Skip to content

E
edx-platform
Commit 0a8f6fa3 by Robert Raposa Committed by Eric Fischer
Options

Properly escape the name

parent 15ef27fe
Showing with 2 additions and 2 deletions
lms/templates/instructor/instructor_dashboard_2/metrics.html
...@@ -91,7 +91,7 @@ from django.template.defaultfilters import escapejs ...@@ -91,7 +91,7 @@ from django.template.defaultfilters import escapejs
$('.metrics-overlay-content thead', metrics_overlay).append(overlay_content); $('.metrics-overlay-content thead', metrics_overlay).append(overlay_content);
$.each(response.results, function(index, value ){ $.each(response.results, function(index, value ){
overlay_content = '<tr><td>' + value['name'] + "</td><td>" + value['username'] + '</td></tr>'; overlay_content = '<tr><td>' + _.escape(value['name']) + "</td><td>" + _.escape(value['username']) + '</td></tr>';
$('.metrics-overlay-content tbody', metrics_overlay).append(overlay_content); $('.metrics-overlay-content tbody', metrics_overlay).append(overlay_content);
}); });
// If student list too long, append message to screen. // If student list too long, append message to screen.
...@@ -131,7 +131,7 @@ from django.template.defaultfilters import escapejs ...@@ -131,7 +131,7 @@ from django.template.defaultfilters import escapejs
$('.metrics-overlay-content thead', metrics_overlay).append(overlay_content); $('.metrics-overlay-content thead', metrics_overlay).append(overlay_content);
$.each(response.results, function(index, value ){ $.each(response.results, function(index, value ){
overlay_content = '<tr><td>' + value['name'] + "</td><td>" + value['username'] + "</td><td>" + value['grade'] + "</td><td>" + value['percent'] + '</td></tr>'; overlay_content = '<tr><td>' + _.escape(value['name']) + "</td><td>" + _.escape(value['username']) + "</td><td>" + _.escape(value['grade']) + "</td><td>" + _.escape(value['percent']) + '</td></tr>';
$('.metrics-overlay-content tbody', metrics_overlay).append(overlay_content); $('.metrics-overlay-content tbody', metrics_overlay).append(overlay_content);
}); });
// If student list too long, append message to screen. // If student list too long, append message to screen.
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment