{"action":"closed","number":11697,"pull_request":{"url":"https://api.github.com/repos/edx/edx-platform/pulls/11697","id":61148722,"html_url":"https://github.com/edx/edx-platform/pull/11697","diff_url":"https://github.com/edx/edx-platform/pull/11697.diff","patch_url":"https://github.com/edx/edx-platform/pull/11697.patch","issue_url":"https://api.github.com/repos/edx/edx-platform/issues/11697","number":11697,"state":"closed","locked":false,"title":"TNL-3429: implement display_name_with_default for studio text sanitation","user":{"login":"Kelketek","id":1099483,"avatar_url":"https://avatars.githubusercontent.com/u/1099483?v=3","gravatar_id":"","url":"https://api.github.com/users/Kelketek","html_url":"https://github.com/Kelketek","followers_url":"https://api.github.com/users/Kelketek/followers","following_url":"https://api.github.com/users/Kelketek/following{/other_user}","gists_url":"https://api.github.com/users/Kelketek/gists{/gist_id}","starred_url":"https://api.github.com/users/Kelketek/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Kelketek/subscriptions","organizations_url":"https://api.github.com/users/Kelketek/orgs","repos_url":"https://api.github.com/users/Kelketek/repos","events_url":"https://api.github.com/users/Kelketek/events{/privacy}","received_events_url":"https://api.github.com/users/Kelketek/received_events","type":"User","site_admin":false},"body":"**JIRA tickets**: [TNL-3429](https://openedx.atlassian.net/browse/TNL-3429)\r\n\r\n**Discussion**: \r\nThis PR replaces https://github.com/edx/edx-platform/pull/11588.  It builds on work done by @robrap in https://github.com/edx/edx-platform/pull/10962, for [TNL-3425](https://openedx.atlassian.net/browse/TNL-3425).\r\n\r\nThese changes aim to follow https://openedx.atlassian.net/wiki/display/TNL/XSS+Protection .\r\n\r\nThe change to cms/templates/container.html replaces calls to display_name_with_default_escaped, which is deprecated and does not properly perform HTML-escaping, with display_name_with_default, which makes use of the |h filter for escaping.\r\n\r\nThe changes to these three files selectively apply escaping, using either the deprecated display_name_with_default_escaped or the preferred display_name_with_default, depending on the context, so that only the course outline and unit pages get the non-escaped data:\r\n* cms/djangoapps/contentstore/views/component.py\r\n* cms/djangoapps/contentstore/views/course.py\r\n* cms/djangoapps/contentstore/views/item.py\r\n\r\nThese two templates are changed to HTML-escape the display name fields:\r\n* cms/templates/js/course-outline.underscore\r\n* cms/templates/js/unit-outline.underscore\r\n\r\n**Dependencies**: None\r\n\r\n**Sandbox**: [LMS](http://pr11697.sandbox.opencraft.com/) [Studio](http://studio.pr11697.sandbox.opencraft.com/)\r\n\r\n**Testing instructions**:\r\n_Note: in the screenshots, the fields of interest are highlighted in purple._\r\n\r\n1. Start up Studio as the edxapp user: \"paver devstack studio\".\r\n2. Open a browser to Studio: http://127.0.0.1:8001. The home page loads.\r\n3. Click the \"Sign in\" button. The sign in page loads.\r\n4. Sign in as as the \"staff@example.com\" user.\r\n5. Click on \"edX Demonstration Course\". This opens the course outline page.\r\n6. Scroll to the bottom of the page.\r\n7. Click \"New Section\" and create a section named ``§: Intro to <HTML> & \"JS\"``\r\n8. Click \"New Subsection\" and create a subsection named ``§§: Intro to <HTML> & \"JS\"``. Both names are rendered correctly on the course outline page.\r\n![outline-page-loaded-before](https://cloud.githubusercontent.com/assets/6389399/13157632/ab99d284-d691-11e5-99b4-acfdece15435.png)\r\n9. If necessary, click on the triangle alongside the subsection name to expand the field.\r\n10. Click \"New Unit\". The unit page loads.\r\n11. Without the fix, this reproduces bug TNL-3429:\r\n![unit-page-loaded-before](https://cloud.githubusercontent.com/assets/6389399/13157716/2a946c66-d692-11e5-9b56-0f3df0e138de.png)\r\n12. With the fix, the text is rendered correctly:\r\n![unit-page-loaded-after](https://cloud.githubusercontent.com/assets/6389399/13157725/33bec066-d692-11e5-8a60-4904a0d679c1.png)\r\n13. Return to the course outline page.  Click to edit the section name.  Without the fix, the text is rendered in the text-field incorrectly (the < and > characters are HTML-escaped, but not the & and \" characters, which appear as expected; the partial escaping is obvious with this particular test-data):\r\n![outline-page-edited-before](https://cloud.githubusercontent.com/assets/6389399/13157651/c20af1c4-d691-11e5-946f-7d8544e7a9e9.png)\r\n\r\nWith these changes, the text is rendered as correctly:\r\n![outline-page-edit-after](https://cloud.githubusercontent.com/assets/6389399/13157874/e6b7e4d6-d692-11e5-8012-884157d17550.png)\r\n\r\nThis editing bug occurs on the unit page too, and is also fixed by this change.  