Andal.LND/edx-platform
4
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

escape json for use in js

Browse Source
This commit is contained in:
noraiz-anwar
2018-11-23 17:26:40 +05:00
committed by Noraiz Anwar
parent 8df5b58853
commit e0d19d6871
3 changed files with 11 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
openedx/core/lib/xblock_utils/__init__.py
View File

@@ -139,14 +139,13 @@ def wrap_xblock(
template_context = {
'content': block.display_name if display_name_only else frag.content,
'classes': css_classes,
'display_name': block.display_name_with_default_escaped,
'display_name': block.display_name_with_default_escaped, # xss-lint: disable=python-deprecated-display-name
'data_attributes': u' '.join(u'data-{}="{}"'.format(markupsafe.escape(key), markupsafe.escape(value))
for key, value in data.iteritems()),
}
if hasattr(frag, 'json_init_args') and frag.json_init_args is not None:
# Replace / with \/ so that "</script>" in the data won't break things.
template_context['js_init_parameters'] = json.dumps(frag.json_init_args).replace("/", r"\/")
template_context['js_init_parameters'] = frag.json_init_args
else:
template_context['js_init_parameters'] = ""
@@ -215,8 +214,7 @@ def wrap_xblock_aside(
}
if hasattr(frag, 'json_init_args') and frag.json_init_args is not None:
# Replace / with \/ so that "</script>" in the data won't break things.
template_context['js_init_parameters'] = json.dumps(frag.json_init_args).replace("/", r"\/")
template_context['js_init_parameters'] = frag.json_init_args
else:
template_context['js_init_parameters'] = ""
@@ -443,6 +441,7 @@ def get_course_update_items(course_updates, provided_index=0):
except (etree.XMLSyntaxError, etree.ParserError):
log.error("Cannot parse: " + course_updates.data)
escaped = escape(course_updates.data)
# xss-lint: disable=python-concat-html
course_html_parsed = html.fromstring("<ol><li>" + escaped + "</li></ol>")
# confirm that root is <ol>, iterate over <li>, pull out <h2> subs and then rest of val