From 115fe2018475f51e962d183e7175519064d8b10e Mon Sep 17 00:00:00 2001
From: Jakob Ackermann <jakob.ackermann@overleaf.com>
Date: Wed, 17 Mar 2021 12:46:33 +0100
Subject: [PATCH] Merge pull request #3766 from overleaf/jpa-xss-8

[views] mitigate Angular XSS in affiliations section of user settings

GitOrigin-RevId: bad444cea136c51f54546770653f21cec6fa70e3
---
 services/web/app/views/user/settings/user-affiliations.pug | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/services/web/app/views/user/settings/user-affiliations.pug b/services/web/app/views/user/settings/user-affiliations.pug
index 7fbbacf8de..5be7eaf7b0 100644
--- a/services/web/app/views/user/settings/user-affiliations.pug
+++ b/services/web/app/views/user/settings/user-affiliations.pug
@@ -269,7 +269,7 @@ form.row(
 								aria-label=translate("close")
 							)
 								span(aria-hidden="true") &times;
-							.small !{translate("institution_acct_successfully_linked", {institutionName: institutionLinked.universityName})}
+							.small(ng-non-bindable) !{translate("institution_acct_successfully_linked", {institutionName: institutionLinked.universityName})}
 							if institutionLinked.hasEntitlement
 								.small !{translate("this_grants_access_to_features", {featureType: translate("professional")})}
 					if institutionEmailNonCanonical
@@ -302,9 +302,9 @@ form.row(
 								| &nbsp;#{translate("generic_something_went_wrong")}.
 								br
 								if samlError.translatedMessage
-									| !{samlError.translatedMessage}
+									span(ng-non-bindable) !{samlError.translatedMessage}
 								else if samlError.message
-									| #{samlError.message}
+									span(ng-non-bindable) #{samlError.message}
 								if samlError.tryAgain
 									br
 									| &nbsp;#{translate("try_again")}.