I am not aware of any JIRA ticket tracking this issue.\r\n\r\n**Author notes and concerns**:\r\nThis PR changes the  way that display_name text is sent via JSON. Previously, the < and > characters would be escaped to ``&lt;`` and ``&gt;``. No other HTML-sensitive characters were handled.  Now, these characters are sent as-is.  For the course outline page and the unit page, the escaping to HTML is performed on the browser by the underscore templates (properly, not just for angle-brackets).\r\n\r\n**Reviewers**\r\n- [ ] @smarnach, TBD\r\n","created_at":"2016-02-29T21:32:25Z","updated_at":"2016-03-04T23:54:12Z","closed_at":"2016-03-04T23:54:11Z","merged_at":"2016-03-04T23:54:11Z","merge_commit_sha":"d8ca0df9a18c8f9c2dd72dcda39e94539f51e20c","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/edx/edx-platform/pulls/11697/commits","review_comments_url":"https://api.github.com/repos/edx/edx-platform/pulls/11697/comments","review_comment_url":"https://api.github.com/repos/edx/edx-platform/pulls/comments{/number}","comments_url":"https://api.github.com/repos/edx/edx-platform/issues/11697/comments","statuses_url":"https://api.github.com/repos/edx/edx-platform/statuses/f1c1c7c1466fcc2bd3c5d4c5e1d0c42518811ade","head":{"label":"open-craft:agaylard/TNL-3429-D","ref":"agaylard/TNL-3429-D","sha":"f1c1c7c1466fcc2bd3c5d4c5e1d0c42518811ade","user":{"login":"open-craft","id":7414786,"avatar_url":"https://avatars.githubusercontent.com/u/7414786?v=3","gravatar_id":"","url":"https://api.github.com/users/open-craft","html_url":"https://github.com/open-craft","followers_url":"https://api.github.com/users/open-craft/followers","following_url":"https://api.github.com/users/open-craft/following{/other_user}","gists_url":"https://api.github.com/users/open-craft/gists{/gist_id}","starred_url":"https://api.github.com/users/open-craft/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/open-craft/subscriptions","organizations_url":"https://api.github.com/users/open-craft/orgs","repos_url":"https://api.github.com/users/open-craft/repos","events_url":"https://api.github.com/users/open-craft/events{/privacy}","received_events_url":"https://api.github.com/users/open-craft/received_events","type":"Organization","site_admin":false},"repo":{"id":19940883,"name":"edx-platform","full_name":"open-craft/edx-platform","owner":{"login":"open-craft","id":7414786,"avatar_url":"https://avatars.githubusercontent.com/u/7414786?v=3","gravatar_id":"","url":"https://api.github.com/users/open-craft","html_url":"https://github.com/open-craft","followers_url":"https://api.github.com/users/open-craft/followers","following_url":"https://api.github.com/users/open-craft/following{/other_user}","gists_url":"https://api.github.com/users/open-craft/gists{/gist_id}","starred_url":"https://api.github.com/users/open-craft/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/open-craft/subscriptions","organizations_url":"https://api.github.com/users/open-craft/orgs","repos_url":"https://api.github.com/users/open-craft/repos","events_url":"https://api.github.com/users/open-craft/events{/privacy}","received_events_url":"https://api.github.com/users/open-craft/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/open-craft/edx-platform","description":"the edX learning management system (LMS) and course authoring tool, Studio","fork":true,"url":"https://api.github.com/repos/open-craft/edx-platform","forks_url":"https://api.github.com/repos/open-craft/edx-platform/forks","keys_url":"https://api.github.com/repos/open-craft/edx-platform/keys{/key_id}","collaborators_url":"https://api.github.com/repos/open-craft/edx-platform/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/open-craft/edx-platform/teams","hooks_url":"https://api.github.com/repos/open-craft/edx-platform/hooks","issue_events_url":"https://api.github.com/repos/open-craft/edx-platform/issues/events{/number}","events_url":"https://api.github.com/repos/open-craft/edx-platform/events","assignees_url":"https://api.github.com/repos/open-craft/edx-platform/assignees{/user}","branches_url":"https://api.github.com/repos/open-craft/edx-platform/branches{/branch}","tags_url":"https://api.github.com/repos/open-craft/edx-platform/tags","blobs_url":"https://api.github.com/repos/open-craft/edx-platform/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/open-craft/edx-platform/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/open-craft/edx-platform/git/refs{/sha}","trees_url":"https://api.github.com/repos/open-craft/edx-platform/git/trees{/sha}","statuses_url":"https