Skip to content
Snippets Groups Projects
Unverified Commit 372254e3 authored by Uzair Rasheed's avatar Uzair Rasheed Committed by GitHub
Browse files

Merge pull request #200 from edx/security-fix/fix-xss-in-templates 

Security fix/fix xss in templates
parents a206e777 8ba1d522
No related branches found
No related tags found
No related merge requests found
Hide whitespace changes
Inline Side-by-side
Showing
with 90 additions and 90 deletions
cms/templates/js/course_info_handouts.underscore
+ 6
− 6
View file @ 372254e3
<a href="#" class="edit-button"><span class="edit-icon"></span><%= gettext("Edit") %></a>
<a href="#" class="edit-button"><span class="edit-icon"></span><%- gettext("Edit") %></a>
<h2 class="title"><%= gettext("Course Handouts") %></h2>
<h2 class="title"><%- gettext("Course Handouts") %></h2>
<%if (model.get('data') != null) { %>
<div class="handouts-content">
</div>
<% } else {%>
<p><%= gettext("You have no handouts defined") %></p>
<p><%- gettext("You have no handouts defined") %></p>
<% } %>
<form class="edit-handouts-form" style="display: block;">
<div class="message message-status error" name="handout_html_error" id="handout_error">
<%= gettext("There is invalid code in your content. Please check to make sure it is valid HTML.") %>
<%- gettext("There is invalid code in your content. Please check to make sure it is valid HTML.") %>
</div>
<div class="row">
<textarea class="handouts-content-editor text-editor"></textarea>
</div>
<div class="row">
<a href="#" class="save-button"><%= gettext("Save") %></a>
<a href="#" class="cancel-button"><%= gettext("Cancel") %></a>
<a href="#" class="save-button"><%- gettext("Save") %></a>
<a href="#" class="cancel-button"><%- gettext("Cancel") %></a>
</div>
</form>
cms/templates/js/grading-editor.underscore
+ 4
− 4
View file @ 372254e3
<h3 class="modal-section-title"><%= gettext('Grading') %></h3>
<h3 class="modal-section-title"><%- gettext('Grading') %></h3>
<div class="modal-section-content grading-type">
<ul class="list-fields list-input">
<li class="field field-grading-type field-select">
<label for="grading_type" class="label"><%= gettext('Grade as:') %></label>
<label for="grading_type" class="label"><%- gettext('Grade as:') %></label>
<select class="input" id="grading_type">
<option value="notgraded"><%= gettext('Not Graded') %></option>
<option value="notgraded"><%- gettext('Not Graded') %></option>
<% _.each(graderTypes, function(grader) { %>
<option value="<%= grader %>"><%= grader %></option>
<option value="<%- grader %>"><%- grader %></option>
<% }); %>
</select>
</li>
......
cms/templates/js/metadata-string-entry.underscore
+ 5
− 5
View file @ 372254e3
<div class="wrapper-comp-setting">
<label class="label setting-label" for="<%= uniqueId %>"><%= model.get('display_name') %></label>
<input class="input setting-input" type="text" id="<%= uniqueId %>" value='<%= model.get("value") %>'/>
<button class="action setting-clear inactive" type="button" name="setting-clear" value="<%= gettext("Clear") %>" data-tooltip="<%= gettext("Clear") %>">
<span class="icon fa fa-undo" aria-hidden="true"></span><span class="sr">"<%= gettext("Clear Value") %>"</span>
<label class="label setting-label" for="<%- uniqueId %>"><%- model.get('display_name') %></label>
<input class="input setting-input" type="text" id="<%- uniqueId %>" value='<%- model.get("value") %>'/>
<button class="action setting-clear inactive" type="button" name="setting-clear" value="<%- gettext("Clear") %>" data-tooltip="<%- gettext("Clear") %>">
<span class="icon fa fa-undo" aria-hidden="true"></span><span class="sr">"<%- gettext("Clear Value") %>"</span>
</button>
</div>
<span class="tip setting-help"><%= model.get('help') %></span>
<span class="tip setting-help"><%- model.get('help') %></span>
cms/templates/js/section-name-edit.underscore
+ 3
− 3
View file @ 372254e3
<form class="section-name-edit">
