmlUtils.interpolateHtml( + gettext( "You are enrolling in: {courseName}"), + { courseName: HtmlUtils.joinHtml( + HtmlUtils.HTML(''), + courseName, + HtmlUtils.HTML('') + ) } + ) %>

    <% } else { %>

    - <%= _.sprintf( - gettext( "Upgrade to a Verified Certificate for %(courseName)s"), - { courseName: '' + courseName + '' } - ) %> + <%= HtmlUtils.interpolateHtml( + gettext( "Upgrade to a Verified Certificate for {courseName}"), + { courseName: HtmlUtils.joinHtml( + HtmlUtils.HTML(''), + courseName, + HtmlUtils.HTML('') + ) } + ) %>

    <% } %> @@ -33,12 +41,12 @@

    <% if ( courseModeSlug === 'no-id-professional' || courseModeSlug === 'professional') { %> - <%= _.sprintf( - gettext( "Professional Certificate for %(courseName)s"),{ courseName: courseName } + <%- StringUtils.interpolate( + gettext( "Professional Certificate for {courseName}"),{ courseName: courseName } )%> <% } else { %> - <%= _.sprintf( - gettext( "Verified Certificate for %(courseName)s"),{ courseName: courseName } + <%- StringUtils.interpolate( + gettext( "Verified Certificate for {courseName}"),{ courseName: courseName } )%> <% } %>

    diff --git a/lms/templates/verify_student/missed_deadline.html b/lms/templates/verify_student/missed_deadline.html index f342ec0372..4c2f7f950b 100644 --- a/lms/templates/verify_student/missed_deadline.html +++ b/lms/templates/verify_student/missed_deadline.html @@ -1,3 +1,4 @@ +<%page expression_filter="h"/> <%! from django.utils.translation import ugettext as _ from lms.djangoapps.verify_student.views import PayAndVerifyView diff --git a/lms/templates/verify_student/pay_and_verify.html b/lms/templates/verify_student/pay_and_verify.html index 4b3a99e609..ada91b0c51 100644 --- a/lms/templates/verify_student/pay_and_verify.html +++ b/lms/templates/verify_student/pay_and_verify.html @@ -1,6 +1,9 @@ +<%page expression_filter="h"/> <%! import json from django.utils.translation import ugettext as _ + +from openedx.core.djangolib.markup import Text, HTML from lms.djangoapps.verify_student.views import PayAndVerifyView %> <%namespace name='static' file='../static_content.html'/> @@ -10,13 +13,13 @@ from lms.djangoapps.verify_student.views import PayAndVerifyView <%block name="pagetitle"> % if message_key == PayAndVerifyView.UPGRADE_MSG: - ${_("Upgrade Your Enrollment For {course_name}.").format(course_name=course.display_name) | h} + ${_("Upgrade Your Enrollment For {course_name}.").format(course_name=course.display_name)} % elif message_key == PayAndVerifyView.PAYMENT_CONFIRMATION_MSG: - ${_("Receipt For {course_name}").format(course_name=course.display_name) | h} + ${_("Receipt For {course_name}").format(course_name=course.display_name)} % elif message_key in [PayAndVerifyView.VERIFY_NOW_MSG, PayAndVerifyView.VERIFY_LATER_MSG]: - ${_("Verify For {course_name}").format(course_name=course.display_name) | h} + ${_("Verify For {course_name}").format(course_name=course.display_name)} % else: - ${_("Enroll In {course_name}").format(course_name=course.display_name) | h} + ${_("Enroll In {course_name}").format(course_name=course.display_name)} % endif @@ -58,10 +61,10 @@ from lms.djangoapps.verify_student.views import PayAndVerifyView

    ${_("Have questions?")}

    -

    ${_("Please read {a_start}our FAQs to view common questions about our certificates{a_end}.").format(a_start='', a_end="")}

    +

    ${Text(_("Please read {a_start}our FAQs to view common questions about our certificates{a_end}.")).format( + a_start=HTML('').format(marketing_link('WHAT_IS_VERIFIED_CERT')), + a_end=HTML(''))}

    @@ -107,7 +112,11 @@ from lms.djangoapps.verify_student.views import PayAndVerifyView

