html escape errors

lms/templates/courseware/courseware.html

@@ -54,8 +54,8 @@
           <div id="course-errors">
             <ul>
           % for (msg, err) in course_errors:
-            <li>${msg}
-              <ul><li><pre>${err}</pre></li></ul>
+            <li>${msg | h}
+              <ul><li><pre>${err | h}</pre></li></ul>
             </li>
           % endfor
             </ul>