[IMP] tools: sanitizer: add and clean sanitize options

Now having

 * sanitize: run the sanitizer to clean the html (removing javascripts,
   unwanted tags, ...)
 * sanitize_tags: only a subset of tags is allowed in html content.
   Unwelcomed tags are remove dand their content stripped.
 * sanitize_attributes: only a subset of attributes is allowed.
 * sanitize_style: only a subset of style attributes is allowed. Style
   attributes are parsed to keep only a white list.
 * strip_style: all style is removed. It bypasses sanitize_style as there
   is no need to sanitize something that is removed.
 * strip_classes: remove class attributes

Fields parameters have also been updated to match the sanitize options. Html
fields by default are sanitized with sanitize_tags activated but without any
further options. All addons have been updated to match the new options
according to their previous behavior.

15 files changed, 19 insertions, 19 deletions

diff --git a/addons/event/models/event.py b/addons/event/models/event.py
index d569a08984b..a0a7e72ae71 100644
--- a/addons/event/models/event.py
+++ b/addons/event/models/event.py
@@ -184,7 +184,7 @@ class EventEvent(models.Model):
         readonly=False, states={'done': [('readonly', True)]})
     country_id = fields.Many2one('res.country', 'Country',  related='address_id.country_id', store=True)
     description = fields.Html(
-        string='Description', oldname='note', translate=html_translate, sanitize=False,
+        string='Description', oldname='note', translate=html_translate, sanitize_attributes=False,
         readonly=False, states={'done': [('readonly', True)]})
     # badge fields
     badge_front = fields.Html(string='Badge Front')
diff --git a/addons/mail/models/mail_message.py b/addons/mail/models/mail_message.py
index 59f707bfc9f..5aa52d755c8 100644
--- a/addons/mail/models/mail_message.py
+++ b/addons/mail/models/mail_message.py
@@ -50,7 +50,7 @@ class Message(models.Model):
     # content
     subject = fields.Char('Subject')
     date = fields.Datetime('Date', default=fields.Datetime.now)
-    body = fields.Html('Contents', default='', strip_classes=True)
+    body = fields.Html('Contents', default='', sanitize_style=True, strip_classes=True)
     attachment_ids = fields.Many2many(
         'ir.attachment', 'message_attachment_rel',
         'message_id', 'attachment_id',
diff --git a/addons/mail/models/mail_template.py b/addons/mail/models/mail_template.py
index 8508fa9f250..801cf27f50e 100644
--- a/addons/mail/models/mail_template.py
+++ b/addons/mail/models/mail_template.py
@@ -139,7 +139,7 @@ class MailTemplate(models.Model):
     mail_server_id = fields.Many2one('ir.mail_server', 'Outgoing Mail Server', readonly=False,
                                      help="Optional preferred server for outgoing mails. If not set, the highest "
                                           "priority one will be used.")
-    body_html = fields.Html('Body', translate=True, sanitize=False)
+    body_html = fields.Html('Body', translate=True, sanitize_attributes=False)
     report_name = fields.Char('Report Filename', translate=True,
                               help="Name to use for the generated report file (may contain placeholders)\n"
                                    "The extension can be omitted and will then come from the report type.")
diff --git a/addons/mass_mailing/models/mass_mailing.py b/addons/mass_mailing/models/mass_mailing.py
index 9bf1a913b20..de197a48b89 100644
--- a/addons/mass_mailing/models/mass_mailing.py
+++ b/addons/mass_mailing/models/mass_mailing.py
@@ -300,7 +300,7 @@ class MassMailing(models.Model):
     create_date = fields.Datetime(string='Creation Date')
     sent_date = fields.Datetime(string='Sent Date', oldname='date', copy=False)
     schedule_date = fields.Datetime(string='Schedule in the Future')
-    body_html = fields.Html(string='Body', translate=html_translate, sanitize=False)
+    body_html = fields.Html(string='Body', translate=html_translate, sanitize_attributes=False)
     attachment_ids = fields.Many2many('ir.attachment', 'mass_mailing_ir_attachments_rel',
         'mass_mailing_id', 'attachment_id', string='Attachments')
     keep_archives = fields.Boolean(string='Keep Archives')
diff --git a/addons/website_blog/models/website_blog.py b/addons/website_blog/models/website_blog.py
index d1a4ad93c56..35d611f162e 100644
--- a/addons/website_blog/models/website_blog.py
+++ b/addons/website_blog/models/website_blog.py
@@ -110,7 +110,7 @@ class BlogPost(models.Model):
         default='{"background-image": "none", "background-color": "oe_black", "opacity": "0.2", "resize_class": ""}')
     blog_id = fields.Many2one('blog.blog', 'Blog', required=True, ondelete='cascade')
     tag_ids = fields.Many2many('blog.tag', string='Tags')
-    content = fields.Html('Content', default=_default_content, translate=html_translate, sanitize=False)
+    content = fields.Html('Content', default=_default_content, translate=html_translate, sanitize_attributes=False)
     teaser = fields.Text('Teaser', compute='_compute_teaser', inverse='_set_teaser')
     teaser_manual = fields.Text(string='Teaser Content')
 
