diff options
Diffstat (limited to 'addons/mail/models/mail_shortcode.py')
| -rw-r--r-- | addons/mail/models/mail_shortcode.py | 27 |
1 files changed, 1 insertions, 26 deletions
diff --git a/addons/mail/models/mail_shortcode.py b/addons/mail/models/mail_shortcode.py index 36624bc0b2b..780a5a746c8 100644 --- a/addons/mail/models/mail_shortcode.py +++ b/addons/mail/models/mail_shortcode.py @@ -1,10 +1,7 @@ # -*- coding: utf-8 -*- # Part of Odoo. See LICENSE file for full copyright and licensing details. -import cgi -import re - -from odoo import api, fields, models +from odoo import fields, models class MailShortcode(models.Model): @@ -23,25 +20,3 @@ class MailShortcode(models.Model): shortcode_type = fields.Selection([('image', 'Smiley'), ('text', 'Canned Response')], required=True, default='text', help="* Smiley are only used for HTML code to display an image "\ "* Text (default value) is used to substitute text with another text") - - @api.model - def create(self, values): - if values.get('substitution'): - values['substitution'] = self._sanitize_shorcode(values['substitution']) - return super(MailShortcode, self).create(values) - - @api.multi - def write(self, values): - if values.get('substitution'): - values['substitution'] = self._sanitize_shorcode(values['substitution']) - return super(MailShortcode, self).write(values) - - def _sanitize_shorcode(self, substitution): - """ Sanitize the shortcode substitution : - - HTML substitution : only allow the img tag (emoji) - - escape other substitutions to avoid XSS - """ - is_img_tag = re.match(r'''^<img\s+src=('|")([^'"]*)\1\s*/?>$''', substitution, re.M | re.I) - if is_img_tag: - return substitution - return cgi.escape(substitution) |