Fix edx templates.

PROD-465

lms/templates/credit_notifications/credit_eligibility_email.html

@@ -1,3 +1,4 @@
+<%page expression_filter="h"/>
 <%!
   from django.utils.translation import ugettext as _
   from openedx.core.djangolib.markup import HTML, Text
@@ -59,11 +60,11 @@
             </p>
 
             <p>
-              ${Text(_(u"Course credit can help you get a jump start on your university degree, finish a degree already started, or fulfill requirements at a different academic institution."))}
+              ${_(u"Course credit can help you get a jump start on your university degree, finish a degree already started, or fulfill requirements at a different academic institution.")}
             </p>
 
             <p>
-              ${Text(_(u'There are 2 steps to getting course credit.'))}
+              ${_(u'There are 2 steps to getting course credit.')}
           </p>
           <ol>
                 <li>

lms/templates/forgot_password_modal.html

@@ -1,7 +1,9 @@
+<%page expression_filter="h" />
 <%namespace name='static' file='static_content.html'/>
 
 <%!
 from django.utils.translation import ugettext as _
+from openedx.core.djangolib.js_utils import js_escaped_string
 from django.urls import reverse
 %>
 
@@ -49,10 +51,16 @@ from django.urls import reverse
   (function() {
     $(document).delegate('#pwd_reset_form', 'ajax:success', function(data, json, xhr) {
       if(json.success) {
-        $("#password-reset").html(json.value);
+        $("#password-reset").text(json.value);
       } else {
         if($('#pwd_error').length == 0) {
-          $('#pwd_reset_form').prepend('<div id="pwd_error" class="modal-form-error">${_("Email is incorrect.")}</div>');
+          var msg = "${_("Email is incorrect.") | n, js_escaped_string}";
+          var error_msg = HtmlUtils.interpolateHtml(
+          edx.HtmlUtils.HTML('<div id="pwd_error" class="modal-form-error">{error_msg}</div>'),
+          {
+            error_msg: msg,
+          });
+          $('#pwd_reset_form').prepend(edx.HtmlUtils.ensureHtml(error_msg).toString());
         }
         $('#pwd_error').stop().css("display", "block");
       }

lms/templates/module-error.html

@@ -1,3 +1,4 @@
+<%page expression_filter="h" />
 <%!
 from django.utils.translation import ugettext as _
 from openedx.core.djangolib.markup import HTML, Text
@@ -6,15 +7,15 @@ from openedx.core.djangolib.markup import HTML, Text
 
 <section class="outside-app">
   <h1>
-    ${_("There has been an error on the {platform_name} servers").format(
-        platform_name=u"<em>{}</em>".format(static.get_platform_name())
+    ${Text(_("There has been an error on the {platform_name} servers")).format(
+        platform_name=HTML(u"<em>{}</em>").format(static.get_platform_name())
     )}
   </h1>
   <p>
-    ${_("We're sorry, this module is temporarily unavailable. Our staff is working "
+    ${Text(_("We're sorry, this module is temporarily unavailable. Our staff is working "
     "to fix it as soon as possible. Please email us at {tech_support_email} to "
-    "report any problems or downtime.").format(
-        tech_support_email=u"<a href=\"mailto:{0}\">{0}</a>".format(static.get_tech_support_email_address())
+    "report any problems or downtime.")).format(
+        tech_support_email=HTML(u"<a href=\"mailto:{0}\">{0}</a>").format(static.get_tech_support_email_address())
     )}
   </p>
 
@@ -23,13 +24,13 @@ from openedx.core.djangolib.markup import HTML, Text
 
 <p>${_("Error:")}
 <pre>
-${error | h}
+${error}
 </pre>
 </p>
 
 <p>${_("Raw data:")}
 
-<pre>${data | h}</pre>
+<pre>${data}</pre>
 </p>
 
 % endif

lms/templates/peer_grading/peer_grading.html

@@ -1,6 +1,9 @@
-<%! from django.utils.translation import ugettext as _ %>
+<%page expression_filter="h"/>
+<%! from django.utils.translation import ugettext as _
+from openedx.core.djangolib.markup import HTML, Text
+%>
 <%
-nothing_to_grade_message = _(
+nothing_to_grade_message = Text(_(
 """
 {p_tag}You currently do not have any peer grading to do.  In order to have peer grading to do:
 {ul_tag}
@@ -10,7 +13,9 @@ criteria.{end_li_tag}
 {li_tag}There must be submissions that are waiting for grading.{end_li_tag}
 {end_ul_tag}
 {end_p_tag}
-""").format(p_tag="<p>", end_p_tag="</p>", ul_tag="<ul>", end_ul_tag="</ul>", li_tag="<li>", end_li_tag="</li>")
+""")).format(p_tag=HTML("<p>"), end_p_tag=HTML("</p>"),
+            ul_tag=HTML("<ul>"), end_ul_tag=HTML("</ul>"),
+            li_tag=HTML("<li>"), end_li_tag=HTML("</li>"))
 %>
 <section class="container peer-grading-container">
     <div class="peer-grading" data-ajax-url="${ajax_url}" data-use-single-location="${use_single_location}">
@@ -41,7 +46,7 @@ criteria.{end_li_tag}
                             %if problem['closed']:
                                 ${problem['problem_name']}
                             %else:
-                                <a href="#problem" data-location="${problem['location'] | h}" class="problem-button">${problem['problem_name']}</a>
+                                <a href="#problem" data-location="${problem['location']}" class="problem-button">${problem['problem_name']}</a>
                             %endif
                         </td>
                         <td>

lms/templates/peer_grading/peer_grading_problem.html

@@ -1,6 +1,7 @@
+<%page expression_filter="h"/>
 <%! from django.utils.translation import ugettext as _ %>
 <section class="container peer-grading-container">
-    <div class="peer-grading" data-ajax-url="${ajax_url}" data-location="${problem_location | h}" data-use-single-location="${use_single_location}">
+    <div class="peer-grading" data-ajax-url="${ajax_url}" data-location="${problem_location}" data-use-single-location="${use_single_location}">
         <div class="error-container"></div>
 
         <section class="content-panel">

lms/templates/secondary_email_change_failed.html

@@ -1,5 +1,7 @@
-## xss-lint: disable=mako-missing-default,python-wrap-html
-<%! from django.utils.translation import ugettext as _ %>
+<%page expression_filter="h"/>
+<%! from django.utils.translation import ugettext as _
+from openedx.core.djangolib.markup import HTML, Text
+%>
 
 <%inherit file="main.html" />
 
@@ -14,7 +16,6 @@
     % else:
     <p>${_("We were unable to activate your secondary email {secondary_email}").format(secondary_email=secondary_email)}</p>
     % endif
-    ## xss-lint: disable=python-wrap-html
-    <p>${_('Go back to the {link_start}home page{link_end}.').format(link_start='<a href="/">', link_end='</a>')}</p>
+    <p>${Text(_('Go back to the {link_start}home page{link_end}.')).format(link_start=HTML('<a href="/">'), link_end=HTML('</a>'))}</p>
   </section>
 </section>

lms/templates/secondary_email_change_successful.html

@@ -1,4 +1,4 @@
-## xss-lint: disable=mako-missing-default
+<%page expression_filter="h"/>
 <%inherit file="main.html" />
 <%!
 from django.utils.translation import ugettext as _