diff options
| author | std-odoo <std@odoo.com> | 2020-04-14 12:27:23 +0000 |
|---|---|---|
| committer | std-odoo <std@odoo.com> | 2020-05-04 07:47:47 +0000 |
| commit | 2a2e5c7b1e155abc7714708b1183191395ff48b1 (patch) | |
| tree | b5e27dbd995ee289dac7ef509cf9566c1828ff3d /addons/web/static/lib/jquery.mjs.nestedSortable/jquery.mjs.nestedSortable.js | |
| parent | ac3cb21836ff9abb3d6a5630287042fb935ab86a (diff) | |
[FIX] website_crm_partner_assign: escape interested partner comment
In portal an user can say he is interested by a lead and take it. He can also
post a comment. However this comment was not escaped, leading to possible
html injection.
As this comment is used to post a message no real issue occurs. It is sanitized
and behaves like every html content used in message_post. However we do not
want to support html here and therefore escape the content given to message
post.
Task ID 2228921
closes odoo/odoo#50537
X-original-commit: df5345618c4abbe8766a012b08ed90f1706c919a
Signed-off-by: Thibault Delavallee (tde) <tde@openerp.com>
Diffstat (limited to 'addons/web/static/lib/jquery.mjs.nestedSortable/jquery.mjs.nestedSortable.js')
0 files changed, 0 insertions, 0 deletions