From c8e0a28babfa68dee26bf34d76b9dea33357ed2b Mon Sep 17 00:00:00 2001
From: adeelehsan <adeel.ehsan@arbisoft.com>
Date: Wed, 22 Jul 2020 16:05:26 +0500
Subject: [PATCH] Fixed xss linter violations

PROD-1725
PROD-1726
PROD-1617
---
 .../support/static/support/js/views/enrollment_modal.js       | 1 +
 .../support/static/support/templates/enrollment.underscore    | 4 ++--
 lms/templates/api_admin/api_access_request_form.html          | 2 +-
 3 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/lms/djangoapps/support/static/support/js/views/enrollment_modal.js b/lms/djangoapps/support/static/support/js/views/enrollment_modal.js
index 40a264cbf2..1cfb47c2aa 100644
--- a/lms/djangoapps/support/static/support/js/views/enrollment_modal.js
+++ b/lms/djangoapps/support/static/support/js/views/enrollment_modal.js
@@ -21,6 +21,7 @@
             },
 
             render: function() {
+                // xss-lint: disable=javascript-jquery-html
                 this.$el.html(_.template(this.template)({
                     enrollment: this.enrollment,
                     modes: this.modes,
diff --git a/lms/djangoapps/support/static/support/templates/enrollment.underscore b/lms/djangoapps/support/static/support/templates/enrollment.underscore
index 1c3b4db1c1..a5abf289d0 100644
--- a/lms/djangoapps/support/static/support/templates/enrollment.underscore
+++ b/lms/djangoapps/support/static/support/templates/enrollment.underscore
@@ -48,8 +48,8 @@
         <td>
           <button
               class="change-enrollment-btn"
-              data-modes="<%= _.pluck(enrollment.get('course_modes'), 'slug')%>"
-              data-course_id="<%= enrollment.get('course_id') %>"
+              data-modes="<%- _.pluck(enrollment.get('course_modes'), 'slug')%>"
+              data-course_id="<%- enrollment.get('course_id') %>"
           >
             <%- gettext('Change Enrollment') %>
           </button>
diff --git a/lms/templates/api_admin/api_access_request_form.html b/lms/templates/api_admin/api_access_request_form.html
index 27e6201de6..615aec5765 100644
--- a/lms/templates/api_admin/api_access_request_form.html
+++ b/lms/templates/api_admin/api_access_request_form.html
@@ -16,7 +16,7 @@
     <div class="api-form-container">
       <form action="" method="post" class="api-form">
         <input type="hidden" id="csrf_token" name="csrfmiddlewaretoken" value="${csrf_token}">
-        ${form.as_p() | n}
+        ${form.as_p() | n, decode.utf8}
         <input id="api-access-submit" type="submit" value="${_('Request API Access')}"/>
       </form>
     </div>