From 2a2e5c7b1e155abc7714708b1183191395ff48b1 Mon Sep 17 00:00:00 2001
From: std-odoo <std@odoo.com>
Date: Tue, 14 Apr 2020 12:27:23 +0000
Subject: [PATCH] [FIX] website_crm_partner_assign: escape interested partner
 comment

In portal an user can say he is interested by a lead and take it. He can also
post a comment. However this comment was not escaped, leading to possible
html injection.

As this comment is used to post a message no real issue occurs. It is sanitized
and behaves like every html content used in message_post. However we do not
want to support html here and therefore escape the content given to message
post.

Task ID 2228921

closes odoo/odoo#50537

X-original-commit: df5345618c4abbe8766a012b08ed90f1706c919a
Signed-off-by: Thibault Delavallee (tde) <tde@openerp.com>
---
 addons/website_crm_partner_assign/models/crm_lead.py | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/addons/website_crm_partner_assign/models/crm_lead.py b/addons/website_crm_partner_assign/models/crm_lead.py
index 817169bb56e..241ff642b5b 100644
--- a/addons/website_crm_partner_assign/models/crm_lead.py
+++ b/addons/website_crm_partner_assign/models/crm_lead.py
@@ -5,6 +5,8 @@ import random
 
 from odoo import api, fields, models, _
 from odoo.exceptions import AccessDenied, AccessError
+from odoo.tools import html_escape
+
 
 
 class CrmLead(models.Model):
@@ -174,7 +176,7 @@ class CrmLead(models.Model):
     def partner_interested(self, comment=False):
         message = _('<p>I am interested by this lead.</p>')
         if comment:
-            message += '<p>%s</p>' % comment
+            message += '<p>%s</p>' % html_escape(comment)
         for lead in self:
             lead.message_post(body=message)
             lead.sudo().convert_opportunity(lead.partner_id.id)  # sudo required to convert partner data
@@ -188,7 +190,7 @@ class CrmLead(models.Model):
             [('id', 'child_of', self.env.user.partner_id.commercial_partner_id.id)])
         self.message_unsubscribe(partner_ids=partner_ids.ids)
         if comment:
-            message += '<p>%s</p>' % comment
+            message += '<p>%s</p>' % html_escape(comment)
         self.message_post(body=message)
         values = {
             'partner_assigned_id': False,