diff --git a/addons/website_event_track/models/website_event_track.py b/addons/website_event_track/models/website_event_track.py
index 7f98f372e45..969bef0fa61 100644
--- a/addons/website_event_track/models/website_event_track.py
+++ b/addons/website_event_track/models/website_event_track.py
@@ -49,7 +49,7 @@ class Track(models.Model):
     state = fields.Selection([
         ('draft', 'Proposal'), ('confirmed', 'Confirmed'), ('announced', 'Announced'), ('published', 'Published'), ('refused', 'Refused'), ('cancel', 'Cancelled')],
         'Status', default='draft', required=True, copy=False, track_visibility='onchange')
-    description = fields.Html('Track Description', translate=html_translate, sanitize=False)
+    description = fields.Html('Track Description', translate=html_translate, sanitize_attributes=False)
     date = fields.Datetime('Track Date')
     duration = fields.Float('Duration', default=1.5)
     location_id = fields.Many2one('event.track.location', 'Room')
diff --git a/addons/website_forum/models/forum.py b/addons/website_forum/models/forum.py
index a1bdeb9fbde..3ef6636af73 100644
--- a/addons/website_forum/models/forum.py
+++ b/addons/website_forum/models/forum.py
@@ -711,7 +711,7 @@ class Post(models.Model):
         question = self.parent_id
         values = {
             'author_id': self.sudo().create_uid.partner_id.id,  # use sudo here because of access to res.users model
-            'body': tools.html_sanitize(self.content, strict=True, strip_style=True, strip_classes=True),
+            'body': tools.html_sanitize(self.content, sanitize_attributes=True, strip_style=True, strip_classes=True),
             'message_type': 'comment',
             'subtype': 'mail.mt_comment',
             'date': self.create_date,
diff --git a/addons/website_hr_recruitment/models/hr_recruitment.py b/addons/website_hr_recruitment/models/hr_recruitment.py
index 4d77e37e459..1a0960a444e 100644
--- a/addons/website_hr_recruitment/models/hr_recruitment.py
+++ b/addons/website_hr_recruitment/models/hr_recruitment.py
@@ -47,7 +47,7 @@ class Job(models.Model):
         default_description = self.env["ir.model.data"].xmlid_to_object("website_hr_recruitment.default_website_description")
         return (default_description.render() if default_description else "")
 
-    website_description = fields.Html('Website description', translate=html_translate, sanitize=False, default=_get_default_website_description)
+    website_description = fields.Html('Website description', translate=html_translate, sanitize_attributes=False, default=_get_default_website_description)
 
