Merge pull request #220 from edx/IM/security-fixes-9

Incident Management Security Fixes 9

cms/templates/js/add-xblock-component-button.underscore

 <% if (type === 'advanced' || templates.length > 1) { %>
-<button type="button" class="multiple-templates add-xblock-component-button" data-type="<%= type %>">
+<button type="button" class="multiple-templates add-xblock-component-button" data-type="<%- type %>">
 <% } else { %>
-<button type="button" class="single-template add-xblock-component-button" data-type="<%= type %>" data-category="<%= templates[0].category %>">
+<button type="button" class="single-template add-xblock-component-button" data-type="<%- type %>" data-category="<%- templates[0].category %>">
 <% } %>
-  <span class="large-template-icon large-<%= type %>-icon"></span>
-  <span class="sr"> <%= gettext("Add Component:") %></span>
-  <span class="name"><%= display_name %></span>
+  <span class="large-template-icon large-<%- type %>-icon"></span>
+  <span class="sr"> <%- gettext("Add Component:") %></span>
+  <span class="name"><%- display_name %></span>
 </button>

cms/templates/js/add-xblock-component.underscore

 <div class="new-component">
-    <h5><%= gettext("Add New Component") %></h5>
+    <h5><%- gettext("Add New Component") %></h5>
     <ul class="new-component-type">
     </ul>
 </div>

cms/templates/js/asset-upload-modal.underscore

 <div class="upload-modal modal" style="display: none;">
-    <a href="#" class="close-button"><span class="icon fa fa-times-circle" aria-hidden="true"></span> <span class="sr"><%= gettext('close') %></span></a>
+    <a href="#" class="close-button"><span class="icon fa fa-times-circle" aria-hidden="true"></span> <span class="sr"><%- gettext('close') %></span></a>
     <div class="modal-body">
-        <h1 class="title"><%= gettext("Upload New File") %></h1>
+        <h1 class="title"><%- gettext("Upload New File") %></h1>
         <p class="file-name">
         <div class="progress-bar">
             <div class="progress-fill"></div>
@@ -12,7 +12,7 @@
         </div>
         <form class="file-chooser" action="asset-url"
               method="post" enctype="multipart/form-data">
-            <a href="#" class="choose-file-button"><%= gettext("Choose File") %></a>
+            <a href="#" class="choose-file-button"><%- gettext("Choose File") %></a>
             <input type="file" class="file-input" name="file">
         </form>
     </div>

cms/templates/js/course_grade_policy.underscore

 <li class="field-group course-grading-assignment-list-item">
   <div class="field text" id="field-course-grading-assignment-name">
-  	<label for="course-grading-assignment-name"><%= gettext("Assignment Type Name") %></label>
-  	<input type="text" class="long" id="course-grading-assignment-name" value="<%= model.get('type') %>" />
-  	<span class="tip tip-stacked"><%= gettext("The general category for this type of assignment, for example, Homework or Midterm Exam. This name is visible to learners.") %></span>
+  	<label for="course-grading-assignment-name"><%- gettext("Assignment Type Name") %></label>
+  	<input type="text" class="long" id="course-grading-assignment-name" value="<%= model.get('type') %>" /> <% // xss-lint: disable=underscore-not-escaped %>
+  	<span class="tip tip-stacked"><%- gettext("The general category for this type of assignment, for example, Homework or Midterm Exam. This name is visible to learners.") %></span>
   </div>
 
   <div class="field text" id="field-course-grading-assignment-shortname">
-    <label for="course-grading-assignment-shortname"><%= gettext("Abbreviation") %></label>
-    <input type="text" class="short" id="course-grading-assignment-shortname" value="<%= model.get('short_label') %>" />
-    <span class="tip tip-stacked"><%= gettext("This short name for the assignment type (for example, HW or Midterm) appears next to assignments on a learner's Progress page.") %></span>
+    <label for="course-grading-assignment-shortname"><%- gettext("Abbreviation") %></label>
+    <input type="text" class="short" id="course-grading-assignment-shortname" value="<%= model.get('short_label') %>" /> <% // xss-lint: disable=underscore-not-escaped %>
+    <span class="tip tip-stacked"><%- gettext("This short name for the assignment type (for example, HW or Midterm) appears next to assignments on a learner's Progress page.") %></span>
   </div>
 
