From 4f29b77e3d1677ffc88336cc99fb7f09d49d7dd1 Mon Sep 17 00:00:00 2001 From: qdp-odoo Date: Fri, 30 Dec 2016 17:20:36 +0100 Subject: [MERGE] foward port of 10.0 up to revision 84a650e33aadb29661121410813e3de37a5ad3e9 --- addons/mail/models/mail_shortcode.py | 27 +-------------------------- 1 file changed, 1 insertion(+), 26 deletions(-) (limited to 'addons/mail/models/mail_shortcode.py') diff --git a/addons/mail/models/mail_shortcode.py b/addons/mail/models/mail_shortcode.py index 36624bc0b2b..780a5a746c8 100644 --- a/addons/mail/models/mail_shortcode.py +++ b/addons/mail/models/mail_shortcode.py @@ -1,10 +1,7 @@ # -*- coding: utf-8 -*- # Part of Odoo. See LICENSE file for full copyright and licensing details. -import cgi -import re - -from odoo import api, fields, models +from odoo import fields, models class MailShortcode(models.Model): @@ -23,25 +20,3 @@ class MailShortcode(models.Model): shortcode_type = fields.Selection([('image', 'Smiley'), ('text', 'Canned Response')], required=True, default='text', help="* Smiley are only used for HTML code to display an image "\ "* Text (default value) is used to substitute text with another text") - - @api.model - def create(self, values): - if values.get('substitution'): - values['substitution'] = self._sanitize_shorcode(values['substitution']) - return super(MailShortcode, self).create(values) - - @api.multi - def write(self, values): - if values.get('substitution'): - values['substitution'] = self._sanitize_shorcode(values['substitution']) - return super(MailShortcode, self).write(values) - - def _sanitize_shorcode(self, substitution): - """ Sanitize the shortcode substitution : - - HTML substitution : only allow the img tag (emoji) - - escape other substitutions to avoid XSS - """ - is_img_tag = re.match(r'''^$''', substitution, re.M | re.I) - if is_img_tag: - return substitution - return cgi.escape(substitution) -- cgit v1.2.3