%s
" % Markup(_("Meeting scheduled at %(html_time)s
Subject: %(subject)s
Duration: %(duration)s")) % {
- 'html_time': Markup("") % {
- 'meeting_start': meeting.start,
- 'meeting_user_time': meeting_usertime,
- },
- 'subject': meeting._get_html_link(), # Already Markup valid
- 'duration': duration,
+ meeting_usertime = fields.Datetime.to_string(fields.Datetime.context_timestamp(self, meeting.start))
+ meeting_time = Markup("") % {
+ 'meeting_start': meeting.start,
+ 'meeting_user_time': meeting_usertime,
+ }
+ message = Markup("
%(meeting)s
%(subject_string)s %(subject_link)s
%(duration)s
") % {
+ 'meeting': escape(_("Meeting scheduled at %s")) % meeting_time,
+ 'subject_string': _("Subject: "),
+ 'subject_link': meeting._get_html_link(),
+ 'duration': _("Duration: %s", duration),
}
return self.message_post(body=message)
diff --git a/addons/crm/models/crm_team.py b/addons/crm/models/crm_team.py
index 5dae56e7b90..1223a4b7d90 100644
--- a/addons/crm/models/crm_team.py
+++ b/addons/crm/models/crm_team.py
@@ -7,6 +7,7 @@ import random
import threading
from ast import literal_eval
+from markupsafe import Markup
from odoo import api, exceptions, fields, models, _
from odoo.osv import expression
@@ -263,13 +264,13 @@ class Team(models.Model):
# format result messages
logs = self._action_assign_leads_logs(teams_data, members_data)
- html_message = '
'.join(logs)
+ html_message = Markup('
').join(logs)
notif_message = ' '.join(logs)
# log a note in case of manual assign (as this method will mainly be called
# on singleton record set, do not bother doing a specific message per team)
log_action = _("Lead Assignment requested by %(user_name)s", user_name=self.env.user.name)
- log_message = "
%s
%s
%s
%s
%s:
%s%s:
%s%(message)s:
- %(booth_names)s
%(message)s:
- %(booth_names)s
Reward (badge %(badge_name)s) for every succeeding user was sent to %(users)s.", + message_body += Markup("
") + _( + "Reward (badge %(badge_name)s) for every succeeding user was sent to %(users)s.", badge_name=challenge.reward_id.name, users=", ".join(name for (user_id, name) in user_names) ) else: - message_body += _("
Nobody has succeeded to reach every goal, no badge is rewarded for this challenge.") + message_body += Markup("
") + _("Nobody has succeeded to reach every goal, no badge is rewarded for this challenge.") # reward bests - reward_message = _("
%(rank)d. %(user_name)s - %(reward_name)s") + reward_message = Markup("
%(rank)d. %(user_name)s - %(reward_name)s") if challenge.reward_first_id: (first_user, second_user, third_user) = challenge._get_topN_users(MAX_VISIBILITY_RANKING) if first_user: challenge._reward_user(first_user, challenge.reward_first_id) - message_body += _("
Special rewards were sent to the top competing users. The ranking for this challenge is:") + message_body += Markup("
") + _("Special rewards were sent to the top competing users. The ranking for this challenge is:") message_body += reward_message % { 'rank': 1, 'user_name': first_user.name, diff --git a/addons/google_calendar/models/google_sync.py b/addons/google_calendar/models/google_sync.py index da97e3151a3..17c8b7dbbe6 100644 --- a/addons/google_calendar/models/google_sync.py +++ b/addons/google_calendar/models/google_sync.py @@ -7,6 +7,7 @@ from functools import wraps from requests import HTTPError import pytz from dateutil.parser import parse +from markupsafe import Markup from odoo import api, fields, models, registry, _ from odoo.tools import ormcache_context, email_normalize @@ -210,10 +211,9 @@ class GoogleSync(models.AbstractModel): 'reason': reason} _logger.error(error_log) - body = _( - "The following event could not be synced with Google Calendar. " - "It will not be synced as long at it is not updated." - "%(reason)s", reason=reason) + body = _("The following event could not be synced with Google Calendar.") + Markup("
") + \ + _("It will not be synced as long at it is not updated.") + Markup("
