[FIX] web_editor: insert record name as text

Previously, the many2one widget from the web_editor used jQuery's
'.html()' method when inserting a record name into the page. The record
name was not HTML-escaped before this, which may have unexpect result
and break the layout.

This commit fixes that by using the '.text()' method instead.

This bug only affects pages containing a many2one (contact excluded)
at the time of selection and not after the selection.
e.g. on the /event page, changing the category of an existing event
via the website editor

closes odoo/odoo#65642

X-original-commit: 53aff7f07317a8261b8b9c3e462d930141c7081b
Signed-off-by: Martin Trigaux (mat) <mat@odoo.com>

1 files changed, 1 insertions, 1 deletions

diff --git a/addons/web_editor/static/src/js/editor/snippets.options.js b/addons/web_editor/static/src/js/editor/snippets.options.js
index 40da59577a1..52f1bebb023 100644
--- a/addons/web_editor/static/src/js/editor/snippets.options.js
+++ b/addons/web_editor/static/src/js/editor/snippets.options.js
@@ -4633,7 +4633,7 @@ registry.many2one = SnippetOptionWidget.extend({
                     });
                 });
         } else {
-            self.$target.html($li.data('name'));
+            self.$target.text($li.data('name'));
         }
 
         this._clear();