     @api.multi
     def _compute_website_url(self):
diff --git a/addons/website_livechat/models/im_livechat.py b/addons/website_livechat/models/im_livechat.py
index f73d3b594f7..17ad3f89a12 100644
--- a/addons/website_livechat/models/im_livechat.py
+++ b/addons/website_livechat/models/im_livechat.py
@@ -17,4 +17,4 @@ class ImLivechatChannel(models.Model):
         for channel in self:
             channel.website_url = "/livechat/channel/%s" % (slug(channel),)
 
-    website_description = fields.Html("Website description", default=False, help="Description of the channel displayed on the website page", sanitize=False, translate=html_translate)
+    website_description = fields.Html("Website description", default=False, help="Description of the channel displayed on the website page", sanitize_attributes=False, translate=html_translate)
diff --git a/addons/website_mass_mailing/models/mass_mailing_list.py b/addons/website_mass_mailing/models/mass_mailing_list.py
index 7058e385b05..3e49bcba59b 100644
--- a/addons/website_mass_mailing/models/mass_mailing_list.py
+++ b/addons/website_mass_mailing/models/mass_mailing_list.py
@@ -18,6 +18,6 @@ class MassMailingList(models.Model):
 </div>
 <p class="o_message_paragraph">Join our Marketing newsletter and get <strong>this white paper instantly</strong></p>"""
 
-    popup_content = fields.Html(string="Website Popup Content", translate=True, sanitize=False,
+    popup_content = fields.Html(string="Website Popup Content", translate=True, sanitize_attributes=False,
                                 default=_default_popup_content)
     popup_redirect_url = fields.Char(string="Website Popup Redirect URL", default='/')
diff --git a/addons/website_quote/models/product_template.py b/addons/website_quote/models/product_template.py
index ef2773225f1..55f3fbc1dec 100644
--- a/addons/website_quote/models/product_template.py
+++ b/addons/website_quote/models/product_template.py
@@ -7,5 +7,5 @@ from odoo import fields, models
 class ProductTemplate(models.Model):
     _inherit = "product.template"
 
-    website_description = fields.Html('Description for the website', sanitize=False) # hack, if website_sale is not installed
-    quote_description = fields.Html('Description for the quote', sanitize=False)
+    website_description = fields.Html('Description for the website', sanitize_attributes=False) # hack, if website_sale is not installed
+    quote_description = fields.Html('Description for the quote', sanitize_attributes=False)
diff --git a/addons/website_quote/models/sale_order.py b/addons/website_quote/models/sale_order.py
index 513185d0075..4e069e2c916 100644
--- a/addons/website_quote/models/sale_order.py
+++ b/addons/website_quote/models/sale_order.py
@@ -56,7 +56,7 @@ class SaleOrder(models.Model):
         'sale.quote.template', 'Quotation Template',
         default=_get_default_template_id, readonly=True,
         states={'draft': [('readonly', False)], 'sent': [('readonly', False)]})
-    website_description = fields.Html('Description', sanitize=False, translate=html_translate)
+    website_description = fields.Html('Description', sanitize_attributes=False, translate=html_translate)
     options = fields.One2many(
         'sale.order.option', 'order_id', 'Optional Products Lines',
         copy=True, readonly=True,
@@ -199,7 +199,7 @@ class SaleOrderOption(models.Model):
     name = fields.Text('Description', required=True)
     product_id = fields.Many2one('product.product', 'Product', domain=[('sale_ok', '=', True)])
     layout_category_id = fields.Many2one('sale.layout_category', string='Section')
-    website_description = fields.Html('Line Description', sanitize=False, translate=html_translate)
+    website_description = fields.Html('Line Description', sanitize_attributes=False, translate=html_translate)
     price_unit = fields.Float('Unit Price', required=True, digits=dp.get_precision('Product Price'))
     discount = fields.Float('Discount (%)', digits=dp.get_precision('Discount'))
     uom_id = fields.Many2one('product.uom', 'Unit of Measure ', required=True)
diff --git a/addons/website_quote/models/sale_quote.py b/addons/website_quote/models/sale_quote.py
index 895c2930d89..817df1e087c 100644
--- a/addons/website_quote/models/sale_quote.py
+++ b/addons/website_quote/models/sale_quote.py
@@ -11,7 +11,7 @@ class SaleQuoteTemplate(models.Model):
     _description = "Sale Quotation Template"
 
