From 369075fefbd20a6bb19c0b21df5fdde827bbdaa4 Mon Sep 17 00:00:00 2001
From: Xavier Morel <xmo@odoo.com>
Date: Wed, 10 Mar 2021 08:23:10 +0000
Subject: [PATCH] [FIX] website_slides: de-raw-ify

Convert `embed_code` to a computed HTML field so it's considered markup-safe.

It needs to be sanitize=False because we're putting <iframe> elements
in it. Those get stripped by sanitize.
---
 addons/website_slides/data/mail_templates.xml                 | 4 ++--
 addons/website_slides/models/slide_slide.py                   | 2 +-
 .../website_slides/views/website_slides_templates_lesson.xml  | 4 ++--
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/addons/website_slides/data/mail_templates.xml b/addons/website_slides/data/mail_templates.xml
index f4f7bc3e218..5e620461a61 100644
--- a/addons/website_slides/data/mail_templates.xml
+++ b/addons/website_slides/data/mail_templates.xml
@@ -27,7 +27,7 @@
     <!-- CONTENT -->
     <tr>
         <td style="min-width: 590px;">
-            <t t-raw="message.body"/>
+            <t t-out="message.body"/>
             <div style="margin: 32px 0px 32px 0px; text-align: center;">
                 <a t-att-href="record.channel_id.website_url"
                     style="background-color: #875A7B; padding: 8px 16px 8px 16px; text-decoration: none; color: #fff; border-radius: 5px; font-size:13px;">
@@ -39,7 +39,7 @@
             </div>
             <div>&amp;nbsp;</div>
             <div t-if="signature" style="font-size: 13px;">
-                <div t-raw="signature"/>
+                <div t-out="signature"/>
             </div>
         </td>
     </tr>
diff --git a/addons/website_slides/models/slide_slide.py b/addons/website_slides/models/slide_slide.py
index 3151f05bd88..e488ba974b0 100644
--- a/addons/website_slides/models/slide_slide.py
+++ b/addons/website_slides/models/slide_slide.py
@@ -181,7 +181,7 @@ class Slide(models.Model):
     likes = fields.Integer('Likes', compute='_compute_user_info', store=True, compute_sudo=False)
     dislikes = fields.Integer('Dislikes', compute='_compute_user_info', store=True, compute_sudo=False)
     user_vote = fields.Integer('User vote', compute='_compute_user_info', compute_sudo=False)
-    embed_code = fields.Text('Embed Code', readonly=True, compute='_compute_embed_code')
+    embed_code = fields.Html('Embed Code', readonly=True, compute='_compute_embed_code', sanitize=False)
     # views
     embedcount_ids = fields.One2many('slide.embed', 'slide_id', string="Embed Count")
     slide_views = fields.Integer('# of Website Views', store=True, compute="_compute_slide_views")
diff --git a/addons/website_slides/views/website_slides_templates_lesson.xml b/addons/website_slides/views/website_slides_templates_lesson.xml
index 8f64e5e9fd1..132a5375fc4 100644
--- a/addons/website_slides/views/website_slides_templates_lesson.xml
+++ b/addons/website_slides/views/website_slides_templates_lesson.xml
@@ -258,10 +258,10 @@
         <img t-if="slide.slide_type == 'infographic'"
             t-att-src="website.image_url(slide, 'image_1024')" class="img-fluid" style="width:100%" t-att-alt="slide.name"/>
         <div t-if="slide.slide_type in ('presentation', 'document')" class="embed-responsive embed-responsive-4by3 embed-responsive-item mb8" style="height: 600px;">
-            <t t-raw="slide.embed_code"/>
+            <t t-esc="slide.embed_code"/>
         </div>
         <div t-if="slide.slide_type == 'video' and slide.document_id" class="embed-responsive embed-responsive-16by9 embed-responsive-item mb8">
-            <t t-raw="slide.embed_code"/>
+            <t t-esc="slide.embed_code"/>
         </div>
         <div t-if="slide.slide_type == 'webpage'" class="bg-white p-3">
             <div t-field="slide.html_content"/>