diff options
| author | Christophe Simonis <chs@openerp.com> | 2012-11-06 17:41:49 +0100 |
|---|---|---|
| committer | Christophe Simonis <chs@openerp.com> | 2012-11-06 17:41:49 +0100 |
| commit | c09a6600a582f1e032e34215b9c3e14e576af8a0 (patch) | |
| tree | 0ba9e87b51b168132a5bc553febad56a1ae4ebed /addons/web/static/src/js/view_list.js | |
| parent | 595a2b3bb160351bca19c40414ede990f45376ea (diff) | |
| parent | 660443885c68b1e86536bafe7e7b01400f04f1e2 (diff) | |
merge upstream
bzr revid: chs@openerp.com-20121106164149-hgj1250avzf12u68
Diffstat (limited to 'addons/web/static/src/js/view_list.js')
| -rw-r--r-- | addons/web/static/src/js/view_list.js | 8 |
1 files changed, 5 insertions, 3 deletions
diff --git a/addons/web/static/src/js/view_list.js b/addons/web/static/src/js/view_list.js index fd74fd8922b..ab50ae933d9 100644 --- a/addons/web/static/src/js/view_list.js +++ b/addons/web/static/src/js/view_list.js @@ -970,7 +970,7 @@ instance.web.ListView.List = instance.web.Class.extend( /** @lends instance.web. // set) a human-readable version. m2o does not have this issue // because the non-human-readable is just a number, where the // human-readable version is a pair - if (value && (ref_match = /([\w\.]+),(\d+)/.exec(value))) { + if (value && (ref_match = /^([\w\.]+),(\d+)$/.exec(value))) { // reference values are in the shape "$model,$id" (as a // string), we need to split and name_get this pair in order // to get a correctly displayable value in the field @@ -1306,9 +1306,11 @@ instance.web.ListView.Groups = instance.web.Class.extend( /** @lends instance.we process_modifiers: false }); } catch (e) { - group_label = row_data[group_column.id].value; + group_label = _.str.escapeHTML(row_data[group_column.id].value); } - $group_column.text(_.str.sprintf("%s (%d)", + // group_label is html-clean (through format or explicit + // escaping if format failed), can inject straight into HTML + $group_column.html(_.str.sprintf("%s (%d)", group_label, group.length)); if (group.length && group.openable) { |