Merge pull request #221 from edx/IM/security-fixes-10

Incident Management Security Fixes 10

cms/templates/js/metadata-dict-entry.underscore

 <div class="wrapper-comp-setting metadata-dict">
-  <label class="label setting-label" for="<%= uniqueId %>"><%= model.get('display_name')%></label>
-  <div id="<%= uniqueId %>" class="wrapper-dict-settings">
+  <label class="label setting-label" for="<%- uniqueId %>"><%- model.get('display_name')%></label>
+  <div id="<%- uniqueId %>" class="wrapper-dict-settings">
     <ol class="list-settings"></ol>
     <a href="#" class="create-action create-setting">
-      <span class="icon fa fa-plus" aria-hidden="true"></span><%= gettext("Add") %> <span class="sr"><%= model.get('display_name')%></span>
+      <span class="icon fa fa-plus" aria-hidden="true"></span><%- gettext("Add") %> <span class="sr"><%- model.get('display_name')%></span>
     </a>
   </div>
-  <button class="action setting-clear inactive" type="button" name="setting-clear" value="<%= gettext("Clear") %>" data-tooltip="<%= gettext("Clear") %>">
+  <button class="action setting-clear inactive" type="button" name="setting-clear" value="<%- gettext("Clear") %>" data-tooltip="<%- gettext("Clear") %>">
     <span class="icon fa fa-undo" aria-hidden="true"></span>
-    <span class="sr">"<%= gettext("Clear Value") %>"</span>
+    <span class="sr">"<%- gettext("Clear Value") %>"</span>
   </button>
 </div>
-<span class="tip setting-help"><%= model.get('help') %></span>
+<span class="tip setting-help"><%- model.get('help') %></span>

cms/templates/js/metadata-option-entry.underscore

 <div class="wrapper-comp-setting">
-    <label class="label setting-label" for="<%= uniqueId %>"><%= model.get('display_name') %></label>
-    <select class="input setting-input" id="<%= uniqueId %>" name="<%= model.get('display_name') %>">
+    <label class="label setting-label" for="<%- uniqueId %>"><%- model.get('display_name') %></label>
+    <select class="input setting-input" id="<%- uniqueId %>" name="<%- model.get('display_name') %>">
         <% _.each(model.get('options'), function(option) { %>
             <% if (option.display_name !== undefined) { %>
-                <option value="<%= option['display_name'] %>"><%= option['display_name'] %></option>
+                <option value="<%- option['display_name'] %>"><%- option['display_name'] %></option>
             <% } else { %>
-                <option value="<%= option %>"><%= option %></option>
+                <option value="<%- option %>"><%- option %></option>
             <% } %>
         <% }) %>
     </select>
-    <button class="action setting-clear inactive" type="button" name="setting-clear" value="<%= gettext("Clear") %>" data-tooltip="<%= gettext("Clear") %>">
-        <span class="icon fa fa-undo" aria-hidden="true"></span><span class="sr">"<%= gettext("Clear Value") %>"</span>
+    <button class="action setting-clear inactive" type="button" name="setting-clear" value="<%- gettext("Clear") %>" data-tooltip="<%- gettext("Clear") %>">
+        <span class="icon fa fa-undo" aria-hidden="true"></span><span class="sr">"<%- gettext("Clear Value") %>"</span>
     </button>
 </div>
-<span class="tip setting-help"><%= model.get('help') %></span>
+<span class="tip setting-help"><%- model.get('help') %></span>

cms/templates/js/validation-error-modal.underscore

 <div class = "validation-error-modal-content">
     <div class "error-header">
         <p>
-        <%= _.template(
+        <%= _.template( // xss-lint: disable=underscore-not-escaped
             ngettext(
                 "There was {strong_start}{num_errors} validation error{strong_end} while trying to save the course settings in the database.",
                 "There were {strong_start}{num_errors} validation errors{strong_end} while trying to save the course settings in the database.",
@@ -13,7 +13,7 @@
                 num_errors: num_errors,
                 strong_end: '</strong>'
             })%>
-        <%= gettext("Please check the following validation feedbacks and reflect them in your course settings:")%></p>
+        <%- gettext("Please check the following validation feedbacks and reflect them in your course settings:")%></p>
     </div>
 
     <hr>
@@ -24,9 +24,9 @@
             <li class = "error-item">
                 <span class='error-item-title'>
                     <span class="icon fa fa-warning" aria-hidden="true"></span>
-                    <strong><%= value.model.display_name %></strong>:
+                    <strong><%- value.model.display_name %></strong>:
                 </span>
-                <textarea class = "error-item-message" disabled='disabled'><%=value.message%></textarea>
+                <textarea class = "error-item-message" disabled='disabled'><%-value.message%></textarea>
             </li>
 
         <% }); %>

cms/templates/js/verification-access-editor.underscore

 <form>
   <div role="group" aria-labelledby="verification-checkpoint-title">
-    <h3 id="verification-checkpoint-title" class="modal-section-title"><%= gettext('Verification Checkpoint') %></h3>
+    <h3 id="verification-checkpoint-title" class="modal-section-title"><%- gettext('Verification Checkpoint') %></h3>
     <div class="modal-section-content verification-access">
       <div class="list-fields list-input">
         <div class="field field-checkbox checkbox-cosmetic">
@@ -20,7 +20,7 @@
           </label>
 
           <label class="sr" for="verification-partition-select">
-            <%= gettext('Verification checkpoint to be completed') %>
+            <%- gettext('Verification checkpoint to be completed') %>
           </label>
 
           <select id="verification-partition-select">
@@ -35,7 +35,7 @@
           </select>
 
           <div id="verification-help-text" class="note">
-            <%= gettext("Learners who require verification must pass the selected checkpoint to see the content in this unit. Learners who do not require verification see this content by default.") %>
+            <%- gettext("Learners who require verification must pass the selected checkpoint to see the content in this unit. Learners who do not require verification see this content by default.") %>
           </div>
         </div>
       </div>

cms/templates/js/video/metadata-translations-item.underscore

-<li class="list-settings-item" data-original-lang="<%= originalLang %>">
-  <a href="#" class="remove-action remove-setting" data-value="<%= value %>"><span class="icon fa fa-times-circle" aria-hidden="true"></span><span class="sr"><%= gettext("Remove") %></span></a>
-  <input type="hidden" class="input" value="<%= value %>">
+<li class="list-settings-item" data-original-lang="<%- originalLang %>">
+  <a href="#" class="remove-action remove-setting" data-value="<%- value %>"><span class="icon fa fa-times-circle" aria-hidden="true"></span><span class="sr"><%- gettext("Remove") %></span></a>
+  <input type="hidden" class="input" value="<%- value %>">
   <div class="list-settings-buttons"><% if (newLang) {
-    %><a href="#" class="upload-action upload-setting" data-value="<%= value %>"><%= value ? gettext("Replace") : gettext("Upload") %>
+    %><a href="#" class="upload-action upload-setting" data-value="<%- value %>"><%- value ? gettext("Replace") : gettext("Upload") %>
     </a><%
      } %><% if (value) {
-     %><a href="<%= url %>?language_code=<%= originalLang %>" class="download-action download-setting"><%= gettext("Download") %>
+     %><a href="<%- url %>?language_code=<%- originalLang %>" class="download-action download-setting"><%- gettext("Download") %>
     </a><%
      }
    %>