Andal.LND/edx-platform
4
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #7399 from edx/ned/plat-462

Browse Source 
Make sure slashes in JSON content don't end script tags. PLAT-462
This commit is contained in:
Ned Batchelder
2015-03-18 22:47:50 -04:00
parent e03813dabb 6928035cd1
commit a64d926845
3 changed files with 52 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
common/djangoapps/xmodule_modifiers.py
View File

@@ -113,11 +113,10 @@ def wrap_xblock(runtime_class, block, view, frag, context, usage_id_serializer,
}
if hasattr(frag, 'json_init_args') and frag.json_init_args is not None:
template_context['js_init_parameters'] = json.dumps(frag.json_init_args)
template_context['js_pass_parameters'] = True
# Replace / with \/ so that "</script>" in the data won't break things.
template_context['js_init_parameters'] = json.dumps(frag.json_init_args).replace("/", r"\/")
else:
template_context['js_init_parameters'] = ""
template_context['js_pass_parameters'] = False
return wrap_fragment(frag, render_to_string('xblock_wrapper.html', template_context))