From 5664bda0f7bdc5e4800a030ae5b59560f61b8741 Mon Sep 17 00:00:00 2001
From: Leonardo Pavan Rocha <lpr@odoo.com>
Date: Tue, 19 Oct 2021 15:44:51 +0000
Subject: [PATCH] [FIX] base: use address_format in layout designer

In task-2355704 changes were made to the pdf layout designer to allow more
flexibility when setting company data. However, for the default values of both
company_details and report_footer, the data wasn't being escaped, therefore
offering security risks. Also, they didn't take into account the address_format
when computing the default value. This PR implements Markup usage in the html
fields and fixes _default_company_details to use the set address_format.

closes odoo/odoo#78725

X-original-commit: 83aeb8fbc3b2a4b39123f756232e34c1ce603299
Signed-off-by: Olivier Dony (odo) <odo@openerp.com>
---
 addons/web/models/base_document_layout.py | 26 ++++++++++++++++-------
 1 file changed, 18 insertions(+), 8 deletions(-)

diff --git a/addons/web/models/base_document_layout.py b/addons/web/models/base_document_layout.py
index cf9f069bde0..8a3668d20db 100644
--- a/addons/web/models/base_document_layout.py
+++ b/addons/web/models/base_document_layout.py
@@ -1,8 +1,10 @@
 # -*- coding: utf-8 -*-
 from PIL import Image
+from markupsafe import Markup
 
 from odoo import api, fields, models, tools
 
+from odoo.addons.base.models.ir_qweb_fields import nl2br
 from odoo.modules import get_resource_path
 
 try:
@@ -27,18 +29,26 @@ class BaseDocumentLayout(models.TransientModel):
     @api.model
     def _default_report_footer(self):
         company = self.env.company
-        footer_fields = filter(None, [company.phone, company.email, company.website, company.vat])
-        return ' '.join(footer_fields)
+        footer_fields = [field for field in [company.phone, company.email, company.website, company.vat] if isinstance(field, str) and len(field) > 0]
+        return Markup(' ').join(footer_fields)
 
     @api.model
     def _default_company_details(self):
         company = self.env.company
-        return (
-            f'{company.name}\n'
-            f'{company.street}\n'
-            f'{company.city} {company.state_id.name} {company.zip}\n'
-            f'{company.country_id.name}\n'
-        )
+        default_address_format = "%(company_name)s\n%(street)s\n%(city)s %(state_code)s %(zip)s\n%(country_name)s"
+        address_format = company.country_id.address_format or default_address_format
+        if 'company_name' not in address_format:
+            address_format = '%(company_name)s\n' + address_format
+        company_data = {
+            "company_name": company.name or "",
+            "street": company.street or "",
+            "street2": "",
+            "city": company.city or "",
+            "state_code": company.state_id.name or "",
+            "zip": company.zip or "",
+            "country_name": company.country_id.name or "",
+        }
+        return Markup(nl2br(address_format)) % company_data
 
     company_id = fields.Many2one(
         'res.company', default=lambda self: self.env.company, required=True)