<input type="text" value="<%= name %>" autocomplete="off"/>
<input type="submit" class="save-button" value="<%= gettext("Save") %>" />
<input type="button" class="cancel-button" value="<%= gettext("Cancel") %>" />
<input type="text" value="<%- name %>" autocomplete="off"/>
<input type="submit" class="save-button" value="<%- gettext("Save") %>" />
<input type="button" class="cancel-button" value="<%- gettext("Cancel") %>" />
</form>
cms/templates/js/signatory-actions.underscore
+ 2
− 2
View file @ 372254e3
<div class="collection-edit">
<div class="actions custom-signatory-action">
<button class="signatory-panel-save action action-primary" type="submit"><%= gettext("Save") %></button>
<button class="signatory-panel-close action action-secondary action-cancel"><%= gettext("Cancel") %></button>
<button class="signatory-panel-save action action-primary" type="submit"><%- gettext("Save") %></button>
<button class="signatory-panel-close action action-secondary action-cancel"><%- gettext("Cancel") %></button>
</div>
</div>
cms/templates/js/team-member.underscore
+ 15
− 15
View file @ 372254e3
<li class="user-item" data-email="<%= user.email %>">
<li class="user-item" data-email="<%- user.email %>">
<span class="wrapper-ui-badge">
<span class="flag flag-role flag-role-<%= user.role %> is-hanging">
<span class="label sr"><%= gettext("Current Role:") %></span>
<span class="flag flag-role flag-role-<%- user.role %> is-hanging">
<span class="label sr"><%- gettext("Current Role:") %></span>
<span class="value">
<%= roles[user.role] %>
<%- roles[user.role] %>
<% if (is_current_user) { %>
<span class="msg-you"><%= gettext("You!") %></span>
<span class="msg-you"><%- gettext("You!") %></span>
<% } %>
</span>
</span>
......@@ -13,11 +13,11 @@
<div class="item-metadata">
<h3 class="user-name">
<span class="user-username"><%= user.username %></span>
<span class="user-username"><%- user.username %></span>
<span class="user-email">
<a class="action action-email" href="mailto:<%= user.email %>"
title="<%= viewHelpers.format(gettext("send an email message to {email}"), {email: user.email})%>">
<%= user.email %>
<a class="action action-email" href="mailto:<%- user.email %>"
title="<%- viewHelpers.format(gettext("send an email message to {email}"), {email: user.email})%>">
<%- user.email %>
</a>
</span>
</h3>
......@@ -29,19 +29,19 @@
<% for (var i=0; i < actions.length; i++) { %>
<% var action = actions[i]; %>
<% if (action.notoggle) { %>
<span class="admin-role notoggleforyou"><%= gettext("Promote another member to Admin to remove your admin rights") %></span>
<span class="admin-role notoggleforyou"><%- gettext("Promote another member to Admin to remove your admin rights") %></span>
<% } else { %>
<a href="#" class="make-<%= action.to_role %> admin-role <%= action.direction %>-admin-role">
<a href="#" class="make-<%- action.to_role %> admin-role <%- action.direction %>-admin-role">
<% var template = (action.direction === 'add') ? gettext("Add {role} Access") : gettext("Remove {role} Access"); %>
<%= viewHelpers.format(template, {role: action.label}) %></span>
<%- viewHelpers.format(template, {role: action.label}) %></span>
</a>
<% } %>
<% } %>
</li>
<li class="action action-delete <%=!allow_delete ? "is-disabled" : "" %> aria-disabled="<%=!allow_delete%>">
<a href="#" class="delete remove-user action-icon" data-id="<%= user.email %>">
<li class="action action-delete <%-!allow_delete ? "is-disabled" : "" %> aria-disabled="<%-!allow_delete%>">
<a href="#" class="delete remove-user action-icon" data-id="<%- user.email %>">
<span class="icon fa fa-trash-o" aria-hidden="true"></span>
<span class="sr"><%= viewHelpers.format(gettext("Delete the user, {username}"), {username:user.username}) %></span>
<span class="sr"><%- viewHelpers.format(gettext("Delete the user, {username}"), {username:user.username}) %></span>
</a>
</li>
</ul>
......
