pengyuthon/odoo_source
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[FIX] website_forum: de-raw-ify

Browse Source 
`post_content` is rendered template content, so should be makup-safe.

`result_msg` is qweb template content, so it's markup-safe.
This commit is contained in:
Xavier Morel
2021-04-29 05:34:20 +00:00
parent 543df9b355
commit 25aeaecf85
1 changed files with 3 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
addons/website_forum/views/website_forum.xml
+3 -4
View File
@@ -286,7 +286,7 @@
</div>
</div>
<!-- Display post's content in moderation mode-->
<div><t t-raw="post_content"/></div>
<div><t t-out="post_content"/></div>
</template>
<template id="display_post">
@@ -754,10 +754,9 @@
<t t-set="_search_and_tag_str"><t t-if="search and tag">&amp;nbsp;and&amp;nbsp;</t></t>
<t t-set="_tag_str"><t t-if="tag">using the <span class="badge badge-light" t-esc="tag.name"/> tag</t></t>
<t t-set="result_msg">
Sorry, we could not find any <b>%s</b> result <b>
%s</b> %s%s%s.
Sorry, we could not find any <b>%s</b> result <b>%s</b> %s%s%s.
</t>
<span t-raw="result_msg % (_filters_str.strip(), _my_str.strip(), _search_str.strip(), _search_and_tag_str.strip(), _tag_str.strip())"/>
<span t-out="result_msg % (_filters_str.strip(), _my_str.strip(), _search_str.strip(), _search_and_tag_str.strip(), _tag_str.strip())"/>
</div>
<t t-elif="not tag and not search and no_filters">