diff options
| author | Laurent Stukkens (LTU) <ltu@odoo.com> | 2020-10-09 19:38:22 +0000 |
|---|---|---|
| committer | Laurent Stukkens (LTU) <ltu@odoo.com> | 2020-10-12 14:57:22 +0000 |
| commit | f91422115c09be484f2868347566b6392ed0effd (patch) | |
| tree | 4819af15e22e4d79468242e73bbcee27cc1be07e /addons/website/data/website_data.xml | |
| parent | 59584974aa891b1182164adac3d3563d882bcfd7 (diff) | |
[FIX] website,website_sale: HTML escape dynamic snippet
Issue
To do on Community:
- Install website_sale (eCommerce)
- Go into Website app
- Navigate through Product/Products
- Edit 'Customizable Desk (CONFIG)' and add '&' and/or '<' and/or '>'
characters into the name
- Save
- Go to the Website app Dashboard and click on 'Go to Website'
- Click on 'Edit' button
- Drag and drop the 'Dynamic Product' snippet into the website
- Click on the block 'Your Dynamic Snippet wil be ...'
- In the right panel, in the 'Dynamic Product' snippet options,
chose a 'Template' and a 'Product Category'
A traceback is shown
Cause
the '&' character crashes lxml.etree.fromstring
Solution
ensure no '&' is sent to lxmx.etree.fromstring by using
odoo.tools.html_escape (in order to ensure no other problematic
characters are sent to the front) on the field values except when
not applicable (widget rendering with record_to_html should not be
escaped).
It is important to note here that this is applicable
to action servers that are used by the dynamic filter.
opw-2357027
closes odoo/odoo#59679
Signed-off-by: Jérémy Kersten (jke) <jke@openerp.com>
Diffstat (limited to 'addons/website/data/website_data.xml')
| -rw-r--r-- | addons/website/data/website_data.xml | 5 |
1 files changed, 2 insertions, 3 deletions
diff --git a/addons/website/data/website_data.xml b/addons/website/data/website_data.xml index dda2fe05c90..dc477e723f6 100644 --- a/addons/website/data/website_data.xml +++ b/addons/website/data/website_data.xml @@ -707,6 +707,8 @@ <field name="url">/website/static/src/img/snippets_demo/s_popup.jpg</field> </record> + </data> + <data> <!-- Filter for Dynamic Snippet --> <record id="dynamic_snippet_country_filter" model="ir.filters"> <field name="name">Countries</field> @@ -769,9 +771,6 @@ <field name="name">Countries</field> <field name="website_id" ref="website.default_website"/> </record> - - </data> - <data> <record id="group_multi_website" model="res.groups"> <field name="name">Multi-website</field> <field name="category_id" ref="base.module_category_hidden"/> |