diff options
| author | Aaron Bohy <aab@odoo.com> | 2017-05-17 11:13:58 +0200 |
|---|---|---|
| committer | Aaron Bohy <aab@odoo.com> | 2017-05-17 12:36:09 +0200 |
| commit | 59584283c52f06a478e61e93b1d0f69a750a1768 (patch) | |
| tree | f92f72bb1f2758ec8ef44ce993f2f606e8d70790 /addons/web/static/src/js/fields/relational_fields.js | |
| parent | 0f9e986c468702ebe55860895ef8d8b84c90a48c (diff) | |
[FIX] web: properly escape field values when necessary
This rev. removes some html injections issues:
- in char and text field widgets
- in phone field widget in mobile
- in list views (when no widget is instantiated)
Diffstat (limited to 'addons/web/static/src/js/fields/relational_fields.js')
| -rw-r--r-- | addons/web/static/src/js/fields/relational_fields.js | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/addons/web/static/src/js/fields/relational_fields.js b/addons/web/static/src/js/fields/relational_fields.js index 10d72a1398d..d65532165e8 100644 --- a/addons/web/static/src/js/fields/relational_fields.js +++ b/addons/web/static/src/js/fields/relational_fields.js @@ -1710,7 +1710,7 @@ var FieldSelection = AbstractField.extend({ * @private */ _renderReadonly: function () { - this.$el.empty().html(this._formatValue(this.value)); + this.$el.empty().text(this._formatValue(this.value)); }, //-------------------------------------------------------------------------- |