From 129049f730f35b2a09f363b67917c176880e58ed Mon Sep 17 00:00:00 2001
From: Xavier Morel <xmo@odoo.com>
Date: Tue, 18 May 2021 13:26:05 +0000
Subject: [PATCH] [IMP] portal: de-traw-ify chatter

Replace t-raw by t-out when outputting the chatter message.

Mark message body as safe during preprocessing: messages from the
portal chatter are automatically escaped when
posted (`/mail/chatter_post` assumes the message body is plaintext,
and escapes it before formatting it based on newlines, maybe one day
it'll accept markdown) while messages from the backend chatter are
"HTML-light" and should be sanitized.
---
 addons/portal/static/src/js/portal_chatter.js          | 6 ++++--
 addons/portal/static/src/xml/portal_chatter.xml        | 2 +-
 addons/portal_rating/static/src/xml/portal_chatter.xml | 2 +-
 3 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/addons/portal/static/src/js/portal_chatter.js b/addons/portal/static/src/js/portal_chatter.js
index 4aaa473ce90..962699bc003 100644
--- a/addons/portal/static/src/js/portal_chatter.js
+++ b/addons/portal/static/src/js/portal_chatter.js
@@ -6,6 +6,7 @@ const dom = require('web.dom');
 var publicWidget = require('web.public.widget');
 var time = require('web.time');
 var portalComposer = require('portal.composer');
+const {Markup} = require('web.utils');
 
 var qweb = core.qweb;
 var _t = core._t;
@@ -118,13 +119,14 @@ var PortalChatter = publicWidget.Widget.extend({
     /**
      * Update the messages format
      *
-     * @param {Array<Object>}
+     * @param {Array<Object>} messages
      * @returns {Array}
      */
-    preprocessMessages: function (messages) {
+    preprocessMessages(messages) {
         _.each(messages, function (m) {
             m['author_avatar_url'] = _.str.sprintf('/web/image/%s/%s/author_avatar/50x50', 'mail.message', m.id);
             m['published_date_str'] = _.str.sprintf(_t('Published on %s'), moment(time.str_to_datetime(m.date)).format('MMMM Do YYYY, h:mm:ss a'));
+            m['body'] = Markup(m.body);
         });
         return messages;
     },
diff --git a/addons/portal/static/src/xml/portal_chatter.xml b/addons/portal/static/src/xml/portal_chatter.xml
index 87e3f34afc3..1c6b9afd838 100644
--- a/addons/portal/static/src/xml/portal_chatter.xml
+++ b/addons/portal/static/src/xml/portal_chatter.xml
@@ -88,7 +88,7 @@
                             <h5 class='mb-1'><t t-esc="message.author_id[1]"/></h5>
                             <p class="o_portal_chatter_puslished_date"><t t-esc="message.published_date_str"/></p>
                         </div>
-                        <t t-raw="message.body"/>
+                        <t t-out="message.body"/>
 
                         <div class="o_portal_chatter_attachments">
                             <t t-call="portal.Chatter.Attachments">
diff --git a/addons/portal_rating/static/src/xml/portal_chatter.xml b/addons/portal_rating/static/src/xml/portal_chatter.xml
index f9a095a33f3..6014c1365ae 100644
--- a/addons/portal_rating/static/src/xml/portal_chatter.xml
+++ b/addons/portal_rating/static/src/xml/portal_chatter.xml
@@ -16,7 +16,7 @@
     </t>
 
     <t t-extend="portal.chatter_messages">
-        <t t-jquery="t[t-raw='message.body']" t-operation="before">
+        <t t-jquery="t[t-out='message.body']" t-operation="before">
             <t t-if="message['rating_value']">
                 <t t-call="portal_rating.rating_stars_static">
                     <t t-set="val" t-value="message.rating_value"/>