Merge pull request #3723 from overleaf/as-fix-team-invite-xss

Prevent stored XSS on team invite page

GitOrigin-RevId: 0f79b96efcb86d121654a95da52da1c40550d3ae

services/web/app/views/subscriptions/team/invite.pug

@@ -18,7 +18,7 @@ block content
 				.col-md-8.col-md-offset-2.text-center(ng-cloak)
 					.card(ng-controller="TeamInviteController")
 						.page-header
-							h1.text-centered #{translate("invited_to_group", {inviterName: inviterName, appName: appName})}
+							h1.text-centered(ng-non-bindable) #{translate("invited_to_group", {inviterName: inviterName, appName: appName})}
 
 						div(ng-show="view =='hasIndividualRecurlySubscription'")
 							p #{translate("cancel_personal_subscription_first")}
@@ -36,6 +36,6 @@ block content
 								a.btn.btn.btn-primary(ng-click="joinTeam()", ng-disabled="inflight") #{translate("accept_invitation")} 
 
 						div(ng-show="view =='inviteAccepted'")
-							p #{translate("joined_team", {inviterName: inviterName})}
+							p(ng-non-bindable) #{translate("joined_team", {inviterName: inviterName})}
 							p
 								a.btn.btn.btn-primary(href="/project") #{translate("done")}