") + \ + reason if event: event.message_post( diff --git a/addons/hr/models/hr_employee.py b/addons/hr/models/hr_employee.py index 28b4ee3d217..9a03ec1ed09 100644 --- a/addons/hr/models/hr_employee.py +++ b/addons/hr/models/hr_employee.py @@ -8,6 +8,7 @@ from random import choice from string import digits from werkzeug.urls import url_encode from dateutil.relativedelta import relativedelta +from markupsafe import Markup from odoo import api, fields, models, _ from odoo.exceptions import ValidationError, AccessError @@ -367,10 +368,9 @@ class HrEmployeePrivate(models.Model): 'active_model': 'hr.employee', 'menu_id': hr_root_menu.id, }) - onboarding_notes_bodies[employee.id] = _( + onboarding_notes_bodies[employee.id] = Markup(_( 'Congratulations! May I recommend you to setup an onboarding plan?', - url, - ) + )) % url employees._message_log_batch(onboarding_notes_bodies) return employees diff --git a/addons/hr/wizard/hr_plan_wizard.py b/addons/hr/wizard/hr_plan_wizard.py index 82ce4f4e1fc..c15063d05a4 100644 --- a/addons/hr/wizard/hr_plan_wizard.py +++ b/addons/hr/wizard/hr_plan_wizard.py @@ -1,6 +1,8 @@ # -*- coding: utf-8 -*- # Part of Odoo. See LICENSE file for full copyright and licensing details. +from markupsafe import Markup + from odoo import api, fields, models, _ from odoo.exceptions import ValidationError @@ -94,10 +96,10 @@ class HrPlanWizard(models.TransientModel): activities.add(activity) if activities: - body += '
- '
+ body += Markup('
- %s ' % activity - body += '
- %s ') % activity + body += Markup('
- ')
for activity in activities:
- body += '
%s
' % content + content = escape(_('The survey %(survey_link)s has been sent to %(partner_link)s')) % { + 'survey_link': survey_link, + 'partner_link': partner_link, + } + body = Markup('%s
') % content self.applicant_id.message_post(body=body) return super().action_invite() diff --git a/addons/hr_skills_slides/models/slide_channel.py b/addons/hr_skills_slides/models/slide_channel.py index 48f56b240cf..ecfdb40ed93 100644 --- a/addons/hr_skills_slides/models/slide_channel.py +++ b/addons/hr_skills_slides/models/slide_channel.py @@ -1,6 +1,8 @@ # -*- coding: utf-8 -*- # Part of Odoo. See LICENSE file for full copyright and licensing details. +from markupsafe import Markup, escape + from odoo import fields, models, _ from odoo.tools import html2plaintext @@ -48,9 +50,11 @@ class SlideChannelPartner(models.Model): super()._send_completed_mail() for scp in self: if self.env.user.employee_ids: - msg = _('The employee has completed the course %(course)s', - link=scp.channel_id.website_url, - course=scp.channel_id.name) + msg = escape(_('The employee has completed the course %s')) % \ + Markup('%(course)s') % { + 'link': scp.channel_id.website_url, + 'course': scp.channel_id.name, + } self.env.user.employee_id.message_post(body=msg) class Channel(models.Model): @@ -60,7 +64,10 @@ class Channel(models.Model): res = super()._action_add_members(target_partners) for channel in self: channel._message_employee_chatter( - _('The employee subscribed to the course %(course)s', link=channel.website_url, course=channel.name), + Markup(_('The employee subscribed to the course %(course)s')) % { + 'link': channel.website_url, + 'course': channel.name, + }, target_partners) return res @@ -71,7 +78,10 @@ class Channel(models.Model): for channel in self: channel._message_employee_chatter( - _('The employee left the course %(course)s', link=channel.website_url, course=channel.name), + Markup(_('The employee left the course %(course)s')) % { + 'link': channel.website_url, + 'course': channel.name, + }, partners) return res diff --git a/addons/im_livechat/tests/test_message.py b/addons/im_livechat/tests/test_message.py index 16dd79de8e4..57c2d560946 100644 --- a/addons/im_livechat/tests/test_message.py +++ b/addons/im_livechat/tests/test_message.py @@ -1,6 +1,8 @@ # -*- coding: utf-8 -*- # Part of Odoo. See LICENSE file for full copyright and licensing details. +from markupsafe import Markup + from odoo import Command from odoo.tests.common import users, tagged, TransactionCase @@ -39,7 +41,7 @@ class TestImLivechatMessage(TransactionCase): }) message = channel_livechat_1.message_post( author_id=record_rating.partner_id.id, - body="Try typing : to use canned responses.") + return Markup(_("That's me! 🎉
Try typing %s to use canned responses.", ":")) elif odoobot_state == "onboarding_canned" and values.get("canned_response_ids"): self.env.user.odoobot_failed = False self.env.user.odoobot_state = "idle" - return _("Good, you can customize canned responses in the live chat application.
