From e9708ca6e0aac9c7e97d45697d55c0bc973b3a9d Mon Sep 17 00:00:00 2001
From: Adeel Khan <muhammad.adeel@arbisoft.com>
Date: Tue, 29 Oct 2019 14:28:39 +0500
Subject: [PATCH] Fixing templates for double escaping.

Some of the email templates are escaped
in such a way that could potentially cause
double escaping i.e via django default behaviour
and other via interpolate_html tag. Fixing it
by only applying escape via tag.

PROD-810
---
 .../schedules/edx_ace/courseupdate/email/body.html        | 6 +++---
 .../edx_ace/recurringnudge_day10/email/body.html          | 4 ++--
 .../schedules/edx_ace/recurringnudge_day3/email/body.html | 8 ++++----
 .../schedules/edx_ace/upgradereminder/email/body.html     | 6 +++---
 4 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/openedx/core/djangoapps/schedules/templates/schedules/edx_ace/courseupdate/email/body.html b/openedx/core/djangoapps/schedules/templates/schedules/edx_ace/courseupdate/email/body.html
index c17360558e..545a165ba7 100644
--- a/openedx/core/djangoapps/schedules/templates/schedules/edx_ace/courseupdate/email/body.html
+++ b/openedx/core/djangoapps/schedules/templates/schedules/edx_ace/courseupdate/email/body.html
@@ -16,10 +16,10 @@
         <td>
             <p>
                 {% blocktrans trimmed asvar tmsg %}
-                    We hope you're enjoying {start_strong}{{ course_name }}{end_strong}!
-                    We want to let you know what you can look forward to in week {{ week_num }}:
+                    We hope you're enjoying {start_strong}{course_name}{end_strong}!
+                    We want to let you know what you can look forward to in week {week_num}:
                 {% endblocktrans %}
-                {% interpolate_html tmsg start_strong='<strong>'|safe end_strong='</strong>'|safe %}
+                {% interpolate_html tmsg start_strong='<strong>'|safe end_strong='</strong>'|safe course_name=course_name|force_escape|safe week_num=week_num|force_escape|safe %}
                 <ul>
                     {% for highlight in week_highlights %}
                         <li>{{ highlight }}</li>
diff --git a/openedx/core/djangoapps/schedules/templates/schedules/edx_ace/recurringnudge_day10/email/body.html b/openedx/core/djangoapps/schedules/templates/schedules/edx_ace/recurringnudge_day10/email/body.html
index eb33c53d8a..4aafbc7a1d 100644
--- a/openedx/core/djangoapps/schedules/templates/schedules/edx_ace/recurringnudge_day10/email/body.html
+++ b/openedx/core/djangoapps/schedules/templates/schedules/edx_ace/recurringnudge_day10/email/body.html
@@ -36,10 +36,10 @@
                 {% endfilter %}
                 {% else %}
                     {% blocktrans trimmed asvar tmsg %}
-                        Many {{ platform_name }} learners in {start_strong}{{course_name}}{end_strong} are completing more problems every week, and
+                        Many {platform_name} learners in {start_strong}{course_name}{end_strong} are completing more problems every week, and
                         participating in the discussion forums. What do you want to do to keep learning?
                     {% endblocktrans %}
-                    {% interpolate_html tmsg start_strong='<strong>'|safe end_strong='</strong>'|safe %}
+                    {% interpolate_html tmsg start_strong='<strong>'|safe end_strong='</strong>'|safe course_name=course_name|force_escape|safe platform_name=platform_name|force_escape|safe %}
                 {% endif %}
             </p>
             {# xss-lint: disable=django-trans-missing-escape #}
diff --git a/openedx/core/djangoapps/schedules/templates/schedules/edx_ace/recurringnudge_day3/email/body.html b/openedx/core/djangoapps/schedules/templates/schedules/edx_ace/recurringnudge_day3/email/body.html
index 1457dcc710..85a2076232 100644
--- a/openedx/core/djangoapps/schedules/templates/schedules/edx_ace/recurringnudge_day3/email/body.html
+++ b/openedx/core/djangoapps/schedules/templates/schedules/edx_ace/recurringnudge_day3/email/body.html
@@ -29,16 +29,16 @@
             <p>
                 {% if course_ids|length > 1 %}
                     {% blocktrans trimmed asvar tmsg %}
-                        Remember when you enrolled in {start_strong}{{ course_name }}{end_strong}, and other courses on {{ platform_name }}? We do, and we’re glad
+                        Remember when you enrolled in {start_strong}{course_name}{end_strong}, and other courses on {platform_name}? We do, and we’re glad
                         to have you! Come see what everyone is learning.
                     {% endblocktrans %}
-                    {% interpolate_html tmsg start_strong='<strong>'|safe end_strong='</strong>'|safe %}
+                    {% interpolate_html tmsg start_strong='<strong>'|safe end_strong='</strong>'|safe course_name=course_name|force_escape|safe platform_name=platform_name|force_escape|safe %}
                 {% else %}
                     {% blocktrans trimmed asvar tmsg %}
-                        Remember when you enrolled in {start_strong}{{ course_name }}{end_strong} on {{ platform_name }}? We do, and we’re glad
+                        Remember when you enrolled in {start_strong}{course_name}{end_strong} on {platform_name}? We do, and we’re glad
                         to have you! Come see what everyone is learning.
                     {% endblocktrans %}
-                    {% interpolate_html tmsg start_strong='<strong>'|safe end_strong='</strong>'|safe %}
+                    {% interpolate_html tmsg start_strong='<strong>'|safe end_strong='</strong>'|safe course_name=course_name|force_escape|safe platform_name=platform_name|force_escape|safe %}
                 {% endif %}
             </p>
             {# xss-lint: disable=django-trans-missing-escape #}
diff --git a/openedx/core/djangoapps/schedules/templates/schedules/edx_ace/upgradereminder/email/body.html b/openedx/core/djangoapps/schedules/templates/schedules/edx_ace/upgradereminder/email/body.html
index 7ced5182ba..03824fbea2 100644
--- a/openedx/core/djangoapps/schedules/templates/schedules/edx_ace/upgradereminder/email/body.html
+++ b/openedx/core/djangoapps/schedules/templates/schedules/edx_ace/upgradereminder/email/body.html
@@ -44,11 +44,11 @@
                     {% interpolate_html tmsg start_strong='<strong>'|safe end_strong='</strong>'|safe %}
                 {% else %}
                     {% blocktrans trimmed asvar tmsg %}
-                        We hope you are enjoying learning with us so far in {start_strong}{{ first_course_name }}{end_strong}! A
+                        We hope you are enjoying learning with us so far in {start_strong}{first_course_name}{end_strong}! A
                         verified certificate allows you to highlight your new knowledge and skills. An
-                        {{ platform_name }} certificate is official and easily shareable.
+                        {platform_name} certificate is official and easily shareable.
                     {% endblocktrans %}
-                    {% interpolate_html tmsg start_strong='<strong>'|safe end_strong='</strong>'|safe %}
+                    {% interpolate_html tmsg start_strong='<strong>'|safe end_strong='</strong>'|safe first_course_name=first_course_name|force_escape|safe platform_name=platform_name|force_escape|safe %}
                 {% endif %}
             </p>
             <p>