From 3428e15453ec259b234ab5c2ef4a02cd52ae5750 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Thibault=20Delavall=C3=A9e?= <tde@odoo.com>
Date: Tue, 6 Jun 2023 09:07:57 +0200
Subject: [PATCH] [FIX] account, mail: defensively evaluate 'partner_to' on
 mail templates

MailTemplate model has a 'partner_to' field is dynamically rendered to contain
partners being recipients. After rendering it should hold a comma-separated
list of partner IDs.

However as we are unsure it was correctly written better be defensive. We now
check that we can effectively transform items to IDs using 'isdigit()'.

Task-2612945 (Mail: Defensive email formatting)

X-original-commit: odoo/odoo@a4e7f9b9dd24ab82194c7abc2088b9d415034d50
Part-of: odoo/odoo#134934
---
 addons/account/wizard/account_move_send.py |  2 +-
 addons/mail/models/mail_template.py        | 14 ++++++++++----
 2 files changed, 11 insertions(+), 5 deletions(-)

diff --git a/addons/account/wizard/account_move_send.py b/addons/account/wizard/account_move_send.py
index 3433f5cc1c5..71c1242b583 100644
--- a/addons/account/wizard/account_move_send.py
+++ b/addons/account/wizard/account_move_send.py
@@ -233,7 +233,7 @@ class AccountMoveSend(models.Model):
                 if mail_template.partner_to:
                     partner_to = wizard._get_mail_default_field_value_from_template(mail_template, wizard.mail_lang, move,
                                                                                   'partner_to')
-                    partner_ids = [int(pid) for pid in partner_to.split(',') if pid]
+                    partner_ids = mail_template._parse_partner_to(partner_to)
                     partners |= self.env['res.partner'].sudo().browse(partner_ids).exists()
                 wizard.mail_partner_ids = partners
             else:
diff --git a/addons/mail/models/mail_template.py b/addons/mail/models/mail_template.py
index 3de352dad0b..840d4efb4ba 100644
--- a/addons/mail/models/mail_template.py
+++ b/addons/mail/models/mail_template.py
@@ -375,10 +375,9 @@ class MailTemplate(models.Model):
 
         # update 'partner_to' rendered value to 'partner_ids'
         all_partner_to = {
-            int(pid)
+            pid
             for record_values in render_results.values()
-            for pid in record_values.get('partner_to', '').split(',')
-            if pid and pid.strip()
+            for pid in self._parse_partner_to(record_values.get('partner_to', ''))
         }
         existing_pids = set()
         if all_partner_to:
@@ -386,7 +385,7 @@ class MailTemplate(models.Model):
         for res_id, record_values in render_results.items():
             partner_to = record_values.pop('partner_to', '')
             if partner_to:
-                tpl_partner_ids = set(int(pid) for pid in partner_to.split(',') if pid) & existing_pids
+                tpl_partner_ids = set(self._parse_partner_to(partner_to)) & existing_pids
                 record_values.setdefault('partner_ids', []).extend(tpl_partner_ids)
 
         return render_results
@@ -526,6 +525,13 @@ class MailTemplate(models.Model):
 
         return render_results
 
+    @classmethod
+    def _parse_partner_to(cls, partner_to):
+        return [
+            int(pid.strip()) for pid in partner_to.split(',')
+            if (pid and pid.strip().isdigit())
+        ]
+
     # ------------------------------------------------------------
     # EMAIL
     # ------------------------------------------------------------