It's the end of this overview, enjoy discovering Odoo!") + return Markup(_("Good, you can customize canned responses in the live chat application.
It's the end of this overview, enjoy discovering Odoo!")) # repeat question if needed elif odoobot_state == 'onboarding_canned' and not self._is_help_requested(body): self.env.user.odoobot_failed = True - return _("Not sure what you are doing. Please, type : and wait for the propositions. Select one of them and press enter.") + return escape(_("Not sure what you are doing. Please, type %s and wait for the propositions. Select one of them and press enter.")) % \ + Markup(":") return super(MailBot, self)._get_answer(record, body, values, command) diff --git a/addons/l10n_in_edi/models/account_edi_format.py b/addons/l10n_in_edi/models/account_edi_format.py index 4cf4e0ebb4d..ce67dcb1a8d 100644 --- a/addons/l10n_in_edi/models/account_edi_format.py +++ b/addons/l10n_in_edi/models/account_edi_format.py @@ -7,6 +7,7 @@ import pytz import markupsafe from collections import defaultdict +from markupsafe import Markup from odoo import models, fields, api, _ from odoo.tools import html_escape, float_is_zero, float_compare @@ -125,12 +126,12 @@ class AccountEdiFormat(models.Model): if not response.get("error"): error = [] odoobot = self.env.ref("base.partner_root") - invoice.message_post(author_id=odoobot.id, body=_( + invoice.message_post(author_id=odoobot.id, body=Markup(_( "Somehow this invoice had been submited to government before." \ "
Normally, this should not happen too often" \ "
Just verify value of invoice by uploade json to government website " \ "here." - )) + ))) if "no-credit" in error_codes: return {invoice: { "success": False, @@ -180,12 +181,12 @@ class AccountEdiFormat(models.Model): if "9999" in error_codes: response = {} odoobot = self.env.ref("base.partner_root") - invoice.message_post(author_id=odoobot.id, body=_( + invoice.message_post(author_id=odoobot.id, body=Markup(_( "Somehow this invoice had been cancelled to government before." \ "
Normally, this should not happen too often" \ "
Just verify by logging into government website " \ "here." - )) + ))) if "no-credit" in error_codes: return {invoice: { "success": False, diff --git a/addons/l10n_in_edi_ewaybill/models/account_edi_format.py b/addons/l10n_in_edi_ewaybill/models/account_edi_format.py index e003497d4d8..572d17c6baa 100755 --- a/addons/l10n_in_edi_ewaybill/models/account_edi_format.py +++ b/addons/l10n_in_edi_ewaybill/models/account_edi_format.py @@ -4,6 +4,7 @@ import re import json from datetime import timedelta +from markupsafe import Markup from odoo import models, fields, api, _ from odoo.tools import html_escape @@ -150,12 +151,12 @@ class AccountEdiFormat(models.Model): if "312" in error_codes: # E-waybill is already canceled # this happens when timeout from the Government portal but IRN is generated - error_message = "
".join(["[%s] %s" % (e.get("code"), html_escape(e.get("message") or self._l10n_in_edi_ewaybill_get_error_message(e.get('code')))) for e in error]) + error_message = Markup("
").join([Markup("[%s] %s") % (e.get("code"), e.get("message") or self._l10n_in_edi_ewaybill_get_error_message(e.get('code'))) for e in error]) error = [] response = {"data": ""} odoobot = self.env.ref("base.partner_root") invoices.message_post(author_id=odoobot.id, body= - "%s
%s:
%s" %( + Markup("%s
%s:
