[FIX] account, mail: defensively evaluate 'partner_to' on mail templates

MailTemplate model has a 'partner_to' field is dynamically rendered to contain
partners being recipients. After rendering it should hold a comma-separated
list of partner IDs.

However as we are unsure it was correctly written better be defensive. We now
check that we can effectively transform items to IDs using 'isdigit()'.

Task-2612945 (Mail: Defensive email formatting)

X-original-commit: odoo/odoo@a4e7f9b9dd
Part-of: odoo/odoo#134934

addons/account/wizard/account_move_send.py

@@ -233,7 +233,7 @@ class AccountMoveSend(models.Model):
                 if mail_template.partner_to:
                     partner_to = wizard._get_mail_default_field_value_from_template(mail_template, wizard.mail_lang, move,
                                                                                   'partner_to')
-                    partner_ids = [int(pid) for pid in partner_to.split(',') if pid]
+                    partner_ids = mail_template._parse_partner_to(partner_to)
                     partners |= self.env['res.partner'].sudo().browse(partner_ids).exists()
                 wizard.mail_partner_ids = partners
             else:

addons/mail/models/mail_template.py

@@ -375,10 +375,9 @@ class MailTemplate(models.Model):
 
         # update 'partner_to' rendered value to 'partner_ids'
         all_partner_to = {
-            int(pid)
+            pid
             for record_values in render_results.values()
-            for pid in record_values.get('partner_to', '').split(',')
-            if pid and pid.strip()
+            for pid in self._parse_partner_to(record_values.get('partner_to', ''))
         }
         existing_pids = set()
         if all_partner_to:
@@ -386,7 +385,7 @@ class MailTemplate(models.Model):
         for res_id, record_values in render_results.items():
             partner_to = record_values.pop('partner_to', '')
             if partner_to:
-                tpl_partner_ids = set(int(pid) for pid in partner_to.split(',') if pid) & existing_pids
+                tpl_partner_ids = set(self._parse_partner_to(partner_to)) & existing_pids
                 record_values.setdefault('partner_ids', []).extend(tpl_partner_ids)
 
         return render_results
@@ -526,6 +525,13 @@ class MailTemplate(models.Model):
 
         return render_results
 
+    @classmethod
+    def _parse_partner_to(cls, partner_to):
+        return [
+            int(pid.strip()) for pid in partner_to.split(',')
+            if (pid and pid.strip().isdigit())
+        ]
+
     # ------------------------------------------------------------
     # EMAIL
     # ------------------------------------------------------------