From 5845bef12bdbf375acd396fb6ebfbec12f34f064 Mon Sep 17 00:00:00 2001 From: Samuel Degueldre Date: Fri, 5 Feb 2021 12:24:15 +0000 Subject: [PATCH] [FIX] web_editor: insert record name as text Previously, the many2one widget from the web_editor used jQuery's '.html()' method when inserting a record name into the page. The record name was not HTML-escaped before this, which may have unexpect result and break the layout. This commit fixes that by using the '.text()' method instead. This bug only affects pages containing a many2one (contact excluded) at the time of selection and not after the selection. e.g. on the /event page, changing the category of an existing event via the website editor closes odoo/odoo#65686 X-original-commit: 53aff7f07317a8261b8b9c3e462d930141c7081b Signed-off-by: Martin Trigaux (mat) --- addons/web_editor/static/src/js/editor/snippets.options.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/addons/web_editor/static/src/js/editor/snippets.options.js b/addons/web_editor/static/src/js/editor/snippets.options.js index f04d2d3334c..09abf34ffa5 100644 --- a/addons/web_editor/static/src/js/editor/snippets.options.js +++ b/addons/web_editor/static/src/js/editor/snippets.options.js @@ -4721,7 +4721,7 @@ registry.many2one = SnippetOptionWidget.extend({ }); }); } else { - self.$target.html($li.data('name')); + self.$target.text($li.data('name')); } this._clear();