diff options
| author | Martin Trigaux <mat@openerp.com> | 2014-02-04 12:33:58 +0100 |
|---|---|---|
| committer | Martin Trigaux <mat@openerp.com> | 2014-02-04 12:33:58 +0100 |
| commit | 57b3abdbd6162a6bd5066f10c198c9b86e4dcf4e (patch) | |
| tree | a79425c91a98cab106341d14faa4cabb1edbdaa1 /addons/mail/static/src | |
| parent | 2bebb9cd4d6e5163767f2fdd81bf633423c92c07 (diff) | |
[FIX] mail: escape user and partner names before being rendered in mail widgets
lp bug: https://launchpad.net/bugs/1276078 fixed
bzr revid: mat@openerp.com-20140204113358-2cb39l7ge2f5pcg5
Diffstat (limited to 'addons/mail/static/src')
| -rw-r--r-- | addons/mail/static/src/xml/mail.xml | 12 |
1 files changed, 6 insertions, 6 deletions
diff --git a/addons/mail/static/src/xml/mail.xml b/addons/mail/static/src/xml/mail.xml index f5004941a8d..752806e0ddd 100644 --- a/addons/mail/static/src/xml/mail.xml +++ b/addons/mail/static/src/xml/mail.xml @@ -249,9 +249,9 @@ <div class="oe_msg_content"> <h1 t-if="(widget.show_record_name or widget.subject) and !widget.thread_level" class="oe_msg_title"> <a t-if="widget.options.show_link and widget.show_record_name" class="oe_mail_action_model" t-attf-href="#model=#{widget.model}&id=#{widget.res_id}"> - <t t-raw="widget.record_name"/> + <t t-esc="widget.record_name"/> </a> - <span t-if="!widget.options.show_link and widget.show_record_name"><t t-raw="widget.record_name"/></span> + <span t-if="!widget.options.show_link and widget.show_record_name"><t t-esc="widget.record_name"/></span> <t t-if="widget.show_record_name and widget.subject">: </t> <t t-if="widget.subject" t-raw="widget.subject"/> </h1> @@ -263,8 +263,8 @@ <t t-if="widget.attachment_ids.length > 0"> <div class="oe_msg_attachment_list"></div> </t> - <a t-if="widget.author_id and widget.options.show_link and widget.author_id[0]" t-attf-href="#model=res.partner&id=#{widget.author_id[0]}"><t t-raw="widget.author_id[2]"/></a> - <span t-if="widget.author_id and (!widget.options.show_link or !widget.author_id[0])"><t t-raw="widget.author_id[2]"/></span> + <a t-if="widget.author_id and widget.options.show_link and widget.author_id[0]" t-attf-href="#model=res.partner&id=#{widget.author_id[0]}"><t t-esc="widget.author_id[2]"/></a> + <span t-if="widget.author_id and (!widget.options.show_link or !widget.author_id[0])"><t t-esc="widget.author_id[2]"/></span> <t t-if="widget.type == 'notification'"> updated document <t t-if="widget.partner_ids.length > 0"> @@ -283,8 +283,8 @@ <t t-if="widget.type == 'notification' or ( (widget.type == 'email' or widget.type == 'comment') and widget.subtype)" t-foreach="widget.partner_ids.slice(0, 3)" t-as="partner"> <span t-attf-class="oe_partner_follower"> - <a t-if="widget.options.show_link" t-attf-href="#model=res.partner&id=#{partner[0]}"><t t-raw="partner[1]"/></a> - <t t-if="!widget.options.show_link" t-raw="partner[1]"/> + <a t-if="widget.options.show_link" t-attf-href="#model=res.partner&id=#{partner[0]}"><t t-esc="partner[1]"/></a> + <t t-if="!widget.options.show_link" t-esc="partner[1]"/> </span> <t t-if="!partner_last">,</t> </t> |