diff options
| author | Xavier Morel <xmo@odoo.com> | 2017-05-12 17:14:52 +0200 |
|---|---|---|
| committer | Xavier Morel <xmo@odoo.com> | 2017-05-15 12:26:31 +0200 |
| commit | e2f1af78c465916551f12419f37d4e63a6cfd7f2 (patch) | |
| tree | 64b5e6a05831bb5db4e32d241d90eedc2bedda7e /addons/base_import/controllers | |
| parent | 5617d4614b4644f0eaf2feb402f0066f260200c8 (diff) | |
[FIX] P3: remove cgi.escape uses
cgi.escape is unsafe (quote=False by default) and deprecated in Python
3. We already have an openerp.tools.misc.html_escape version which
forwards to the (modern and safe) werkzeug.utils.escape, just use that
everywhere, and convert extant uses of werkzeug.utils.escape to
utils.html_escape as well so that we do the same thing everywhere.
Diffstat (limited to 'addons/base_import/controllers')
| -rw-r--r-- | addons/base_import/controllers/main.py | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/addons/base_import/controllers/main.py b/addons/base_import/controllers/main.py index 23febc086e0..7eff0aa420d 100644 --- a/addons/base_import/controllers/main.py +++ b/addons/base_import/controllers/main.py @@ -1,11 +1,11 @@ # -*- coding: utf-8 -*- # Part of Odoo. See LICENSE file for full copyright and licensing details. -import cgi import json from odoo import http from odoo.http import request +from odoo.tools import misc class ImportController(http.Controller): @@ -20,4 +20,4 @@ class ImportController(http.Controller): 'file_type': file.content_type, }) - return 'window.top.%s(%s)' % (cgi.escape(jsonp), json.dumps({'result': written})) + return 'window.top.%s(%s)' % (misc.html_escape(jsonp), json.dumps({'result': written})) |