diff options
| author | XavierDo <xdo@odoo.com> | 2019-01-17 15:57:47 +0000 |
|---|---|---|
| committer | XavierDo <xdo@odoo.com> | 2019-01-17 16:21:08 +0000 |
| commit | 76e085cbb7cdff9d24acf666ffd8b81d0601b626 (patch) | |
| tree | 33b4d04bc7adbd009c9f33bbfa049096a3d82a6f /odoo/tools | |
| parent | 8781e2e4f8cf2d801d6f7f39a86a3bf63f8ad9da (diff) | |
[FIX] base: avoid to escape image when src contains @
The content id of an attachement can contains a @, therefore
image contained in emails where sometimes escaped by html_sanitize
as if they were emails adresses.
Task: 1915251
closes odoo/odoo#30326
Diffstat (limited to 'odoo/tools')
| -rw-r--r-- | odoo/tools/mail.py | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/odoo/tools/mail.py b/odoo/tools/mail.py index 668d0678f88..6992c206009 100644 --- a/odoo/tools/mail.py +++ b/odoo/tools/mail.py @@ -180,7 +180,7 @@ def html_sanitize(src, silent=True, sanitize_tags=True, sanitize_attributes=Fals part = re.compile(r"(<(([^a<>]|a[^<>\s])[^<>]*)@[^<>]+>)", re.IGNORECASE | re.DOTALL) # remove results containing cite="mid:email_like@address" (ex: blockquote cite) # cite_except = re.compile(r"^((?!cite[\s]*=['\"]).)*$", re.IGNORECASE) - src = part.sub(lambda m: (u'cite=' not in m.group(1) and u'alt=' not in m.group(1)) and misc.html_escape(m.group(1)) or m.group(1), src) + src = part.sub(lambda m: (u'cite=' not in m.group(1) and u'alt=' not in m.group(1) and u'src=' not in m.group(1)) and misc.html_escape(m.group(1)) or m.group(1), src) # html encode mako tags <% ... %> to decode them later and keep them alive, otherwise they are stripped by the cleaner src = src.replace(u'<%', misc.html_escape(u'<%')) src = src.replace(u'%>', misc.html_escape(u'%>')) |