From 8ba1d522df261e1c80d4828ec8f7d80f2e59afec Mon Sep 17 00:00:00 2001
From: uzairr <uzairr@yahoo.com>
Date: Fri, 21 Aug 2020 13:31:49 +0500
Subject: [PATCH] fix xss in transcript not found template

PROD-2017
---
 .../messages/transcripts-not-found.underscore      | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/cms/templates/js/video/transcripts/messages/transcripts-not-found.underscore b/cms/templates/js/video/transcripts/messages/transcripts-not-found.underscore
index 6bb74c635e..daa33a1f69 100644
--- a/cms/templates/js/video/transcripts/messages/transcripts-not-found.underscore
+++ b/cms/templates/js/video/transcripts/messages/transcripts-not-found.underscore
@@ -1,16 +1,16 @@
-<div class="transcripts-message-status status-error"><span class="icon fa fa-remove" aria-hidden="true"></span><%= gettext("No Timed Transcript") %></div>
+<div class="transcripts-message-status status-error"><span class="icon fa fa-remove" aria-hidden="true"></span><%- gettext("No Timed Transcript") %></div>
 <p class="transcripts-message">
-<%= gettext("EdX doesn\'t have a timed transcript for this video. Please upload an .srt file.") %>
+<%- gettext("EdX doesn\'t have a timed transcript for this video. Please upload an .srt file.") %>
 </p>
 <div class="transcripts-file-uploader"></div>
 <p class="transcripts-error-message is-invisible">
-<%= gettext("Error.") %>
+<%- gettext("Error.") %>
 </p>
 <div class="wrapper-transcripts-buttons">
-    <button class="action setting-upload" type="button" name="setting-upload" value="<%= gettext("Upload New Transcript") %>" data-tooltip="<%= gettext("Upload New Transcript") %>">
-        <%= gettext("Upload New Transcript") %>
+    <button class="action setting-upload" type="button" name="setting-upload" value="<%- gettext("Upload New Transcript") %>" data-tooltip="<%- gettext("Upload New Transcript") %>">
+        <%- gettext("Upload New Transcript") %>
     </button>
-    <a class="action setting-download is-disabled" aria-disabled="true" href="javascropt: void(0);" data-tooltip="<%= gettext("Download Transcript for Editing") %>">
-        <%= gettext("Download Transcript for Editing") %>
+    <a class="action setting-download is-disabled" aria-disabled="true" href="javascropt: void(0);" data-tooltip="<%- gettext("Download Transcript for Editing") %>">
+        <%- gettext("Download Transcript for Editing") %>
     </a>
 </div>