://api.github.com/repos/open-craft/edx-platform/statuses/{sha}","languages_url":"https://api.github.com/repos/open-craft/edx-platform/languages","stargazers_url":"https://api.github.com/repos/open-craft/edx-platform/stargazers","contributors_url":"https://api.github.com/repos/open-craft/edx-platform/contributors","subscribers_url":"https://api.github.com/repos/open-craft/edx-platform/subscribers","subscription_url":"https://api.github.com/repos/open-craft/edx-platform/subscription","commits_url":"https://api.github.com/repos/open-craft/edx-platform/commits{/sha}","git_commits_url":"https://api.github.com/repos/open-craft/edx-platform/git/commits{/sha}","comments_url":"https://api.github.com/repos/open-craft/edx-platform/comments{/number}","issue_comment_url":"https://api.github.com/repos/open-craft/edx-platform/issues/comments{/number}","contents_url":"https://api.github.com/repos/open-craft/edx-platform/contents/{+path}","compare_url":"https://api.github.com/repos/open-craft/edx-platform/compare/{base}...{head}","merges_url":"https://api.github.com/repos/open-craft/edx-platform/merges","archive_url":"https://api.github.com/repos/open-craft/edx-platform/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/open-craft/edx-platform/downloads","issues_url":"https://api.github.com/repos/open-craft/edx-platform/issues{/number}","pulls_url":"https://api.github.com/repos/open-craft/edx-platform/pulls{/number}","milestones_url":"https://api.github.com/repos/open-craft/edx-platform/milestones{/number}","notifications_url":"https://api.github.com/repos/open-craft/edx-platform/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/open-craft/edx-platform/labels{/name}","releases_url":"https://api.github.com/repos/open-craft/edx-platform/releases{/id}","deployments_url":"https://api.github.com/repos/open-craft/edx-platform/deployments","created_at":"2014-05-19T12:28:25Z","updated_at":"2016-02-04T22:30:58Z","pushed_at":"2016-03-04T21:31:53Z","git_url":"git://github.com/open-craft/edx-platform.git","ssh_url":"git@github.com:open-craft/edx-platform.git","clone_url":"https://github.com/open-craft/edx-platform.git","svn_url":"https://github.com/open-craft/edx-platform","homepage":"http://code.edx.org/","size":563370,"stargazers_count":1,"watchers_count":1,"language":"Python","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":1,"mirror_url":null,"open_issues_count":4,"forks":1,"open_issues":4,"watchers":1,"default_branch":"master"}},"base":{"label":"edx:master","ref":"master","sha":"2b880d2d8362c608f81a6a2ef364c922dfa66991","user":{"login":"edx","id":3179841,"avatar_url":"https://avatars.githubusercontent.com/u/3179841?v=3","gravatar_id":"","url":"https://api.github.com/users/edx","html_url":"https://github.com/edx","followers_url":"https://api.github.com/users/edx/followers","following_url":"https://api.github.com/users/edx/following{/other_user}","gists_url":"https://api.github.com/users/edx/gists{/gist_id}","starred_url":"https://api.github.com/users/edx/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/edx/subscriptions","organizations_url":"https://api.github.com/users/edx/orgs","repos_url":"https://api.github.com/users/edx/repos","events_url":"https://api.github.com/users/edx/events{/privacy}","received_events_url":"https://api.github.com/users/edx/received_events","type":"Organization","site_admin":false},"repo":{"id":10391073,"name":"edx-platform","full_name":"edx/edx-platform","owner":{"login":"edx","id":3179841,"avatar_url":"https://avatars.githubusercontent.com/u/3179841?v=3","gravatar_id":"","url":"https://api.github.com/users/edx","html_url":"https://github.com/edx","followers_url":"https://api.github.com/users/edx/followers","following_url":"https://api.github.com/users/edx/following{/other_user}","gists_url":"https://api.github.com/users/edx/gists{/gist_id}","starred_url":"https://api.github.com/users/edx/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/edx/subscriptions","organizations_url":"https://api.github.com/users/edx/orgs","repos_url":"https://api.github.com/users/edx/repos","events_url":"https://api.github.com/users/edx/events{/privacy}","received_events_url":"https://api.github.com/users/edx/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/edx/edx-platform","description":"The Open edX platform, the software that powers