Fix the invalid set "You must use your LMS to access this set" message. #2640
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This was broken in #2485. In that pull request line 16 of
templates/ContentGenerator/ProblemSet.html.ep
was changed from<p class="mb-0"><%== $c->{invalidSet} %></p>
to<p class="mb-0"><%= $c->{invalidSet} %></p>
which means that the invalid set message is now HTML escaped. That was necessary as almost allinvalidSet
messages include the set ID taken directly from the URL, and that is a cross-site scripting vulnerability. However, there is one message that does not use the set id from the URL, but does add HTML that needs to not be escaped. That is the message,You must use your Learning Management System ([_1]) to access this set. Try logging in to the Learning Management System and visiting the set from there.
where the[_1]
may be the LMS URL. That now displays asYou must use your Learning Management System (<a href="https://myschool.edu/lms/">the LMS</a>) to access this set. Try logging in to the Learning Management System and visiting the set from there.
<%=
can certainly not be changed back to<%==
because of the cross-site scripting vulnerability issue. However, there is another way to prevent HTML escaping. That is by using aMojo::Bytestream
object. So this message which is the only one that needs to not be HTML escaped (and is safe to do this with) is set in that way via theb
method of aMojolicious::Controller
.