%s") %( _("Somehow this E-waybill has been canceled in the government portal before. You can verify by checking the details into the government (https://ewaybillgst.gov.in/Others/EBPrintnew.asp)"), _("Error"), error_message @@ -168,7 +169,7 @@ class AccountEdiFormat(models.Model): "blocking_level": "error", } elif error: - error_message = "
".join(["[%s] %s" % (e.get("code"), html_escape(e.get("message") or self._l10n_in_edi_ewaybill_get_error_message(e.get('code')))) for e in error]) + error_message = Markup("
").join([Markup("[%s] %s") % (e.get("code"), e.get("message") or self._l10n_in_edi_ewaybill_get_error_message(e.get('code'))) for e in error]) blocking_level = "error" if "404" in error_codes: blocking_level = "warning" diff --git a/addons/l10n_it_edi/models/account_invoice.py b/addons/l10n_it_edi/models/account_invoice.py index 6a0418e87c9..10e53b67d21 100644 --- a/addons/l10n_it_edi/models/account_invoice.py +++ b/addons/l10n_it_edi/models/account_invoice.py @@ -7,6 +7,7 @@ import logging import re from datetime import datetime +from markupsafe import escape from odoo import api, fields, models, _ from odoo.tools import float_repr, float_compare @@ -352,7 +353,7 @@ class AccountMove(models.Model): }) with other_invoice._get_edi_creation() as other_invoice: self.env['account.edi.format']._import_fattura_pa(tree, other_invoice) - other_invoice.message_post(body=_("Created from attachment in %s", invoice._get_html_link())) + other_invoice.message_post(body=escape(_("Created from attachment in %s")) % invoice._get_html_link()) return True diff --git a/addons/mail/controllers/discuss.py b/addons/mail/controllers/discuss.py index 182786efcf3..5c66bd2f939 100644 --- a/addons/mail/controllers/discuss.py +++ b/addons/mail/controllers/discuss.py @@ -3,6 +3,7 @@ from collections import defaultdict from datetime import datetime, timedelta +from markupsafe import Markup from psycopg2 import IntegrityError from psycopg2.errorcodes import UNIQUE_VIOLATION @@ -238,6 +239,8 @@ class DiscussController(http.Controller): thread = channel_member_sudo.channel_id else: thread = request.env[thread_model].browse(int(thread_id)).exists() + if 'body' in post_data: + post_data['body'] = Markup(post_data['body']) # contains HTML such as @mentions message_data = thread.message_post(**{key: value for key, value in post_data.items() if key in self._get_allowed_message_post_params()}).message_format()[0] if 'temporary_id' in request.context: message_data['temporary_id'] = request.context['temporary_id'] diff --git a/addons/mail/models/mail_channel.py b/addons/mail/models/mail_channel.py index a8a66035d45..f93efd63670 100644 --- a/addons/mail/models/mail_channel.py +++ b/addons/mail/models/mail_channel.py @@ -5,6 +5,7 @@ import base64 import logging from collections import defaultdict from hashlib import sha512 +from markupsafe import Markup from secrets import choice from markupsafe import Markup @@ -315,7 +316,7 @@ class Channel(models.Model): # channel_info is called before actually unpinning the channel channel_info['is_pinned'] = False self.env['bus.bus']._sendone(partner, 'mail.channel/leave', channel_info) - notification = _('
left the channel
')
+ notification = Markup('%s
') % _('left the channel')
# post 'channel left' message as root since the partner just unsubscribed from the channel
self.sudo().message_post(body=notification, subtype_xmlid="mail.mt_comment", author_id=partner.id)
self.env['bus.bus']._sendone(self, 'mail.record/insert', {
@@ -387,15 +388,13 @@ class Channel(models.Model):
if post_joined_message:
