Merge pull request #204 from edx/sustaining/security-fixes-6

Sustaining security fixes 6

cms/templates/js/group-configuration-details.underscore

@@ -31,9 +31,9 @@
 
     <% if(showGroups) { %>
       <% allocation = Math.floor(100 / groups.length) %>
-      <ol class="collection-items groups groups-<%= index %>">
+      <ol class="collection-items groups groups-<%- index %>">
         <% groups.each(function(group, groupIndex) { %>
-          <li class="item group group-<%= groupIndex %>">
+          <li class="item group group-<%- groupIndex %>">
             <span class="name group-name"><%- group.get('name') %></span>
             <span class="meta group-allocation"><%- allocation %>%</span>
           </li>

cms/templates/js/maintenance/force-published-course-response.underscore

@@ -3,7 +3,7 @@
         <%- gettext('You have done a dry run of force publishing the course. Nothing has changed. Had you run it, the following course versions would have been change.') %>
     </div>
     <div class="main-output">
-        <%= StringUtils.interpolate(
+        <%- StringUtils.interpolate(
             gettext('The published branch version, {published}, was reset to the draft branch version, {draft}.'),
             {
                 published: current_versions['published-branch'],

cms/templates/js/mock/mock-xmodule-editor.underscore

@@ -16,13 +16,13 @@
 
         <script id="metadata-string-entry" type="text/template">
             <div class="wrapper-comp-setting">
-                \t<label class="label setting-label" for="<%= uniqueId %>"><%= model.get('display_name') %></label>
-                \t<input class="input setting-input" type="text" id="<%= uniqueId %>" value='<%= model.get("value") %>'/>
+                \t<label class="label setting-label" for="<%- uniqueId %>"><%- model.get('display_name') %></label>
+                \t<input class="input setting-input" type="text" id="<%- uniqueId %>" value='<%- model.get("value") %>'/>
                 \t<button class="action setting-clear inactive" type="button" name="setting-clear" value="Clear" data-tooltip="Clear">
                 <span class="icon fa fa-undo" aria-hidden="true"></span><span class="sr">"Clear Value"</span>
                 </button>
             </div>
-            <span class="tip setting-help"><%= model.get('help') %></span>
+            <span class="tip setting-help"><%- model.get('help') %></span>
 
         </script>
 

cms/templates/js/publish-editor.underscore

@@ -6,13 +6,13 @@
             <% _.each(xblockInfo.get('child_info').children, function(subsection) { %>
               <% if (subsection.isPublishable())  { %>
                 <li class="outline-item outline-subsection">
-                    <h4 class="subsection-title item-title"><%= subsection.get('display_name') %></h4>
+                    <h4 class="subsection-title item-title"><%- subsection.get('display_name') %></h4>
                     <div class="subsection-content">
                         <ol class="list-units">
                           <% _.each(subsection.get('child_info').children, function(unit) { %>
                             <% if (unit.isPublishable())  { %>
                               <li class="outline-item outline-unit">
-                                  <span class="unit-title item-title"><%= unit.get('display_name') %></span>
+                                  <span class="unit-title item-title"><%- unit.get('display_name') %></span>
                               </li>
                             <% } %>
                           <% }); %>
@@ -27,7 +27,7 @@
             <% _.each(xblockInfo.get('child_info').children, function(unit) { %>
               <% if (unit.isPublishable())  { %>
                 <li class="outline-item outline-unit">
-                    <span class="unit-title item-title"><%= unit.get('display_name') %></span>
+                    <span class="unit-title item-title"><%- unit.get('display_name') %></span>
                 </li>
               <% } %>
             <% }); %>