   <div class="field text" id="field-course-grading-assignment-gradeweight">
-    <label for="course-grading-assignment-gradeweight"><%= gettext("Weight of Total Grade") %></label>
-    <input type="text" class="short" id="course-grading-assignment-gradeweight" value = "<%= model.get('weight') %>" />
-    <span class="tip tip-stacked"><%= gettext("The weight of all assignments of this type as a percentage of the total grade, for example, 40. Do not include the percent symbol.") %></span>
+    <label for="course-grading-assignment-gradeweight"><%- gettext("Weight of Total Grade") %></label>
+    <input type="text" class="short" id="course-grading-assignment-gradeweight" value = "<%= model.get('weight') %>" /> <% // xss-lint: disable=underscore-not-escaped %>
+    <span class="tip tip-stacked"><%- gettext("The weight of all assignments of this type as a percentage of the total grade, for example, 40. Do not include the percent symbol.") %></span>
   </div>
 
   <div class="field text" id="field-course-grading-assignment-totalassignments">
-    <label for="course-grading-assignment-totalassignments"><%= gettext("Total Number") %></label>
-    <input type="text" class="short" id="course-grading-assignment-totalassignments" value = "<%= model.get('min_count') %>" />
-    <span class="tip tip-stacked"><%= gettext("The number of subsections in the course that contain problems of this assignment type.") %></span>
+    <label for="course-grading-assignment-totalassignments"><%- gettext("Total Number") %></label>
+    <input type="text" class="short" id="course-grading-assignment-totalassignments" value = "<%= model.get('min_count') %>" /> <% // xss-lint: disable=underscore-not-escaped %>
+    <span class="tip tip-stacked"><%- gettext("The number of subsections in the course that contain problems of this assignment type.") %></span>
   </div>
 
   <div class="field text" id="field-course-grading-assignment-droppable">
-    <label for="course-grading-assignment-droppable"><%= gettext("Number of Droppable") %></label>
-    <input type="text" class="short" id="course-grading-assignment-droppable" value = "<%= model.get('drop_count') %>" />
-    <span class="tip tip-stacked"><%= gettext("The number of assignments of this type that will be dropped. The lowest scoring assignments are dropped first.") %></span>
+    <label for="course-grading-assignment-droppable"><%- gettext("Number of Droppable") %></label>
+    <input type="text" class="short" id="course-grading-assignment-droppable" value = "<%= model.get('drop_count') %>" /> <% // xss-lint: disable=underscore-not-escaped %>
+    <span class="tip tip-stacked"><%- gettext("The number of assignments of this type that will be dropped. The lowest scoring assignments are dropped first.") %></span>
   </div>
 
   <div class="actions">
-  	<a href="#" class="button delete-button standard remove-item remove-grading-data"><span class="delete-icon"></span><%= gettext("Delete") %></a>
+  	<a href="#" class="button delete-button standard remove-item remove-grading-data"><span class="delete-icon"></span><%- gettext("Delete") %></a>
   </div>
 </li>

lms/djangoapps/teams/static/teams/templates/team-member.underscore

 <li>
   <span class="team-member">
-    <a class="member-profile" href="<%= memberProfileUrl %>">
-      <p class="tooltip-custom"><%= username %></p>
-      <img class="image-url" src="<%= imageUrl %>" alt="profile page" />
+    <a class="member-profile" href="<%- memberProfileUrl %>">
+      <p class="tooltip-custom"><%- username %></p>
+      <img class="image-url" src="<%- imageUrl %>" alt="profile page" />
     </a>
   </span>
 </li>