[FIX] web_editor: insert record name as text
Previously, the many2one widget from the web_editor used jQuery's '.html()' method when inserting a record name into the page. The record name was not HTML-escaped before this, which may have unexpect result and break the layout. This commit fixes that by using the '.text()' method instead. This bug only affects pages containing a many2one (contact excluded) at the time of selection and not after the selection. e.g. on the /event page, changing the category of an existing event via the website editor closes odoo/odoo#65686 X-original-commit: 53aff7f07317a8261b8b9c3e462d930141c7081b Signed-off-by: Martin Trigaux (mat) <mat@odoo.com>
This commit is contained in:
committed by
Martin Trigaux
parent
dd65f793e7
commit
5845bef12b
@@ -4721,7 +4721,7 @@ registry.many2one = SnippetOptionWidget.extend({
|
||||
});
|
||||
});
|
||||
} else {
|
||||
self.$target.html($li.data('name'));
|
||||
self.$target.text($li.data('name'));
|
||||
}
|
||||
|
||||
this._clear();
|
||||
|
||||
Reference in New Issue
Block a user