diff options
| author | XavierDo <xdo@odoo.com> | 2019-02-04 13:21:32 +0000 |
|---|---|---|
| committer | XavierDo <xdo@odoo.com> | 2019-02-07 08:53:45 +0000 |
| commit | b8f2edd94c498c6b1d8d7606d268232b50cbe88d (patch) | |
| tree | e54b86588009bfd1c44e118fa4333ea0217a255d /odoo/tools/mail.py | |
| parent | c875d0257228abba0b85f2d8ee0ffe50f7645433 (diff) | |
[FIX] core: remove email escape logic from html_sanitize.
Related to #30326
Before #30326, when calling html_sanitize, some content may be escaped
when it shouldn't. A simple example was images with cid links containing @.
(a first fix for another use case was made in 8aff53733b6ca1dd6f8074834ada1baaab3910d5)
We suspect that this escaping (added in 71a92f46e4e223a3bad0e27ececa2ece3c09f5d1)
was made to avoid loosing email with format '<email@domaine>' in html_sanitize
to escape them if html_sanitize is called on plain text.
Anyway, only html should be passed to html_sanitize, and therefore email of format
<email@domain> should already be escaped.
PR #30326 fixes the unwanted behaviour in 12.0 and this commit removes
this logic in master.
closes odoo/odoo#30815
Diffstat (limited to 'odoo/tools/mail.py')
| -rw-r--r-- | odoo/tools/mail.py | 5 |
1 files changed, 0 insertions, 5 deletions
diff --git a/odoo/tools/mail.py b/odoo/tools/mail.py index d310220111d..40c9604157f 100644 --- a/odoo/tools/mail.py +++ b/odoo/tools/mail.py @@ -176,11 +176,6 @@ def html_sanitize(src, silent=True, sanitize_tags=True, sanitize_attributes=Fals logger = logging.getLogger(__name__ + '.html_sanitize') - # html encode email tags - part = re.compile(r"(<(([^a<>]|a[^<>\s])[^<>]*)@[^<>]+>)", re.IGNORECASE | re.DOTALL) - # remove results containing cite="mid:email_like@address" (ex: blockquote cite) - # cite_except = re.compile(r"^((?!cite[\s]*=['\"]).)*$", re.IGNORECASE) - src = part.sub(lambda m: (u'cite=' not in m.group(1) and u'alt=' not in m.group(1) and u'src=' not in m.group(1)) and misc.html_escape(m.group(1)) or m.group(1), src) # html encode mako tags <% ... %> to decode them later and keep them alive, otherwise they are stripped by the cleaner src = src.replace(u'<%', misc.html_escape(u'<%')) src = src.replace(u'%>', misc.html_escape(u'%>')) |