[safe templates] Commerce templates.

lms/static/js/commerce/views/receipt_view.js

@@ -39,7 +39,7 @@ var edx = edx || {};
                 courseKey: this.courseKey
             });
 
-            this.$el.html(_.template(templateHtml)(context));
+            edx.HtmlUtils.setHtml(this.$el, edx.HtmlUtils.template(templateHtml)(context));
 
             this.trackLinks();
 
@@ -67,7 +67,8 @@ var edx = edx || {};
             context.course_key = this.courseKey;
             context.username = this.username;
             context.platformName = this.$el.data('platform-name');
-            providerDiv.html(_.template(templateHtml)(context)).removeClass('hidden');
+            context.fulfillment_instructions = edx.HtmlUtils.HTML(context.fulfillment_instructions);
+            edx.HtmlUtils.setHtml(providerDiv, edx.HtmlUtils.template(templateHtml)(context)).removeClass('hidden');
         },
 
         renderError: function () {

lms/templates/commerce/checkout_cancel.html

-<%! from django.utils.translation import ugettext as _ %>
+<%page expression_filter="h"/>
+<%!
+from django.utils.translation import ugettext as _
+
+from openedx.core.djangolib.markup import HTML, Text
+%>
 
 <%inherit file="../main.html" />
 
@@ -7,6 +12,9 @@
 
 <section class="container">
     <h1>${_("Checkout Cancelled")}</h1>
-    ${ _(u"Your transaction has been cancelled. If you feel an error has occurred, contact {email}.").format(
-    email="<a href=\"mailto:{email}\">{email}</a>".format(email=payment_support_email)) }
+    ${
+        Text(_(u"Your transaction has been cancelled. If you feel an error has occurred, contact {email}.")).format(
+            email=HTML("<a href=\"mailto:{email}\">{email}</a>").format(email=payment_support_email)
+        )
+    }
 </section>

lms/templates/commerce/checkout_error.html

-<%! from django.utils.translation import ugettext as _ %>
+<%page expression_filter="h"/>
+<%!
+from django.utils.translation import ugettext as _
+
+from openedx.core.djangolib.markup import HTML, Text
+%>
 
 <%inherit file="../main.html" />
 
@@ -6,7 +11,13 @@
 
 
 <section class="container">
-    <h1>${_("Checkout Error")}</h1>
-    ${ _(u"An error has occurred with your payment. <b>You have not been charged.</b> Please try to submit your payment again. If this problem persists, contact {email}.").format(
-    email="<a href=\"mailto:{email}\">{email}</a>".format(email=payment_support_email)) }
+  <h1>${_("Checkout Error")}</h1>
+  ## Translators: bold_end and bold_start are HTML tags to create bold text.
+  ${
+      Text(_(u"An error has occurred with your payment. {bold_start}You have not been charged.{bold_end} Please try to submit your payment again. If this problem persists, contact {email}.")).format(
+          email=HTML("<a href=\"mailto:{email}\">{email}</a>").format(email=payment_support_email),
+          bold_start=HTML('<b>'),
+          bold_end=HTML('</b>')
+      ) 
+   }
 </section>

lms/templates/commerce/checkout_receipt.html

+<%page expression_filter="h"/>
 <%!
 from django.utils.translation import ugettext as _
 %>

lms/templates/commerce/provider.underscore

 <div class="provider-wrapper">
   <div class="provider-info">
-    <%= interpolate(
-          gettext("You still need to visit the %(display_name)s website to complete the credit process."),
-          { display_name: display_name }, true
+    <%- StringUtils.interpolate(
+          gettext("You still need to visit the {display_name} website to complete the credit process."),
+          { display_name: display_name }
         ) %>
   </div>
   <div class="provider-more-info">
-    <%= interpolate(
-          gettext("To finalize course credit, %(display_name)s requires %(platform_name)s learners to submit a credit request."),
-          { display_name: display_name, platform_name: platformName }, true
+    <%- StringUtils.interpolate(
+          gettext("To finalize course credit, {display_name} requires {platform_name} learners to submit a credit request."),
+          { display_name: display_name, platform_name: platformName }
         ) %>
   </div>
   <div class="provider-instructions">
-    <%= fulfillment_instructions %>
+    <%- edx.HtmlUtils.ensureHtml(fulfillment_instructions) %>
   </div>
 </div>
 
 <div class="provider-buttons-logos">
   <div class="provider-logo">
-    <%= interpolate("<img src='%s' alt='%s'></image>", [thumbnail_url, display_name]) %>
+    <img src="<%- thumbnail_url %>" alt="<%- display_name %>" />
   </div>
   <div class="complete-order">
-    <%= interpolate('<button data-provider="%s" data-course-key="%s" data-username="%s" class="complete-course" onClick=completeOrder(this)>%s</button>', [id, course_key, username,
-        gettext( "Get Credit")]) %>
+    <button data-provider="<%- id %>" data-course-key="<%- course_key %>" data-username="<%- username %>" class="complete-course" onClick=completeOrder(this)><%- gettext("Get Credit") %></button>
   </div>
 </div>