[FIX] mail: unescape channel name in discuss sidebar

When the user creates a channel by providing a name, the name is escaped
in order to avoid XSS attacks. As a result, the logic make use of escaped
string, which may be different from the provided string by the user.

As a result, if we do not unescape the string when necessary, the user may
see the escaped version. For instance, if we creates a channel named 'R&D',
it may display 'R&D' to the user.

This commit plays safe by still keeping the handling of channel names in
their escaped form, but unescape it just before displaying it on the sidebar
of the Discuss app to the user.

addons/mail/static/src/js/models/threads/abstract_thread.js

@@ -51,7 +51,8 @@ var AbstractThread = Class.extend({
      */
     getMessages: function () {},
     /**
-     * Get the name of this thread
+     * Get the name of this thread. If the name of the thread has been created
+     * by the user from an input, it may be escaped.
      *
      * @returns {string}
      */

addons/mail/static/src/xml/discuss.xml

@@ -143,7 +143,7 @@
                         </t>
                     </span>
                     <span t-if="displayHash" class="o_mail_hash">#</span>
-                    <t t-esc="thread.getName()"/>
+                    <t t-esc="_.unescape(thread.getName())"/>
                     <i t-if="thread.isMassMailing()" class="fa fa-envelope-o" title="Sends messages by email" role="img" aria-label="Send by mail"/>
                 </span>
                 <span t-attf-class="fa fa-cog o_mail_channel_settings"

addons/mail/static/tests/discuss_tests.js

@@ -102,6 +102,46 @@ QUnit.test('basic rendering', function (assert) {
     });
 });
 
+QUnit.test('unescape channel name in the sidebar', function (assert) {
+    // When the user creates a channel, the channel's name is escaped, this in
+    // order to prevent XSS attacks. However, the user should see visually the
+    // unescaped name of the channel. For instance, when the user creates a
+    // channel named  "R&D", he should see "R&D" and not "R&D".
+    assert.expect(2);
+    var done = assert.async();
+
+    this.data.initMessaging = {
+        channel_slots: {
+            channel_channel: [{
+                id: 1,
+                channel_type: "channel",
+                name: "R&D",
+            }],
+        },
+    };
+
+    createDiscuss({
+        id: 1,
+        context: {},
+        params: {},
+        data: this.data,
+        services: this.services,
+    })
+    .then(function (discuss) {
+        var $sidebar = discuss.$('.o_mail_discuss_sidebar');
+
+        var $channel = $sidebar.find('.o_mail_discuss_item[data-thread-id=1]');
+        assert.strictEqual($channel.length, 1,
+            "should have the channel item for channel 1 in the sidebar");
+        assert.strictEqual($channel.find('.o_thread_name').text().replace(/\s/g, ''),
+            "#R&D",
+            "should have unescaped channel name in the sidebar");
+
+        discuss.destroy();
+        done();
+    });
+});
+
 QUnit.test('@ mention in channel', function (assert) {
     assert.expect(34);
     var done = assert.async();