cms/templates/js/video/transcripts/messages/transcripts-import.underscore
+ 7
− 7
View file @ 372254e3
<div class="transcripts-message-status status-error"><span class="icon fa fa-remove" aria-hidden="true"></span><%= gettext("No EdX Timed Transcript") %></div>
<div class="transcripts-message-status status-error"><span class="icon fa fa-remove" aria-hidden="true"></span><%- gettext("No EdX Timed Transcript") %></div>
<p class="transcripts-message">
<%= gettext("EdX doesn't have a timed transcript for this video in Studio, but we found a transcript on YouTube. You can import the YouTube transcript or upload your own .srt transcript file.") %>
<%- gettext("EdX doesn't have a timed transcript for this video in Studio, but we found a transcript on YouTube. You can import the YouTube transcript or upload your own .srt transcript file.") %>
</p>
<div class="transcripts-file-uploader"></div>
<p class="transcripts-error-message is-invisible">
<%= gettext("Error.") %>
<%- gettext("Error.") %>
</p>
<div class="wrapper-transcripts-buttons">
<button class="action setting-import" type="button" name="setting-import" value="<%= gettext("Import YouTube Transcript") %>" data-tooltip="<%= gettext("Import YouTube Transcript") %>">
<span><%= gettext("Import YouTube Transcript") %></span>
<button class="action setting-import" type="button" name="setting-import" value="<%- gettext("Import YouTube Transcript") %>" data-tooltip="<%- gettext("Import YouTube Transcript") %>">
<span><%- gettext("Import YouTube Transcript") %></span>
</button>
<button class="action setting-upload" type="button" name="setting-upload" value="<%= gettext("Upload New Transcript") %>" data-tooltip="<%= gettext("Upload New .srt Transcript") %>">
<span><%= gettext("Upload New Transcript") %></span>
<button class="action setting-upload" type="button" name="setting-upload" value="<%- gettext("Upload New Transcript") %>" data-tooltip="<%- gettext("Upload New .srt Transcript") %>">
<span><%- gettext("Upload New Transcript") %></span>
</button>
</div>
cms/templates/js/video/transcripts/messages/transcripts-not-found.underscore
+ 7
− 7
View file @ 372254e3
<div class="transcripts-message-status status-error"><span class="icon fa fa-remove" aria-hidden="true"></span><%= gettext("No Timed Transcript") %></div>
<div class="transcripts-message-status status-error"><span class="icon fa fa-remove" aria-hidden="true"></span><%- gettext("No Timed Transcript") %></div>
<p class="transcripts-message">
<%= gettext("EdX doesn\'t have a timed transcript for this video. Please upload an .srt file.") %>
<%- gettext("EdX doesn\'t have a timed transcript for this video. Please upload an .srt file.") %>
</p>
<div class="transcripts-file-uploader"></div>
<p class="transcripts-error-message is-invisible">
<%= gettext("Error.") %>
<%- gettext("Error.") %>
</p>
<div class="wrapper-transcripts-buttons">
<button class="action setting-upload" type="button" name="setting-upload" value="<%= gettext("Upload New Transcript") %>" data-tooltip="<%= gettext("Upload New Transcript") %>">
<%= gettext("Upload New Transcript") %>
<button class="action setting-upload" type="button" name="setting-upload" value="<%- gettext("Upload New Transcript") %>" data-tooltip="<%- gettext("Upload New Transcript") %>">
<%- gettext("Upload New Transcript") %>
</button>
<a class="action setting-download is-disabled" aria-disabled="true" href="javascropt: void(0);" data-tooltip="<%= gettext("Download Transcript for Editing") %>">
<%= gettext("Download Transcript for Editing") %>
<a class="action setting-download is-disabled" aria-disabled="true" href="javascropt: void(0);" data-tooltip="<%- gettext("Download Transcript for Editing") %>">
<%- gettext("Download Transcript for Editing") %>
</a>
</div>
cms/templates/js/video/transcripts/messages/transcripts-replace.underscore
+ 7
− 7
View file @ 372254e3
<div class="transcripts-message-status status-error">
<span class="icon fa fa-remove" aria-hidden="true"></span>
<%= gettext("Timed Transcript Conflict") %>
<%- gettext("Timed Transcript Conflict") %>
</div>
<p class="transcripts-message">
<%= gettext("The timed transcript for this video on edX is out of date, but YouTube has a current timed transcript for this video.") %>
<%- gettext("The timed transcript for this video on edX is out of date, but YouTube has a current timed transcript for this video.") %>
<strong>
<%= gettext("Do you want to replace the edX transcript with the YouTube transcript?") %>
