[FIX] website_crm_partner_assign: escape interested partner comment

In portal an user can say he is interested by a lead and take it. He can also
post a comment. However this comment was not escaped, leading to possible
html injection.

As this comment is used to post a message no real issue occurs. It is sanitized
and behaves like every html content used in message_post. However we do not
want to support html here and therefore escape the content given to message
post.

Task ID 2228921

closes odoo/odoo#50537

X-original-commit: df5345618c4abbe8766a012b08ed90f1706c919a
Signed-off-by: Thibault Delavallee (tde) <tde@openerp.com>

addons/website_crm_partner_assign/models/crm_lead.py

@@ -5,6 +5,8 @@ import random
 
 from odoo import api, fields, models, _
 from odoo.exceptions import AccessDenied, AccessError
+from odoo.tools import html_escape
+
 
 
 class CrmLead(models.Model):
@@ -174,7 +176,7 @@ class CrmLead(models.Model):
     def partner_interested(self, comment=False):
         message = _('<p>I am interested by this lead.</p>')
         if comment:
-            message += '<p>%s</p>' % comment
+            message += '<p>%s</p>' % html_escape(comment)
         for lead in self:
             lead.message_post(body=message)
             lead.sudo().convert_opportunity(lead.partner_id.id)  # sudo required to convert partner data
@@ -188,7 +190,7 @@ class CrmLead(models.Model):
             [('id', 'child_of', self.env.user.partner_id.commercial_partner_id.id)])
         self.message_unsubscribe(partner_ids=partner_ids.ids)
         if comment:
-            message += '<p>%s</p>' % comment
+            message += '<p>%s</p>' % html_escape(comment)
         self.message_post(body=message)
         values = {
             'partner_assigned_id': False,