Andal.LND/edx-platform
4
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Make base.html Mako template safe by default

Browse Source 
Make base.html Mako template safe by default by:
1. Add page-level default of html escaping
2. Fix escaping of all variables in base.html
3. Fix escaping of all dependent underscore templates
Also includes additional best practices for certificates and
textbooks JavaScript/Underscore in order to complete that work.

TNL-3425
This commit is contained in:
Robert Raposa
2015-12-23 18:48:30 -05:00
parent 3fa62a6ff6
commit b69c6d62bf
14 changed files with 157 additions and 152 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
cms/templates/js/edit-textbook.underscore
View File

@@ -2,27 +2,27 @@
<div class="wrapper-form">
<% if (error && error.message) { %>
<div id="edit_textbook_error" class="message message-status message-status error is-shown" name="edit_textbook_error">
<%= gettext(error.message) %>
<%- gettext(error.message) %>
</div>
<% } %>
<fieldset class="textbook-fields">
<legend class="sr"><%= gettext("Textbook information") %></legend>
<legend class="sr"><%- gettext("Textbook information") %></legend>
<div class="input-wrap field text required add-textbook-name <% if(error && error.attributes && error.attributes.name) { print('error'); } %>">
<label for="textbook-name-input"><%= gettext("Textbook Name") %></label>
<input id="textbook-name-input" name="textbook-name" type="text" placeholder="<%= gettext("Introduction to Cookie Baking") %>" value="<%= name %>">
<span class="tip tip-stacked"><%= gettext("provide the title/name of the text book as you would like your students to see it") %></span>
<label for="textbook-name-input"><%- gettext("Textbook Name") %></label>
<input id="textbook-name-input" name="textbook-name" type="text" placeholder="<%- gettext("Introduction to Cookie Baking") %>" value="<%- name %>">
<span class="tip tip-stacked"><%- gettext("provide the title/name of the text book as you would like your students to see it") %></span>
</div>
</fieldset>
<fieldset class="chapters-fields">
<legend class="sr"><%= gettext("Chapter information") %></legend>
<legend class="sr"><%- gettext("Chapter information") %></legend>
<ol class="chapters list-input enum"></ol>
<button class="action action-add-chapter"><i class="icon fa fa-plus"></i> <%= gettext("Add a Chapter") %></button>
<button class="action action-add-chapter"><i class="icon fa fa-plus"></i> <%- gettext("Add a Chapter") %></button>
</fieldset>
</div>
<div class="actions">
<button class="action action-primary" type="submit"><%= gettext("Save") %></button>
<button class="action action-secondary action-cancel"><%= gettext("Cancel") %></button>
<button class="action action-primary" type="submit"><%- gettext("Save") %></button>
<button class="action action-secondary action-cancel"><%- gettext("Cancel") %></button>
</div>
</form>