[MERGE] foward port of 10.0 up to revision 84a650e33aadb29661121410813e3de37a5ad3e9

1 files changed, 1 insertions, 26 deletions

diff --git a/addons/mail/models/mail_shortcode.py b/addons/mail/models/mail_shortcode.py
index 36624bc0b2b..780a5a746c8 100644
--- a/addons/mail/models/mail_shortcode.py
+++ b/addons/mail/models/mail_shortcode.py
@@ -1,10 +1,7 @@
 # -*- coding: utf-8 -*-
 # Part of Odoo. See LICENSE file for full copyright and licensing details.
 
-import cgi
-import re
-
-from odoo import api, fields, models
+from odoo import fields, models
 
 
 class MailShortcode(models.Model):
@@ -23,25 +20,3 @@ class MailShortcode(models.Model):
     shortcode_type = fields.Selection([('image', 'Smiley'), ('text', 'Canned Response')], required=True, default='text',
         help="* Smiley are only used for HTML code to display an image "\
              "* Text (default value) is used to substitute text with another text")
-
-    @api.model
-    def create(self, values):
-        if values.get('substitution'):
-            values['substitution'] = self._sanitize_shorcode(values['substitution'])
-        return super(MailShortcode, self).create(values)
-
-    @api.multi
-    def write(self, values):
-        if values.get('substitution'):
-            values['substitution'] = self._sanitize_shorcode(values['substitution'])
-        return super(MailShortcode, self).write(values)
-
-    def _sanitize_shorcode(self, substitution):
-        """ Sanitize the shortcode substitution :
-                - HTML substitution : only allow the img tag (emoji)
-                - escape other substitutions to avoid XSS
-        """
-        is_img_tag = re.match(r'''^<img\s+src=('|")([^'"]*)\1\s*/?>$''', substitution, re.M | re.I)
-        if is_img_tag:
-            return substitution
-        return cgi.escape(substitution)