     name = fields.Char('Quotation Template', required=True)
-    website_description = fields.Html('Description', translate=html_translate, sanitize=False)
+    website_description = fields.Html('Description', translate=html_translate, sanitize_attributes=False)
     quote_line = fields.One2many('sale.quote.line', 'quote_id', 'Quotation Template Lines', copy=True)
     note = fields.Text('Terms and conditions')
     options = fields.One2many('sale.quote.option', 'template_id', 'Optional Products Lines', copy=True)
@@ -100,7 +100,7 @@ class SaleQuoteOption(models.Model):
     name = fields.Text('Description', required=True, translate=True)
     product_id = fields.Many2one('product.product', 'Product', domain=[('sale_ok', '=', True)], required=True)
     layout_category_id = fields.Many2one('sale.layout_category', string='Section')
-    website_description = fields.Html('Option Description', translate=html_translate, sanitize=False)
+    website_description = fields.Html('Option Description', translate=html_translate, sanitize_attributes=False)
     price_unit = fields.Float('Unit Price', required=True, digits=dp.get_precision('Product Price'))
     discount = fields.Float('Discount (%)', digits=dp.get_precision('Discount'))
     uom_id = fields.Many2one('product.uom', 'Unit of Measure ', required=True)
diff --git a/addons/website_sale/models/product.py b/addons/website_sale/models/product.py
index ef1096f6285..fe2bb8dcf64 100644
--- a/addons/website_sale/models/product.py
+++ b/addons/website_sale/models/product.py
@@ -81,7 +81,7 @@ class ProductTemplate(models.Model):
         domain=lambda self: ['&', ('model', '=', self._name), ('message_type', '=', 'comment')],
         string='Website Comments',
     )
-    website_description = fields.Html('Description for the website', sanitize=False, translate=True)
+    website_description = fields.Html('Description for the website', sanitize_attributes=False, translate=True)
     alternative_product_ids = fields.Many2many('product.template', 'product_alternative_rel', 'src_id', 'dest_id',
                                                string='Suggested Products', help='Appear on the product page')
     accessory_product_ids = fields.Many2many('product.product', 'product_accessory_rel', 'src_id', 'dest_id',
diff --git a/addons/website_slides/models/slides.py b/addons/website_slides/models/slides.py
index b2e6fb0ae7f..602b95014e7 100644
--- a/addons/website_slides/models/slides.py
+++ b/addons/website_slides/models/slides.py
@@ -34,7 +34,7 @@ class Channel(models.Model):
 
     name = fields.Char('Name', translate=True, required=True)
     active = fields.Boolean(default=True)
-    description = fields.Html('Description', translate=html_translate, sanitize=False)
+    description = fields.Html('Description', translate=html_translate, sanitize_attributes=False)
     sequence = fields.Integer(default=10, help='Display order')
     category_ids = fields.One2many('slide.category', 'channel_id', string="Categories")
     slide_ids = fields.One2many('slide.slide', 'channel_id', string="Slides")
@@ -102,7 +102,7 @@ class Channel(models.Model):
         string='Channel Groups', help="Groups allowed to see presentations in this channel")
     access_error_msg = fields.Html(
         'Error Message', help="Message to display when not accessible due to access rights",
-        default="<p>This channel is private and its content is restricted to some users.</p>", translate=html_translate, sanitize=False)
+        default="<p>This channel is private and its content is restricted to some users.</p>", translate=html_translate, sanitize_attributes=False)
     upload_group_ids = fields.Many2many(
         'res.groups', 'rel_upload_groups', 'channel_id', 'group_id',
         string='Upload Groups', help="Groups allowed to upload presentations in this channel. If void, every user can upload.")