[FIX] website,website_sale: HTML escape dynamic snippet

Issue
    To do on Community:
    - Install website_sale (eCommerce)
    - Go into Website app
    - Navigate through Product/Products
    - Edit 'Customizable Desk (CONFIG)' and add '&' and/or '<' and/or '>'
      characters into the name
    - Save
    - Go to the Website app Dashboard and click on 'Go to Website'
    - Click on 'Edit' button
    - Drag and drop the 'Dynamic Product' snippet into the website
    - Click on the block 'Your Dynamic Snippet wil be ...'
    - In the right panel, in the 'Dynamic Product' snippet options,
      chose a 'Template' and a 'Product Category'

    A traceback is shown

Cause
    the '&' character crashes lxml.etree.fromstring

Solution
    ensure no '&' is sent to lxmx.etree.fromstring by using
    odoo.tools.html_escape (in order to ensure no other problematic
    characters are sent to the front) on the field values except when
    not applicable (widget rendering with record_to_html should not be
    escaped).
    It is important to note here that this is applicable
    to action servers that are used by the dynamic filter.

opw-2357027

closes odoo/odoo#59679

Signed-off-by: Jérémy Kersten (jke) <jke@openerp.com>

0 files changed, 0 insertions, 0 deletions