[FIX] mail: sent messages are plaintext

The problem was that users couldn't write characters like <, > in their
messages because the messages are html (e.g. '3 < 5' resulted in '3' because
this wasn't html valid so the second part was trimmed).

Because of mentions, we can't force messages to be plaintext (mentions are
processed and replaced by html links before the message is stored in DB).

The solution is to escape them just before processing the mentions. In the case
of chat windows, we must be careful because chat windows are also used for the
livechat, for which messages are plaintext. So the escaping should be done for
chat windows in the backend, but not in the livechat.

1 files changed, 1 insertions, 0 deletions

diff --git a/addons/mail/static/src/js/window_manager.js b/addons/mail/static/src/js/window_manager.js
index fe60dff4bd5..f217d929c20 100644
--- a/addons/mail/static/src/js/window_manager.js
+++ b/addons/mail/static/src/js/window_manager.js
@@ -38,6 +38,7 @@ function open_chat (session) {
         });
 
         chat_session.window.on("post_message", null, function (message, channel_id) {
+            message.content = _.escape(message.content);
             chat_manager.post_message(message, {channel_id: channel_id});
         });
         chat_session.window.on("messages_read", null, function () {