# notify existing members with a new message in the channel
if member.partner_id == self.env.user.partner_id:
- notification = _('joined the channel
')
+ notification = Markup('%s
') % _('joined the channel')
else:
- notification = _(
- 'invited %s to the channel
',
- member.partner_id._get_html_link(),
- )
+ notification = (Markup('%s
') % _("invited %s to the channel")) % member.partner_id._get_html_link()
member.channel_id.message_post(body=notification, message_type="notification", subtype_xmlid="mail.mt_comment")
for member in new_members.filtered(lambda member: member.guest_id):
- member.channel_id.message_post(body=_('joined the channel
'), message_type="notification", subtype_xmlid="mail.mt_comment")
+ member.channel_id.message_post(body=Markup('%s
') % _('joined the channel'),
+ message_type="notification", subtype_xmlid="mail.mt_comment")
guest = member.guest_id
if guest:
notifications.append((guest, 'mail.channel/joined', {
@@ -1135,7 +1134,9 @@ class Channel(models.Model):
new_channel = self.create(vals)
group = self.env['res.groups'].search([('id', '=', group_id)]) if group_id else None
new_channel.group_public_id = group.id if group else None
- notification = _('created #%s
', new_channel.id, new_channel.name)
+ notification = (Markup('%s
') % _("created %(link)s")) % {
+ 'link': Markup('#%s') % (new_channel.id, new_channel.name)
+ }
new_channel.message_post(body=notification, message_type="notification", subtype_xmlid="mail.mt_comment")
channel_info = new_channel.channel_info()[0]
self.env['bus.bus']._sendone(self.env.user.partner_id, 'mail.channel/legacy_insert', channel_info)
diff --git a/addons/mail/models/mail_thread.py b/addons/mail/models/mail_thread.py
index 219294838c8..99cd2c801bf 100644
--- a/addons/mail/models/mail_thread.py
+++ b/addons/mail/models/mail_thread.py
@@ -23,7 +23,7 @@ from email import message_from_string
from lxml import etree
from werkzeug import urls
from xmlrpc import client as xmlrpclib
-from markupsafe import Markup
+from markupsafe import Markup, escape
from odoo import _, api, exceptions, fields, models, tools, registry, SUPERUSER_ID, Command
from odoo.exceptions import MissingError, AccessError
@@ -1353,7 +1353,7 @@ class MailThread(models.AbstractModel):
for node in to_remove:
node.getparent().remove(node)
if postprocessed:
- body = etree.tostring(root, pretty_print=False, encoding='unicode')
+ body = Markup(etree.tostring(root, pretty_print=False, encoding='unicode'))
return {'body': body, 'attachments': attachments}
def _message_parse_extract_payload(self, message, message_dict, save_original=False):
@@ -2023,7 +2023,7 @@ class MailThread(models.AbstractModel):
'model': self._name,
'res_id': self.id,
# content
- 'body': body,
+ 'body': escape(body), # escape if text, keep if markup
'message_type': message_type,
'parent_id': self._message_compute_parent_id(parent_id),
'subject': subject or False,
@@ -2485,7 +2485,7 @@ class MailThread(models.AbstractModel):
'record_name': False,
'res_id': self.id if self else res_id,
# content
- 'body': body,
+ 'body': escape(body), # escape if text, keep if markup
'is_internal': True,
'message_type': 'user_notification',
'subject': subject,
@@ -2601,7 +2601,7 @@ class MailThread(models.AbstractModel):
values_list = [dict(base_message_values,
res_id=record.id,
- body=bodies.get(record.id, ''))
+ body=escape(bodies.get(record.id, '')))
for record in self]
return self.sudo()._message_create(values_list)
diff --git a/addons/mail/tests/test_res_partner.py b/addons/mail/tests/test_res_partner.py
