diff options
| author | Alexandre Kühn <aku@odoo.com> | 2018-07-13 17:42:49 +0200 |
|---|---|---|
| committer | Alexandre Kühn <aku@odoo.com> | 2018-07-19 14:01:58 +0200 |
| commit | 4bcfcb9aa4c666e5bc133c25f9d881f335bdf1b8 (patch) | |
| tree | bd66071c44eceefc012b2089d630d19bb757aa05 /addons/mail/static/src | |
| parent | 04c98eeb4810652aac248720184ae7cdfb6dda2a (diff) | |
[FIX] mail: unescape channel name in discuss sidebar
When the user creates a channel by providing a name, the name is escaped
in order to avoid XSS attacks. As a result, the logic make use of escaped
string, which may be different from the provided string by the user.
As a result, if we do not unescape the string when necessary, the user may
see the escaped version. For instance, if we creates a channel named 'R&D',
it may display 'R&D' to the user.
This commit plays safe by still keeping the handling of channel names in
their escaped form, but unescape it just before displaying it on the sidebar
of the Discuss app to the user.
Diffstat (limited to 'addons/mail/static/src')
| -rw-r--r-- | addons/mail/static/src/js/models/threads/abstract_thread.js | 3 | ||||
| -rw-r--r-- | addons/mail/static/src/xml/discuss.xml | 2 |
2 files changed, 3 insertions, 2 deletions
diff --git a/addons/mail/static/src/js/models/threads/abstract_thread.js b/addons/mail/static/src/js/models/threads/abstract_thread.js index fb31c5156c6..67929517ed4 100644 --- a/addons/mail/static/src/js/models/threads/abstract_thread.js +++ b/addons/mail/static/src/js/models/threads/abstract_thread.js @@ -51,7 +51,8 @@ var AbstractThread = Class.extend({ */ getMessages: function () {}, /** - * Get the name of this thread + * Get the name of this thread. If the name of the thread has been created + * by the user from an input, it may be escaped. * * @returns {string} */ diff --git a/addons/mail/static/src/xml/discuss.xml b/addons/mail/static/src/xml/discuss.xml index ab2e7255ba5..c56aa3dda8d 100644 --- a/addons/mail/static/src/xml/discuss.xml +++ b/addons/mail/static/src/xml/discuss.xml @@ -143,7 +143,7 @@ </t> </span> <span t-if="displayHash" class="o_mail_hash">#</span> - <t t-esc="thread.getName()"/> + <t t-esc="_.unescape(thread.getName())"/> <i t-if="thread.isMassMailing()" class="fa fa-envelope-o" title="Sends messages by email" role="img" aria-label="Send by mail"/> </span> <span t-attf-class="fa fa-cog o_mail_channel_settings" |