[FIX] web_editor: insert record name as text

Previously, the many2one widget from the web_editor used jQuery's
'.html()' method when inserting a record name into the page. The record
name was not HTML-escaped before this, which may have unexpect result
and break the layout.

This commit fixes that by using the '.text()' method instead.

This bug only affects pages containing a many2one (contact excluded)
at the time of selection and not after the selection.
e.g. on the /event page, changing the category of an existing event
via the website editor

closes odoo/odoo#65686

X-original-commit: 53aff7f07317a8261b8b9c3e462d930141c7081b
Signed-off-by: Martin Trigaux (mat) <mat@odoo.com>
This commit is contained in:
Samuel Degueldre
2021-02-08 09:04:12 +00:00
committed by Martin Trigaux
parent dd65f793e7
commit 5845bef12b
@@ -4721,7 +4721,7 @@ registry.many2one = SnippetOptionWidget.extend({
});
});
} else {
self.$target.html($li.data('name'));
self.$target.text($li.data('name'));
}
this._clear();