From 0abfaeda96c2eaa868cc7fc5fa1926dfa90fc420 Mon Sep 17 00:00:00 2001
From: qsm-odoo <qsm@odoo.com>
Date: Wed, 30 Jan 2019 17:18:07 +0000
Subject: [FIX] website: prevent animation of anchor links with invalid
 fragment

Also secure the anchor creation to only allow valid names, that is
letters, digits, underscores and hyphens.

task-1913458

closes odoo/odoo#30701
---
 addons/website/static/src/xml/website.editor.xml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

(limited to 'addons/website/static/src/xml/website.editor.xml')

diff --git a/addons/website/static/src/xml/website.editor.xml b/addons/website/static/src/xml/website.editor.xml
index 5b060389618..46d5de05c12 100644
--- a/addons/website/static/src/xml/website.editor.xml
+++ b/addons/website/static/src/xml/website.editor.xml
@@ -107,7 +107,10 @@
             <label class="col-form-label col-md-3" for="anchorName">Choose an anchor name</label>
             <div class="col-md-9">
                 <input type="text" class="form-control o_input_anchor_name" id="anchorName" t-attf-value="#{currentAnchor}" placeholder="Anchor name"/>
-                <div class="invalid-feedback">The chosen name already exists</div>
+                <div class="invalid-feedback">
+                    <p class="d-none o_anchor_not_valid">The chosen name is not valid (use only a-Z A-Z 0-9 - _)</p>
+                    <p class="d-none o_anchor_already_exists">The chosen name already exists</p>
+                </div>
             </div>
         </div>
     </div>
-- 
cgit v1.2.3