<%- gettext("Do you want to replace the edX transcript with the YouTube transcript?") %>
</strong>
</p>
<p class="transcripts-error-message is-invisible">
<%= gettext("Error.") %>
<%- gettext("Error.") %>
</p>
<div class="wrapper-transcripts-buttons">
......@@ -19,11 +19,11 @@
class="action setting-replace"
type="button"
name="setting-replace"
value="<%= gettext("Yes, replace the edX transcript with the YouTube transcript") %>"
data-tooltip="<%= gettext("Yes, replace the edX transcript with the YouTube transcript") %>"
value="<%- gettext("Yes, replace the edX transcript with the YouTube transcript") %>"
data-tooltip="<%- gettext("Yes, replace the edX transcript with the YouTube transcript") %>"
>
<span>
<%= gettext("Yes, replace the edX transcript with the YouTube transcript") %>
<%- gettext("Yes, replace the edX transcript with the YouTube transcript") %>
</span>
</button>
</div>
cms/templates/js/video/transcripts/messages/transcripts-uploaded.underscore
+ 7
− 7
View file @ 372254e3
<div class="transcripts-message-status"><span class="icon fa fa-check" aria-hidden="true"></span><%= gettext("Timed Transcript Uploaded Successfully") %></div>
<div class="transcripts-message-status"><span class="icon fa fa-check" aria-hidden="true"></span><%- gettext("Timed Transcript Uploaded Successfully") %></div>
<p class="transcripts-message">
<%= gettext("EdX has a timed transcript for this video. If you want to replace this transcript, upload a new .srt transcript file. If you want to edit this transcript, you can download, edit, and re-upload the existing transcript.") %>
<%- gettext("EdX has a timed transcript for this video. If you want to replace this transcript, upload a new .srt transcript file. If you want to edit this transcript, you can download, edit, and re-upload the existing transcript.") %>
</p>
<div class="transcripts-file-uploader"></div>
<p class="transcripts-error-message is-invisible">
<%= gettext("Error.") %>
<%- gettext("Error.") %>
</p>
<div class="wrapper-transcripts-buttons">
<button class="action setting-upload" type="button" name="setting-upload" value="<%= gettext("Upload New Transcript") %>" data-tooltip="<%= gettext("Upload New Transcript") %>">
<span><%= gettext("Upload New Transcript") %></span>
<button class="action setting-upload" type="button" name="setting-upload" value="<%- gettext("Upload New Transcript") %>" data-tooltip="<%- gettext("Upload New Transcript") %>">
<span><%- gettext("Upload New Transcript") %></span>
</button>
<a class="action setting-download" href="/transcripts/download?locator=<%= component_locator %>" data-tooltip="<%= gettext("Download Transcript for Editing") %>">
<span><%= gettext("Download Transcript for Editing") %></span>
<a class="action setting-download" href="/transcripts/download?locator=<%- component_locator %>" data-tooltip="<%- gettext("Download Transcript for Editing") %>">
<span><%- gettext("Download Transcript for Editing") %></span>
</a>
</div>
cms/templates/js/video/transcripts/messages/transcripts-use-existing.underscore
+ 9
− 9
View file @ 372254e3
<div class="transcripts-message-status status-error">
<span class="icon fa fa-remove" aria-hidden="true"></span>
<%= gettext("Confirm Timed Transcript") %>
<%- gettext("Confirm Timed Transcript") %>
</div>
<p class="transcripts-message">
<%= gettext("You changed a video URL, but did not change the timed transcript file. Do you want to use the current timed transcript or upload a new .srt transcript file?") %>
<%- gettext("You changed a video URL, but did not change the timed transcript file. Do you want to use the current timed transcript or upload a new .srt transcript file?") %>
</p>
<div class="transcripts-file-uploader"></div>
<p class="transcripts-error-message is-invisible">
<%= gettext("Error.") %>
<%- gettext("Error.") %>
</p>
<div class="wrapper-transcripts-buttons">
......@@ -18,22 +18,22 @@
class="action setting-use-existing"
type="button"
name="setting-use-existing"
value="<%= gettext("Use Current Transcript") %>"
data-tooltip="<%= gettext("Use Current Transcript") %>"
value="<%- gettext("Use Current Transcript") %>"
data-tooltip="<%- gettext("Use Current Transcript") %>"
>
<span>
<%= gettext("Use Current Transcript") %>
<%- gettext("Use Current Transcript") %>
</span>
</button>
<button
class="action setting-upload"
type="button"
name="setting-upload"
value="<%= gettext("Upload New Transcript") %>"
data-tooltip="<%= gettext("Upload New Transcript") %>"
