From 25aeaecf85140e9a0999f6a3c64ff252e15b35ec Mon Sep 17 00:00:00 2001
From: Xavier Morel <xmo@odoo.com>
Date: Wed, 10 Mar 2021 08:14:33 +0000
Subject: [PATCH] [FIX] website_forum: de-raw-ify

`post_content` is rendered template content, so should be makup-safe.

`result_msg` is qweb template content, so it's markup-safe.
---
 addons/website_forum/views/website_forum.xml | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/addons/website_forum/views/website_forum.xml b/addons/website_forum/views/website_forum.xml
index 75c9af58423..6a60a30810b 100644
--- a/addons/website_forum/views/website_forum.xml
+++ b/addons/website_forum/views/website_forum.xml
@@ -286,7 +286,7 @@
         </div>
     </div>
     <!--  Display post's content in moderation mode-->
-    <div><t t-raw="post_content"/></div>
+    <div><t t-out="post_content"/></div>
 </template>
 
 <template id="display_post">
@@ -754,10 +754,9 @@
                     <t t-set="_search_and_tag_str"><t t-if="search and tag">&amp;nbsp;and&amp;nbsp;</t></t>
                     <t t-set="_tag_str"><t t-if="tag">using the <span class="badge badge-light" t-esc="tag.name"/> tag</t></t>
                     <t t-set="result_msg">
-                        Sorry, we could not find any <b>%s</b> result <b>
-                        %s</b> %s%s%s.
+                        Sorry, we could not find any <b>%s</b> result <b>%s</b> %s%s%s.
                     </t>
-                    <span t-raw="result_msg % (_filters_str.strip(), _my_str.strip(), _search_str.strip(), _search_and_tag_str.strip(), _tag_str.strip())"/>
+                    <span t-out="result_msg % (_filters_str.strip(), _my_str.strip(), _search_str.strip(), _search_and_tag_str.strip(), _tag_str.strip())"/>
                 </div>
 
                 <t t-elif="not tag and not search and no_filters">