From 40cf0f452a70c32ce348ce340641da7897ccbf05 Mon Sep 17 00:00:00 2001
From: Xavier Morel <xmo@odoo.com>
Date: Thu, 4 Mar 2021 14:10:22 +0000
Subject: [PATCH] [FIX] pad, pad_project: mark pad output as markup-safe

And remove the now unnecessary `t-raw` to embed it.
---
 addons/pad/models/pad.py                              | 3 ++-
 addons/pad_project/views/project_portal_templates.xml | 2 +-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/addons/pad/models/pad.py b/addons/pad/models/pad.py
index 45df365dc97..0393c9820b6 100644
--- a/addons/pad/models/pad.py
+++ b/addons/pad/models/pad.py
@@ -7,6 +7,7 @@ import re
 import string
 
 import requests
+from markupsafe import Markup
 
 from odoo import api, models, _
 from odoo.exceptions import UserError
@@ -99,7 +100,7 @@ class PadCommon(models.AbstractModel):
                     if mo:
                         content = mo.group(1)
 
-        return content
+        return Markup(content)
 
     # TODO
     # reverse engineer protocol to be setHtml without using the api key
diff --git a/addons/pad_project/views/project_portal_templates.xml b/addons/pad_project/views/project_portal_templates.xml
index 6981aaf1430..534e8fa2bf4 100644
--- a/addons/pad_project/views/project_portal_templates.xml
+++ b/addons/pad_project/views/project_portal_templates.xml
@@ -23,7 +23,7 @@
                     </div>
                 </t>
                 <t t-else="">
-                    <div class="py-1 px-2 bg-100 small" t-raw="task._get_pad_content()"/>
+                    <div class="py-1 px-2 bg-100 small" t-esc="task._get_pad_content()"/>
                 </t>
             </t>
             <t t-else="">