From ea4dbcd2404663d8542d3f071ceae97ee6dc61ad Mon Sep 17 00:00:00 2001 From: Martin Trigaux Date: Tue, 30 Mar 2021 14:08:11 +0000 Subject: [FIX] web_editor: use escape for image rendering To properly escape all tags and not just the first one And move the escape before the loop to apply for everybody This avoid weird preview with selected content rendered (had effect only on preview) closes odoo/odoo#68633 Signed-off-by: Martin Trigaux (mat) --- addons/web_editor/static/src/js/wysiwyg/widgets/link_dialog.js | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'addons/web_editor/static/src/js') diff --git a/addons/web_editor/static/src/js/wysiwyg/widgets/link_dialog.js b/addons/web_editor/static/src/js/wysiwyg/widgets/link_dialog.js index cf2fa9dd04a..2a18ba2b436 100644 --- a/addons/web_editor/static/src/js/wysiwyg/widgets/link_dialog.js +++ b/addons/web_editor/static/src/js/wysiwyg/widgets/link_dialog.js @@ -261,11 +261,11 @@ var LinkDialog = Dialog.extend({ _getData: function () { var $url = this.$('input[name="url"]'); var url = $url.val(); - var label = this.$('input[name="label"]').val() || url; + var label = _.escape(this.$('input[name="label"]').val() || url); if (label && this.data.images) { for (var i = 0; i < this.data.images.length; i++) { - label = label.replace('<', "<").replace('>', ">").replace(/\[IMG\]/, this.data.images[i].outerHTML); + label = label.replace(/\[IMG\]/, this.data.images[i].outerHTML); } } -- cgit v1.2.3