diff options
| author | Martin Trigaux <mat@odoo.com> | 2016-06-02 16:02:48 +0200 |
|---|---|---|
| committer | Martin Trigaux <mat@odoo.com> | 2016-06-02 17:00:17 +0200 |
| commit | 30f06fd39e856a97c5aed7cff461e1bb207232bc (patch) | |
| tree | 759f5406f7b819e58844c12a80f7060938e097b2 /addons/website_forum/controllers | |
| parent | c751c129da8762c8f7b4ed599db9479d40a77f6e (diff) | |
[FIX] website_forum: convert content of posted comment to plaintext
HTML content should be escaped before being sanitized. Any content (link, image,
code,...) that is acceptable in usual mail.message but should not be interprated
when posted on a comment of the forum.
Fixes #3737
Diffstat (limited to 'addons/website_forum/controllers')
| -rw-r--r-- | addons/website_forum/controllers/main.py | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/addons/website_forum/controllers/main.py b/addons/website_forum/controllers/main.py index 4323e03720f..95a8062e37b 100644 --- a/addons/website_forum/controllers/main.py +++ b/addons/website_forum/controllers/main.py @@ -347,9 +347,10 @@ class WebsiteForum(http.Controller): cr, uid, context = request.cr, request.uid, request.context if kwargs.get('comment') and post.forum_id.id == forum.id: # TDE FIXME: check that post_id is the question or one of its answers + body = tools.mail.plaintext2html(kwargs['comment']) request.registry['forum.post'].message_post( cr, uid, post.id, - body=kwargs.get('comment'), + body=body, type='comment', subtype='mt_comment', context=dict(context, mail_create_nosubscribe=True)) |