From 3d777ad262a519657a117f2598d69f96efbd03df Mon Sep 17 00:00:00 2001 From: Nicolas Martinelli Date: Thu, 22 Dec 2016 17:46:59 +0100 Subject: [PATCH] [FIX] mail: escape canned responses Create a canned response containing the character "<". It is automatically converted into "<". The substitution field is systematically escaped, for security reason. This causes the substitution observed. However, the canned responses are only used in text-only messages. The escaping is therefore not necessary, since the HTML is not interpreted. opw-693970 --- addons/mail/models/mail_shortcode.py | 27 +-------------------------- 1 file changed, 1 insertion(+), 26 deletions(-) diff --git a/addons/mail/models/mail_shortcode.py b/addons/mail/models/mail_shortcode.py index 36624bc0b2b..780a5a746c8 100644 --- a/addons/mail/models/mail_shortcode.py +++ b/addons/mail/models/mail_shortcode.py @@ -1,10 +1,7 @@ # -*- coding: utf-8 -*- # Part of Odoo. See LICENSE file for full copyright and licensing details. -import cgi -import re - -from odoo import api, fields, models +from odoo import fields, models class MailShortcode(models.Model): @@ -23,25 +20,3 @@ class MailShortcode(models.Model): shortcode_type = fields.Selection([('image', 'Smiley'), ('text', 'Canned Response')], required=True, default='text', help="* Smiley are only used for HTML code to display an image "\ "* Text (default value) is used to substitute text with another text") - - @api.model - def create(self, values): - if values.get('substitution'): - values['substitution'] = self._sanitize_shorcode(values['substitution']) - return super(MailShortcode, self).create(values) - - @api.multi - def write(self, values): - if values.get('substitution'): - values['substitution'] = self._sanitize_shorcode(values['substitution']) - return super(MailShortcode, self).write(values) - - def _sanitize_shorcode(self, substitution): - """ Sanitize the shortcode substitution : - - HTML substitution : only allow the img tag (emoji) - - escape other substitutions to avoid XSS - """ - is_img_tag = re.match(r'''^$''', substitution, re.M | re.I) - if is_img_tag: - return substitution - return cgi.escape(substitution)