Merge pull request #210 from edx/IM/security-fixes-2

Incident Management security fixes 2

common/lib/xmodule/xmodule/assets/split_test/public/js/split_test_staff.js

@@ -13,7 +13,7 @@ window.ABTestSelector = function(runtime, elem) {
             // force this id to remain a string, even if it looks like something else
             var child_group_id = $(this).data('group-id').toString();
             if (child_group_id === group_id) {
-                _this.content_container.html($(this).text());
+                _this.content_container.html(edx.HtmlUtils.HTML($(this).text()).toString());
                 XBlock.initializeBlocks(_this.content_container, $(elem).data('request-token'));
             }
         });

common/static/common/js/discussion/views/new_post_view.js

@@ -59,8 +59,11 @@
                     startHeader: this.startHeader,
                     form_id: this.mode + (this.topicId ? '-' + this.topicId : '')
                 });
-                this.$el.html(_.template($('#new-post-template').html())(context));
-                threadTypeTemplate = _.template($('#thread-type-template').html());
+                edx.HtmlUtils.setHtml(
+                    this.$el,
+                    edx.HtmlUtils.template($('#new-post-template').html())(context)
+                );
+                threadTypeTemplate = edx.HtmlUtils.template($('#thread-type-template').html());
                 if ($('.js-group-select').prop('disabled')) {
                     $('.group-selector-wrapper').addClass('disabled');
                 }
@@ -77,7 +80,7 @@
                     if (this.course_settings.get('is_discussion_division_enabled')) {
                         this.topicView.on('thread:topic_change', this.updateVisibilityMessage);
                     }
-                    this.addField(this.topicView.render());
+                    this.addField(edx.HtmlUtils.HTML(this.topicView.render()));
                 } else {
                     this.group_name = this.getGroupName();
                     this.updateVisibilityMessage(null, this.is_commentable_divided);
@@ -86,7 +89,10 @@
             };
 
             NewPostView.prototype.addField = function(fieldView) {
-                return this.$('.forum-new-post-form-wrapper').append(fieldView);
+                return edx.HtmlUtils.append(
+                    this.$('.forum-new-post-form-wrapper'),
+                    fieldView
+                );
             };
 
             NewPostView.prototype.isTabMode = function() {

common/static/common/js/discussion/views/response_comment_edit_view.js

@@ -43,8 +43,11 @@
             ResponseCommentEditView.prototype.render = function() {
                 var context = $.extend({mode: this.options.mode, startHeader: this.options.startHeader},
                     this.model.attributes);
-                this.template = _.template($('#response-comment-edit-template').html());
-                this.$el.html(this.template(context));
+                this.template = edx.HtmlUtils.template($('#response-comment-edit-template').html());
+                edx.HtmlUtils.setHtml(
+                    this.$el,
+                    this.template(context)
+                );
                 this.delegateEvents();
                 DiscussionUtil.makeWmdEditor(this.$el, $.proxy(this.$, this), 'edit-comment-body');
                 return this;

common/static/common/js/discussion/views/thread_response_edit_view.js

@@ -43,8 +43,11 @@
             ThreadResponseEditView.prototype.render = function() {
                 var context = $.extend({mode: this.options.mode, startHeader: this.options.startHeader},
                     this.model.attributes);
-                this.template = _.template($('#thread-response-edit-template').html());
-                this.$el.html(this.template(context));
+                this.template = edx.HtmlUtils.template($('#thread-response-edit-template').html());
+                edx.HtmlUtils.setHtml(
+                    this.$el,
+                    this.template(context)
+                );
                 this.delegateEvents();
                 DiscussionUtil.makeWmdEditor(this.$el, $.proxy(this.$, this), 'edit-post-body');
                 return this;

common/templates/admin/student/loginfailures/change_form_template.html

@@ -4,13 +4,13 @@
 <div class="submit-row">
     {% if original.lockout_until %}
     <input type="submit"
-           value="{% trans "Unlock Account" %}"
+           value="{% trans "Unlock Account" as tmsg %}{{tmsg|force_escape}}"
            name="_unlock"
            class="deletelink">
     {% endif %}
     <a href="{% url opts|admin_urlname:'changelist' %}"
        class="closelink">
-        {% trans 'Close' %}
+        {% trans 'Close' as tmsg %}{{tmsg|force_escape}}
     </a>
 </div>
 {% endblock %}
@@ -19,14 +19,14 @@
     {% if original.lockout_until %}
     <p class="deletelink-box">
         <input type="submit"
-               value="{% trans "Unlock Account" %}"
+               value="{% trans "Unlock Account" as tmsg %}{{tmsg|force_escape}}"
                name="_unlock"
                class="deletelink">
     </p>
     {% endif %}
     <a href="{% url opts|admin_urlname:'changelist' %}"
        class="closelink">
-        {% trans 'Close' %}
+        {% trans 'Close' as tmsg %}{{tmsg|force_escape}}
     </a>
 </div>
 {% endblock %}