[IMP] bus: unescape notification message

The title of notification is the author name escaped (for security
reasons).

   if (message.hasAuthor()) {
       title = _.escape(message.getAuthorName());
   }

When forwarded to the system notification, it does not need to be
escaped though, as the system notification is not HTML based.

Without this patch, a user named "Bob's friend" sending a message was
creating a notification with the title "Bob's friend"

Unescaping the notification body just in case but the HTML of the body
in a mail.messages should be stripped by _notifyIncomingMessage.
Unescaping will just ignored unescaped characters and should do
nothing on messages not escaped.

Fixes odoo/odoo#24846

closes odoo/odoo#44550

Signed-off-by: Martin Trigaux (mat) <mat@odoo.com>

0 files changed, 0 insertions, 0 deletions