value="<%- gettext("Upload New Transcript") %>"
data-tooltip="<%- gettext("Upload New Transcript") %>"
>
<span>
<%= gettext("Upload New Transcript") %>
<%- gettext("Upload New Transcript") %>
</span>
</button>
</div>
cms/templates/js/xblock-outline.underscore
+ 18
− 18
View file @ 372254e3
<% if (parentInfo) { %>
<li class="outline-item outline-item-<%= xblockType %> <%= includesChildren ? 'is-collapsible' : '' %> is-draggable <%= isCollapsed ? 'is-collapsed' : '' %>"
data-parent="<%= parentInfo.get('id') %>" data-locator="<%= xblockInfo.get('id') %>">
<li class="outline-item outline-item-<%- xblockType %> <%- includesChildren ? 'is-collapsible' : '' %> is-draggable <%- isCollapsed ? 'is-collapsed' : '' %>"
data-parent="<%- parentInfo.get('id') %>" data-locator="<%- xblockInfo.get('id') %>">
<span class="draggable-drop-indicator draggable-drop-indicator-before"><span class="icon fa fa-caret-right" aria-hidden="true"></span></span>
<div class="wrapper-xblock-header">
<div class="wrapper-xblock-header-primary">
<% if (includesChildren) { %>
<h3 class="xblock-title expand-collapse <%= isCollapsed ? 'expand' : 'collapse' %>"
title="<%= interpolate(
<h3 class="xblock-title expand-collapse <%- isCollapsed ? 'expand' : 'collapse' %>"
title="<%- interpolate(
gettext('Collapse/Expand this %(xblock_type)s'), { xblock_type: xblockTypeDisplayName }, true
) %>"
>
......@@ -17,7 +17,7 @@
<% } %>
<% if (xblockInfo.get('studio_url') && xblockInfo.get('category') !== 'chapter') { %>
<a href="<%= xblockInfo.get('studio_url') %>"><%- xblockInfo.get('display_name') %></a>
<a href="<%- xblockInfo.get('studio_url') %>"><%- xblockInfo.get('display_name') %></a>
<% } else { %>
<span class="wrapper-xblock-field is-editable" data-field="display_name">
<span class="xblock-field-value"><%- xblockInfo.get('display_name') %></span>
......@@ -28,9 +28,9 @@
<div class="item-actions">
<ul class="actions-list">
<li class="action-item action-delete">
<a href="#" data-tooltip="<%= gettext('Delete') %>" class="delete-button action-button">
<a href="#" data-tooltip="<%- gettext('Delete') %>" class="delete-button action-button">
<span class="icon fa fa-remove" aria-hidden="true"></span>
<span class="sr"><%= gettext('Delete') %></span>
<span class="sr"><%- gettext('Delete') %></span>
</a>
</li>
</ul>
......@@ -40,7 +40,7 @@
<% if (xblockInfo.get('release_date')) { %>
<div class="meta-info">
<span class="icon fa fa-clock-o" aria-hidden="true"></span>
<%= gettext('Released:') %> <%= xblockInfo.get('release_date') %>
<%- gettext('Released:') %> <%- xblockInfo.get('release_date') %>
</div>
<% } %>
......@@ -54,30 +54,30 @@
<% } %>
<% if (!parentInfo && xblockInfo.get('child_info') && xblockInfo.get('child_info').children.length === 0) { %>
<div class="no-content add-xblock-component">
<p><%= gettext("You haven't added any content to this course yet.") %>
<a href="#" class="button button-new" data-category="<%= childCategory %>"
data-parent="<%= xblockInfo.get('id') %>" data-default-name="<%= defaultNewChildName %>"
title="<%= interpolate(
<p><%- gettext("You haven't added any content to this course yet.") %>
<a href="#" class="button button-new" data-category="<%- childCategory %>"
data-parent="<%- xblockInfo.get('id') %>" data-default-name="<%- defaultNewChildName %>"
title="<%- interpolate(
gettext('Click to add a new %(xblock_type)s'), { xblock_type: defaultNewChildName }, true
) %>"
>
<span class="icon fa fa-plus" aria-hidden="true"></span><%= addChildLabel %>
<span class="icon fa fa-plus" aria-hidden="true"></span><%- addChildLabel %>
</a>
</p>
</div>
<% } else { %>
<ol class="sortable-list sortable-<%= xblockType %>-list">
<ol class="sortable-list sortable-<%- xblockType %>-list">
</ol>
<% if (childType) { %>
<div class="add-xblock-component">
<a href="#" class="button button-new" data-category="<%= childCategory %>"
data-parent="<%= xblockInfo.get('id') %>" data-default-name="<%= defaultNewChildName %>"
title="<%= interpolate(
<a href="#" class="button button-new" data-category="<%- childCategory %>"
data-parent="<%- xblockInfo.get('id') %>" data-default-name="<%- defaultNewChildName %>"
title="<%- interpolate(
gettext('Click to add a new %(xblock_type)s'), { xblock_type: defaultNewChildName }, true
) %>"
>
<span class="icon fa fa-plus" aria-hidden="true"></span><%= addChildLabel %>
<span class="icon fa fa-plus" aria-hidden="true"></span><%- addChildLabel %>
</a>
</div>
<% } %>
......
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment