Fix edx-ace templates
This patch is part of multiple PR's to protect templates against xss attack PROD-465
This commit is contained in:
Adeel Khan
@@ -380,8 +380,6 @@ class EmailChangeRequestTests(EventTestMixin, EmailTemplateTagMixin, CacheIsolat
|
||||
),
|
||||
u'If this is correct, please confirm your new e-mail address by visiting:',
|
||||
u'http://edx.org/email_confirm/{key}'.format(key=registration_key),
|
||||
u'If you didn\'t request this, you don\'t need to do anything;',
|
||||
u'you won\'t receive any more email from us.',
|
||||
u'Please do not reply to this e-mail; if you require assistance,',
|
||||
u'check the help section of the édX web site.',
|
||||
],
|
||||
@@ -403,7 +401,6 @@ class EmailChangeRequestTests(EventTestMixin, EmailTemplateTagMixin, CacheIsolat
|
||||
html = message.alternatives[0][0]
|
||||
|
||||
assert message.subject == subject
|
||||
|
||||
for body in text, html:
|
||||
for fragment in body_fragments:
|
||||
assert fragment in body
|
||||
|
||||
@@ -124,8 +124,10 @@ class ResetPasswordTests(EventTestMixin, CacheIsolationTestCase):
|
||||
cache.clear()
|
||||
|
||||
@unittest.skipUnless(settings.ROOT_URLCONF == 'lms.urls', "Test only valid in LMS")
|
||||
@ddt.data('plain_text', 'html')
|
||||
def test_reset_password_email(self, body_type):
|
||||
@ddt.data(('plain_text', "You're receiving this e-mail because you requested a password reset"),
|
||||
('html', "You're receiving this e-mail because you requested a password reset"))
|
||||
@ddt.unpack
|
||||
def test_reset_password_email(self, body_type, expected_output):
|
||||
"""Tests contents of reset password email, and that user is not active"""
|
||||
good_req = self.request_factory.post('/password_reset/', {'email': self.user.email})
|
||||
good_req.user = self.user
|
||||
@@ -157,7 +159,7 @@ class ResetPasswordTests(EventTestMixin, CacheIsolationTestCase):
|
||||
body = bodies[body_type]
|
||||
|
||||
self.assertIn("Password reset", sent_message.subject)
|
||||
self.assertIn("You're receiving this e-mail because you requested a password reset", body)
|
||||
self.assertIn(expected_output, body)
|
||||
self.assertEquals(sent_message.from_email, from_email)
|
||||
self.assertEquals(len(sent_message.to), 1)
|
||||
self.assertIn(self.user.email, sent_message.to)
|
||||
|
||||
@@ -7,28 +7,34 @@
|
||||
<tr>
|
||||
<td>
|
||||
<h1>
|
||||
{% trans "Create Password" %}
|
||||
{% trans "Create Password" as tmsg %}{{ tmsg | force_escape }}
|
||||
</h1>
|
||||
<p style="color: rgba(0,0,0,.75);">
|
||||
{% filter force_escape %}
|
||||
{% blocktrans %}You're receiving this e-mail because you requested to create a password for your user account at {{ platform_name }}.{% endblocktrans %}
|
||||
{% endfilter %}
|
||||
<br />
|
||||
</p>
|
||||
|
||||
<p style="color: rgba(0,0,0,.75);">
|
||||
{% filter force_escape %}
|
||||
{% blocktrans %}We've restored access to your {{ platform_name }} account using the recovery email you provided at registration.{% endblocktrans %}
|
||||
{% endfilter %}
|
||||
<br />
|
||||
</p>
|
||||
|
||||
<p style="color: rgba(0,0,0,.75);">
|
||||
{% filter force_escape %}
|
||||
{% blocktrans %}Once you've created a password [below], you will be able to log in to {{ platform_name }} with this email ({{ email }}) and your new password.{% endblocktrans %}
|
||||
{% endfilter %}
|
||||
<br />
|
||||
</p>
|
||||
|
||||
<p style="color: rgba(0,0,0,.75);">
|
||||
{% trans "If you didn't request this change, you can disregard this email - we have not yet reset your password." %}
|
||||
{% trans "If you didn't request this change, you can disregard this email - we have not yet reset your password." as tmsg %}{{ tmsg | force_escape }}
|
||||
<br />
|
||||
</p>
|
||||
|
||||
## xss-lint: disable=django-trans-missing-escape
|
||||
{% trans "Create Password" as course_cta_text %}
|
||||
|
||||
{% include "ace_common/edx_ace/common/return_to_course_cta.html" with course_cta_text=course_cta_text course_cta_url=reset_link %}
