Skip to content

Commit

Permalink
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #192 from edx/security-fix/fix-xss-edit-member
Browse files Browse the repository at this point in the history
Fix xss in edit member template
uzairr authored Jul 30, 2020

Verified

This commit was signed with the committer’s verified signature. The key has expired.
romainthomas Romain Thomas
2 parents 00f4ea3 + 6b8f903 commit 32fae72
Showing 1 changed file with 7 additions and 7 deletions.
Original file line number Diff line number Diff line change
@@ -1,16 +1,16 @@
<li class="team-member">
<a class="member-profile" href="<%= memberProfileUrl %>">
<img class="image-url" src="<%= imageUrl %>" alt="<%= username %>'s profile page" />
<a class="member-profile" href="<%= memberProfileUrl /* xss-lint: disable=underscore-not-escaped */%>">
<img class="image-url" src="<%= imageUrl /* xss-lint: disable=underscore-not-escaped */%>" alt="<%= username /* xss-lint: disable=underscore-not-escaped */%>'s profile page" />
</a>
<div class="member-info-container">
<span class="primary"><%= username %></span>
<span class="primary"><%= username /* xss-lint: disable=underscore-not-escaped */%></span>
<div class="secondary">
<span id="date-joined"><%= dateJoined %></span>
<span id="date-joined"><%= dateJoined /* xss-lint: disable=underscore-not-escaped */%></span>
<span> | </span>
<span id="last-active"><%= lastActive %></span>
<span id="last-active"><%= lastActive /* xss-lint: disable=underscore-not-escaped */%></span>
</div>
</div>
<button class="action-remove-member" data-username="<%= username %>">
<%- gettext("Remove") %><span class="sr">&nbsp;<%= username %></span>
<button class="action-remove-member" data-username="<%= username /* xss-lint: disable=underscore-not-escaped */%>">
<%- gettext("Remove") %><span class="sr">&nbsp;<%= username /* xss-lint: disable=underscore-not-escaped */%></span>
</button>
</li>

0 comments on commit 32fae72

Please sign in to comment.