edX!","fork":false,"url":"https://api.github.com/repos/edx/edx-platform","forks_url":"https://api.github.com/repos/edx/edx-platform/forks","keys_url":"https://api.github.com/repos/edx/edx-platform/keys{/key_id}","collaborators_url":"https://api.github.com/repos/edx/edx-platform/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/edx/edx-platform/teams","hooks_url":"https://api.github.com/repos/edx/edx-platform/hooks","issue_events_url":"https://api.github.com/repos/edx/edx-platform/issues/events{/number}","events_url":"https://api.github.com/repos/edx/edx-platform/events","assignees_url":"https://api.github.com/repos/edx/edx-platform/assignees{/user}","branches_url":"https://api.github.com/repos/edx/edx-platform/branches{/branch}","tags_url":"https://api.github.com/repos/edx/edx-platform/tags","blobs_url":"https://api.github.com/repos/edx/edx-platform/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/edx/edx-platform/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/edx/edx-platform/git/refs{/sha}","trees_url":"https://api.github.com/repos/edx/edx-platform/git/trees{/sha}","statuses_url":"https://api.github.com/repos/edx/edx-platform/statuses/{sha}","languages_url":"https://api.github.com/repos/edx/edx-platform/languages","stargazers_url":"https://api.github.com/repos/edx/edx-platform/stargazers","contributors_url":"https://api.github.com/repos/edx/edx-platform/contributors","subscribers_url":"https://api.github.com/repos/edx/edx-platform/subscribers","subscription_url":"https://api.github.com/repos/edx/edx-platform/subscription","commits_url":"https://api.github.com/repos/edx/edx-platform/commits{/sha}","git_commits_url":"https://api.github.com/repos/edx/edx-platform/git/commits{/sha}","comments_url":"https://api.github.com/repos/edx/edx-platform/comments{/number}","issue_comment_url":"https://api.github.com/repos/edx/edx-platform/issues/comments{/number}","contents_url":"https://api.github.com/repos/edx/edx-platform/contents/{+path}","compare_url":"https://api.github.com/repos/edx/edx-platform/compare/{base}...{head}","merges_url":"https://api.github.com/repos/edx/edx-platform/merges","archive_url":"https://api.github.com/repos/edx/edx-platform/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/edx/edx-platform/downloads","issues_url":"https://api.github.com/repos/edx/edx-platform/issues{/number}","pulls_url":"https://api.github.com/repos/edx/edx-platform/pulls{/number}","milestones_url":"https://api.github.com/repos/edx/edx-platform/milestones{/number}","notifications_url":"https://api.github.com/repos/edx/edx-platform/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/edx/edx-platform/labels{/name}","releases_url":"https://api.github.com/repos/edx/edx-platform/releases{/id}","deployments_url":"https://api.github.com/repos/edx/edx-platform/deployments","created_at":"2013-05-30T20:20:38Z","updated_at":"2016-03-04T10:26:19Z","pushed_at":"2016-03-04T23:54:11Z","git_url":"git://github.com/edx/edx-platform.git","ssh_url":"git@github.com:edx/edx-platform.git","clone_url":"https://github.com/edx/edx-platform.git","svn_url":"https://github.com/edx/edx-platform","homepage":"http://open.edx.org/","size":694339,"stargazers_count":2430,"watchers_count":2430,"language":"Python","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":true,"forks_count":1476,"mirror_url":null,"open_issues_count":164,"forks":1476,"open_issues":164,"watchers":2430,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/edx/edx-platform/pulls/11697"},"html":{"href":"https://github.com/edx/edx-platform/pull/11697"},"issue":{"href":"https://api.github.com/repos/edx/edx-platform/issues/11697"},"comments":{"href":"https://api.github.com/repos/edx/edx-platform/issues/11697/comments"},"review_comments":{"href":"https://api.github.com/repos/edx/edx-platform/pulls/11697/comments"},"review_comment":{"href":"https://api.github.com/repos/edx/edx-platform/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/edx/edx-platform/pulls/11697/commits"},"statuses":{"href":"https://api.github.com/repos/edx/edx-platform/statuses/f1c1c7c1466fcc2bd3c5d4c5e1d0c42518811ade"}},"merged":true,"mergeable":null,"mergeable_state":"unknown","merged_by":{"login":"Kelketek","id":1099483,"avatar_url":"https://avatars.githubusercontent.com/u/1099483?v=3","gravatar_id":"","url":"https://api.github.com/users/Kelketek","html_url":"https://github.com/Kelketek","followers_url":"https://api.github.com/users/Kelketek/followers","following_url":"https://api.github.com/users/Kelketek/following{/other_user}","gists_url":"https://api.github.com/users/Kelketek/gists{/gist_id}","starred_url":"https://api.github.com/users/Kelketek/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Kelketek/subscriptions","organizations_url":"https://api.github.com/users/Kelketek/orgs","repos_url":"https://api.github.com/users/Kelketek/repos","events_url":"https://api.github.com/users/Kelketek/events{/privacy}","received_events_url":"https://api.github.com/users/Kelketek/received_events","type":"User","site_admin":false},"comments":11,"review_comments":0,"commits":2,"additions":8,"deletions":8,"changed_files":5}}