diff options
| author | Nicolas Lempereur <nle@odoo.com> | 2020-04-22 14:47:15 +0000 |
|---|---|---|
| committer | Nicolas Lempereur <nle@odoo.com> | 2020-04-24 09:08:08 +0000 |
| commit | b781fb588e2a3864eb88521e8df596b182d48f53 (patch) | |
| tree | f38ef2b02c96c76ba595a1f5adadd202dc06fa6d /odoo/tools | |
| parent | a3a415b13003cd3bfccc202e833efac9ccfeebce (diff) | |
[FIX] mail.py: escape plaintext email
A plaintext email is displayed in a `<pre/>` tag to conserve spacing.
But since there is no escaping, if in this text there was XML tags or
HTML entities, they would appear as HTML in browser which is not wanted.
Do note that this was not a security issue since the content will still
be subjected to the checks and foundling of HTML emails.
Without the change, the added test would fail because character &,<,>
were not escaped.
opw-2242323
closes #50003
closes odoo/odoo#50123
X-original-commit: 932532b5b59e0b71c8e16dadfb2ff36c38764208
Signed-off-by: Nicolas Lempereur (nle) <nle@odoo.com>
Signed-off-by: Martin Trigaux (mat) <mat@odoo.com>
Diffstat (limited to 'odoo/tools')
| -rw-r--r-- | odoo/tools/mail.py | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/odoo/tools/mail.py b/odoo/tools/mail.py index 8738f132f72..c1a14e964fc 100644 --- a/odoo/tools/mail.py +++ b/odoo/tools/mail.py @@ -412,7 +412,7 @@ def append_content_to_html(html, content, plaintext=True, preserve=False, contai """ html = ustr(html) if plaintext and preserve: - content = u'\n<pre>%s</pre>\n' % ustr(content) + content = u'\n<pre>%s</pre>\n' % misc.html_escape(ustr(content)) elif plaintext: content = '\n%s\n' % plaintext2html(content, container_tag) else: |