cms/templates/js/unit-outline.underscore

@@ -1,23 +1,23 @@
 <% if (parentInfo) { %>
-    <li class="outline-item outline-<%= xblockType %> <%= visibilityClass %> <%= xblockInfo.get('id') === currentUnitId ? 'is-current' : '' %>"
-        data-parent="<%= parentInfo.get('id') %>" data-locator="<%= xblockInfo.get('id') %>">
-        <div class="<%= xblockType %>-header">
-            <h3 class="<%= xblockType %>-header-details">
-                <span class="<%= xblockType %>-title item-title">
-                    <a href="<%= xblockInfo.get('studio_url') %>"><%- xblockInfo.get('display_name') %></a>
+    <li class="outline-item outline-<%- xblockType %> <%- visibilityClass %> <%- xblockInfo.get('id') === currentUnitId ? 'is-current' : '' %>"
+        data-parent="<%- parentInfo.get('id') %>" data-locator="<%- xblockInfo.get('id') %>">
+        <div class="<%- xblockType %>-header">
+            <h3 class="<%- xblockType %>-header-details">
+                <span class="<%- xblockType %>-title item-title">
+                    <a href="<%- xblockInfo.get('studio_url') %>"><%- xblockInfo.get('display_name') %></a>
                 </span>
             </h3>
         </div>
 <% } %>
 
-        <div class="<%= xblockType %>-content outline-content">
-            <ol class="<%= typeListClass %>">
+        <div class="<%- xblockType %>-content outline-content">
+            <ol class="<%- typeListClass %>">
             </ol>
             <% if (childType) { %>
-                <div class="add-<%= childType %> add-item">
-                    <a href="#" class="button button-new" data-category="<%= childCategory %>"
-                       data-parent="<%= xblockInfo.get('id') %>" data-default-name="<%= defaultNewChildName %>">
-                        <span class="icon fa fa-plus" aria-hidden="true"></span><%= addChildLabel %>
+                <div class="add-<%- childType %> add-item">
+                    <a href="#" class="button button-new" data-category="<%- childCategory %>"
+                       data-parent="<%- xblockInfo.get('id') %>" data-default-name="<%- defaultNewChildName %>">
+                        <span class="icon fa fa-plus" aria-hidden="true"></span><%- addChildLabel %>
                     </a>
                 </div>
             <% } %>

cms/templates/js/video/transcripts/file-upload.underscore

@@ -4,6 +4,6 @@
 <form class="file-chooser" action="/transcripts/upload"
                           method="post" enctype="multipart/form-data">
   <input type="file" class="file-input" name="transcript-file"
-    accept="<%= _.map(ext, function(val){ return '.' + val; }).join(', ') %>">
-  <input type="hidden" name="locator" value="<%= component_locator %>">
+    accept="<%- _.map(ext, function(val){ return '.' + val; }).join(', ') %>">
+  <input type="hidden" name="locator" value="<%- component_locator %>">
 </form>

cms/templates/js/xblock-validation-messages.underscore

@@ -3,7 +3,7 @@ var summaryMessage = validation.get("summary");
 var aggregateMessageType = summaryMessage.type;
 var aggregateValidationClass = aggregateMessageType === "error"? "has-errors" : "has-warnings";
 %>
-    <div class="xblock-message validation <%= aggregateValidationClass %> <%= additionalClasses %>">
+    <div class="xblock-message validation <%- aggregateValidationClass %> <%- additionalClasses %>">
         <p class="<%- aggregateMessageType %>"><span class="icon fa <%- getIcon(aggregateMessageType) %>" aria-hidden="true"></span>
         <%- summaryMessage.text %>
         <% if (summaryMessage.action_class) { %>
@@ -25,7 +25,7 @@ var aggregateValidationClass = aggregateMessageType === "error"? "has-errors" :
                 var messageType = message.type
                 var messageTypeDisplayName = getDisplayName(messageType)
                 %>
-                <li class="xblock-message-item <%= messageType %>">
+                <li class="xblock-message-item <%- messageType %>">
                     <span class="message-text">
                         <% if (messageTypeDisplayName) { %>
                             <span class="sr"><%- messageTypeDisplayName %>:</span>