From 85fc5871d66ddd1733c135b92578749f72697e9b Mon Sep 17 00:00:00 2001
From: Brian Jacobel <bjacobel@gmail.com>
Date: Mon, 13 Mar 2017 17:50:16 -0400
Subject: [PATCH] Fix template to escape rendered strings

---
 .../common/templates/discussion/forum-actions.underscore    | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/common/static/common/templates/discussion/forum-actions.underscore b/common/static/common/templates/discussion/forum-actions.underscore
index 6cc46e20a8..dcb17d72d4 100644
--- a/common/static/common/templates/discussion/forum-actions.underscore
+++ b/common/static/common/templates/discussion/forum-actions.underscore
@@ -1,13 +1,13 @@
 <% if (!readOnly) { %>
-    <ul class="<%= contentType %>-actions-list">
+    <ul class="<%- contentType %>-actions-list">
         <% _.each(primaryActions, function(action) { print(_.template($('#forum-action-' + action).html())({})) }) %>
         <li class="actions-item is-visible">
             <div class="more-wrapper">
-                <button class="btn-link action-button action-more" aria-label="<%- gettext('More') %>" aria-haspopup="true" aria-controls="action-menu-<%= contentType %>-<%= contentId %>">
+                <button class="btn-link action-button action-more" aria-label="<%- gettext('More') %>" aria-haspopup="true" aria-controls="action-menu-<%- contentType %>-<%- contentId %>">
                     <span class="action-label"><%- gettext('More') %></span>
                     <span class="action-icon"><span class="icon fa fa-ellipsis-h" aria-hidden="true"></span></span>
                 </button>
-                <div class="actions-dropdown" id="action-menu-<%= contentType %>-<%= contentId %>" aria-expanded="false">
+                <div class="actions-dropdown" id="action-menu-<%- contentType %>-<%- contentId %>" aria-expanded="false">
                   <ul class="actions-dropdown-list">
                     <% _.each(secondaryActions, function(action) { print(_.template($('#forum-action-' + action).html())({})) }) %>
                   </ul>