Don't prepopulate models which may have script tags in their payloads

but fetch async via json get.

cms/djangoapps/contentstore/views.py

@@ -1106,6 +1106,7 @@ def module_info(request, module_location):
     else:
         return HttpResponseBadRequest()
 
+
 @login_required
 @ensure_csrf_cookie
 def get_course_settings(request, org, course, name):
@@ -1121,12 +1122,15 @@ def get_course_settings(request, org, course, name):
         raise PermissionDenied()
 
     course_module = modulestore().get_item(location)
-    course_details = CourseDetails.fetch(location)
 
     return render_to_response('settings.html', {
         'context_course': course_module,
-        'course_location' : location,
+        'course_location': location,
-        'course_details' : json.dumps(course_details, cls=CourseSettingsEncoder)
+        'details_url': reverse(course_settings_updates,
+                               kwargs={"org": org,
+                                       "course": course,
+                                       "name": name,
+                                       "section": "details"})
     })
 
 @login_required

cms/static/js/models/settings/course_details.js

@@ -59,11 +59,6 @@ CMS.Models.Settings.CourseDetails = Backbone.Model.extend({
         // NOTE don't return empty errors as that will be interpreted as an error state
     },
 
-    url: function() {
-        var location = this.get('location');
-        return '/' + location.get('org') + "/" + location.get('course') + '/settings-details/' + location.get('name') + '/section/details';
-    },
-
     _videokey_illegal_chars : /[^a-zA-Z0-9_-]/g,
     save_videosource: function(newsource) {
         // newsource either is <video youtube="speed:key, *"/> or just the "speed:key, *" string

cms/static/js/views/course_info_edit.js

@@ -55,8 +55,12 @@ CMS.Views.ClassInfoUpdateView = Backbone.View.extend({
           $(updateEle).empty();
           var self = this;
           this.collection.each(function (update) {
-        	  var newEle = self.template({ updateModel : update });
+              try {
-              $(updateEle).append(newEle);
+                  var newEle = self.template({ updateModel : update });
+                  $(updateEle).append(newEle);
+            } catch (e) {
+                // ignore
+            }
           });
           this.$el.find(".new-update-form").hide();
           this.$el.find('.date').datepicker({ 'dateFormat': 'MM d, yy' });
@@ -162,8 +166,13 @@ CMS.Views.ClassInfoUpdateView = Backbone.View.extend({
         self.$currentPost.removeClass('editing');
         self.$currentPost.find('.date-display').html(targetModel.get('date'));
         self.$currentPost.find('.date').val(targetModel.get('date'));
-        self.$currentPost.find('.update-contents').html(targetModel.get('content'));
+        try {
-        self.$currentPost.find('.new-update-content').val(targetModel.get('content'));
+            // just in case the content causes an error (embedded js errors)
+            self.$currentPost.find('.update-contents').html(targetModel.get('content'));
+            self.$currentPost.find('.new-update-content').val(targetModel.get('content'));
+        } catch (e) {
+            // ignore but handle rest of page
+        }
         self.$currentPost.find('form').hide();
         window.$modalCover.unbind('click');
         window.$modalCover.hide();

cms/templates/settings.html

@@ -30,13 +30,18 @@ from contentstore import utils
       }).blur(function() {
         $("label").removeClass("is-focused");
         });
-        
+      var model = new CMS.Models.Settings.CourseDetails();
-      var editor = new CMS.Views.Settings.Details({
+      model.urlRoot = '${details_url}';
-          el: $('.settings-details'),
+      model.fetch({success : 
-          model: new CMS.Models.Settings.CourseDetails(${course_details|n},{parse:true})
+          function(model) {
-        });
+              var editor = new CMS.Views.Settings.Details({
-        
+                  el: $('.settings-details'),
-        editor.render();
+                  model: model
+                });
+                
+              editor.render();
+          }
+      });
     });
       
   </script>