  • ${_("Technical Requirements")}

    -

    ${_("Please make sure your browser is updated to the {a_start}most recent version possible{a_end}. Also, please make sure your webcam is plugged in, turned on, and allowed to function in your web browser (commonly adjustable in your browser settings).").format(a_start='', a_end="")}

    +

    ${Text(_("Please make sure your browser is updated to the {strong_start}{a_start}most recent version possible{a_end}{strong_end}. Also, please make sure your {strong_start}webcam is plugged in, turned on, and allowed to function in your web browser (commonly adjustable in your browser settings).{strong_end}")).format( + a_start=HTML(''), + a_end=HTML(''), + strong_start=HTML(''), + strong_end=HTML(''))}

    • % endif diff --git a/lms/templates/verify_student/payment_confirmation_step.underscore b/lms/templates/verify_student/payment_confirmation_step.underscore index a69ad394cc..ddf9f62d74 100644 --- a/lms/templates/verify_student/payment_confirmation_step.underscore +++ b/lms/templates/verify_student/payment_confirmation_step.underscore @@ -1,7 +1,14 @@

    - <%= _.sprintf( gettext( "Thank you! We have received your payment for %(courseName)s." ), { courseName: '' + courseName + '' } ) %> + <%= HtmlUtils.interpolateHtml( + gettext( "Thank you! We have received your payment for {courseName}." ), + { courseName: HtmlUtils.joinHtml( + HtmlUtils.HTML(''), + courseName, + HtmlUtils.HTML('') + ) } + ) %>

    <% if ( receipt ) { %> diff --git a/lms/templates/verify_student/reverify.html b/lms/templates/verify_student/reverify.html index 6a0669849f..7467ba1bee 100644 --- a/lms/templates/verify_student/reverify.html +++ b/lms/templates/verify_student/reverify.html @@ -1,3 +1,4 @@ +<%page expression_filter="h"/> <%! from django.utils.translation import ugettext as _ %> diff --git a/lms/templates/verify_student/reverify_not_allowed.html b/lms/templates/verify_student/reverify_not_allowed.html index c8facb3998..a5d4b2c39f 100644 --- a/lms/templates/verify_student/reverify_not_allowed.html +++ b/lms/templates/verify_student/reverify_not_allowed.html @@ -1,3 +1,4 @@ +<%page expression_filter="h"/> <%! from django.utils.translation import ugettext as _ from django.core.urlresolvers import reverse diff --git a/lms/templates/verify_student/review_photos_step.underscore b/lms/templates/verify_student/review_photos_step.underscore index 923c8ef2f7..b588214dde 100644 --- a/lms/templates/verify_student/review_photos_step.underscore +++ b/lms/templates/verify_student/review_photos_step.underscore @@ -37,7 +37,7 @@

    <%- gettext( "Make sure that the full name on your account matches the name on your ID." ) %>

    - +
    diff --git a/lms/templates/verify_student/test/fake_softwaresecure_response.html b/lms/templates/verify_student/test/fake_softwaresecure_response.html index 14a94e7622..c4be837bee 100644 --- a/lms/templates/verify_student/test/fake_softwaresecure_response.html +++ b/lms/templates/verify_student/test/fake_softwaresecure_response.html @@ -1,4 +1,6 @@ +<%page expression_filter="h"/> <%namespace name='static' file='/static_content.html'/> +<%! from openedx.core.djangolib.js_utils import js_escaped_string %> Fake Software Secure Form @@ -45,7 +47,7 @@ $(document).ready(function() { function ajax_post(status, reason){ var data = { - "EdX-ID": '${receipt_id}', + "EdX-ID": '${receipt_id | n, js_escaped_string}', "Result": status, "Reason": reason, "MessageType": "" @@ -56,9 +58,9 @@ $(document).ready(function() { $.ajax({ type: "POST", - url: '${results_callback}', + url: '${results_callback | n, js_escaped_string}', headers: { - "Authorization": "${authorization_code}" + "Authorization": "${authorization_code | n, js_escaped_string}" }, data: JSON.stringify(data), contentType: "application/json;",