|
||||
|
||||
@@ -7,18 +7,22 @@
|
||||
<tr>
|
||||
<td>
|
||||
<h1>
|
||||
{% trans "Email Change" %}
|
||||
{% trans "Email Change" as tmsg %}{{ tmsg | force_escape }}
|
||||
</h1>
|
||||
<p style="color: rgba(0,0,0,.75);">
|
||||
{% filter force_escape %}
|
||||
{% blocktrans %}We received a request to change the e-mail associated with your {{ platform_name }} account from {{ old_email }} to {{ new_email }}. If this is correct, please confirm your new e-mail address by visiting:{% endblocktrans %}
|
||||
{% endfilter %}
|
||||
<br />
|
||||
</p>
|
||||
|
||||
## xss-lint: disable=django-trans-missing-escape
|
||||
{% trans "Confirm Email Change" as course_cta_text %}
|
||||
{% include "ace_common/edx_ace/common/return_to_course_cta.html" with course_cta_text=course_cta_text course_cta_url=confirm_link %}
|
||||
|
||||
<p style="color: rgba(0,0,0,.75);">
|
||||
{% filter force_escape %}
|
||||
{% blocktrans %}If you didn't request this, you don't need to do anything; you won't receive any more email from us. Please do not reply to this e-mail; if you require assistance, check the help section of the {{ platform_name }} web site.{% endblocktrans %}
|
||||
{% endfilter %}
|
||||
<br />
|
||||
</p>
|
||||
|
||||
|
||||
@@ -7,17 +7,23 @@
|
||||
<tr>
|
||||
<td>
|
||||
<h1>
|
||||
{% filter force_escape %}
|
||||
{% blocktrans %}Email Change Confirmation for {{ platform_name }}{% endblocktrans %}
|
||||
{% endfilter %}
|
||||
</h1>
|
||||
<p style="color: rgba(0,0,0,.75);">
|
||||
{% filter force_escape %}
|
||||
{% blocktrans %}This is to confirm that you changed the e-mail associated with {{ platform_name }} from {{ old_email }} to {{ new_email }}. If you did not make this request, please contact us immediately. Contact information is listed at:{% endblocktrans %}
|
||||
{% endfilter %}
|
||||
<br />
|
||||
</p>
|
||||
|
||||
<a href="{{ contact_link }}">{{ contact_link }}</a>
|
||||
|
||||
<p style="color: rgba(0,0,0,.75);">
|
||||
{% filter force_escape %}
|
||||
{% blocktrans %}We keep a log of old e-mails, so if this request was unintentional, we can investigate.{% endblocktrans %}
|
||||
{% endfilter %}
|
||||
<br />
|
||||
</p>
|
||||
|
||||
|
||||
@@ -7,29 +7,33 @@
|
||||
<tr>
|
||||
<td>
|
||||
<h1>
|
||||
{% trans "Password Reset" %}
|
||||
{% trans "Password Reset" as tmsg %}{{ tmsg | force_escape }}
|
||||
</h1>
|
||||
<p style="color: rgba(0,0,0,.75);">
|
||||
{% filter force_escape %}
|
||||
{% blocktrans %}You're receiving this e-mail because you requested a password reset for your user account at {{ platform_name }}.{% endblocktrans %}
|
||||
{% endfilter %}
|
||||
<br />
|
||||
</p>
|
||||
|
||||
{% if failed %}
|
||||
<p style="color: rgba(0,0,0,.75);">
|
||||
{% filter force_escape %}
|
||||
{% blocktrans %}However, there is currently no user account associated with your email address: {{ email_address }}.{% endblocktrans %}
|
||||
{% endfilter %}
|
||||
<br />
|
||||
</p>
|
||||
|
||||
<p style="color: rgba(0,0,0,.75);">
|
||||
{% trans "If you did not request this change, you can ignore this email." %}
|
||||
{% trans "If you did not request this change, you can ignore this email." as tmsg %}{{ tmsg | force_escape }}
|
||||
<br />
|
||||
</p>
|
||||
{% else %}
|
||||
<p style="color: rgba(0,0,0,.75);">
|
||||
{% trans "If you didn't request this change, you can disregard this email - we have not yet reset your password." %}
|
||||
{% trans "If you didn't request this change, you can disregard this email - we have not yet reset your password." as tmsg %}{{ tmsg | force_escape }}
|
||||
<br />
|
||||
</p>
|
||||
|
||||
## xss-lint: disable=django-trans-missing-escape
|
||||
{% trans "Change my Password" as course_cta_text %}
|
||||
|
||||
{% include "ace_common/edx_ace/common/return_to_course_cta.html" with course_cta_text=course_cta_text course_cta_url=reset_link %}
|
||||
|
||||
Reference in New Issue
Block a user