index 0590df65092..9096320df00 100644
--- a/addons/mail/tests/test_res_partner.py
+++ b/addons/mail/tests/test_res_partner.py
@@ -2,6 +2,7 @@
# Part of Odoo. See LICENSE file for full copyright and licensing details.
from contextlib import contextmanager
+from markupsafe import Markup
from unittest.mock import patch
from uuid import uuid4
@@ -407,7 +408,7 @@ class TestPartner(MailCommon):
p1.message_subscribe(partner_ids=p3.ids)
p1_act1 = p1.activity_schedule(act_type_xmlid='mail.mail_activity_data_todo')
p1_msg1 = p1.message_post(
- body='Log on P1
', + body=Markup('Log on P1
'), subtype_id=self.env.ref('mail.mt_comment').id ) self.assertEqual(p1.activity_ids, p1_act1) diff --git a/addons/mail_bot/models/mail_bot.py b/addons/mail_bot/models/mail_bot.py index 50ad2db6154..97344eb242c 100644 --- a/addons/mail_bot/models/mail_bot.py +++ b/addons/mail_bot/models/mail_bot.py @@ -4,9 +4,9 @@ import itertools import random +from markupsafe import Markup from odoo import models, _ - class MailBot(models.AbstractModel): _name = 'mail.bot' _description = 'Mail Bot' @@ -40,19 +40,19 @@ class MailBot(models.AbstractModel): if odoobot_state == 'onboarding_emoji' and self._body_contains_emoji(body): self.env.user.odoobot_state = "onboarding_command" self.env.user.odoobot_failed = False - return _("Great! 👍To access special commands, start your sentence with /. Try getting help.") + return Markup(_("Great! 👍
To access special commands, start your sentence with /. Try getting help.")) elif odoobot_state == 'onboarding_command' and command == 'help': self.env.user.odoobot_state = "onboarding_ping" self.env.user.odoobot_failed = False - return _("Wow you are a natural!
Ping someone with @username to grab their attention. Try to ping me using @OdooBot in a sentence.") + return Markup(_("Wow you are a natural!
Ping someone with @username to grab their attention. Try to ping me using @OdooBot in a sentence.")) elif odoobot_state == 'onboarding_ping' and self._is_bot_pinged(values): self.env.user.odoobot_state = "onboarding_attachement" self.env.user.odoobot_failed = False - return _("Yep, I am here! 🎉
Now, try sending an attachment, like a picture of your cute dog...") + return Markup(_("Yep, I am here! 🎉
Now, try sending an attachment, like a picture of your cute dog...")) elif odoobot_state == 'onboarding_attachement' and values.get("attachment_ids"): self.env.user.odoobot_state = "idle" self.env.user.odoobot_failed = False - return _("I am a simple bot, but if that's a dog, he is the cutest 😊
Congratulations, you finished this tour. You can now close this chat window. Enjoy discovering Odoo.") + return Markup(_("I am a simple bot, but if that's a dog, he is the cutest 😊
Congratulations, you finished this tour. You can now close this chat window. Enjoy discovering Odoo.")) elif odoobot_state in (False, "idle", "not_initialized") and (_('start the tour') in body.lower()): self.env.user.odoobot_state = "onboarding_emoji" return _("To start, try to send me an emoji :)") @@ -63,28 +63,28 @@ class MailBot(models.AbstractModel): return _("That's not nice! I'm a bot but I have feelings... 💔") # help message elif self._is_help_requested(body) or odoobot_state == 'idle': - return _("Unfortunately, I'm just a bot 😞 I don't understand! If you need help discovering our product, please check " + return Markup(_("Unfortunately, I'm just a bot 😞 I don't understand! If you need help discovering our product, please check " "our documentation or " - "our videos.") + "our videos.")) else: # repeat question if odoobot_state == 'onboarding_emoji': self.env.user.odoobot_failed = True - return _("Not exactly. To continue the tour, send an emoji: type :) and press enter.") + return Markup(_("Not exactly. To continue the tour, send an emoji: type :) and press enter.")) elif odoobot_state == 'onboarding_attachement': self.env.user.odoobot_failed = True - return _("To send an attachment, click on the icon and select a file.") + return Markup(_("To send an attachment, click on the icon and select a file.")) elif odoobot_state == 'onboarding_command': self.env.user.odoobot_failed = True - return _("Not sure what you are doing. Please, type / and wait for the propositions. Select help and press enter") + return Markup(_("Not sure what you are doing. Please, type / and wait for the propositions. Select help and press enter")) elif odoobot_state == 'onboarding_ping': self.env.user.odoobot_failed = True - return _("Sorry, I am not listening. To get someone's attention, ping him. Write @OdooBot and select me.") + return Markup(_("Sorry, I am not listening. To get someone's attention, ping him. Write @OdooBot and select me.")) return random.choice([ - _("I'm not smart enough to answer your question.
To follow my guide, ask: start the tour."), + Markup(_("I'm not smart enough to answer your question.
To follow my guide, ask: start the tour.")), _("Hmmm..."), _("I'm afraid I don't understand. Sorry!"), - _("Sorry I'm sleepy. Or not! Maybe I'm just trying to hide my unawareness of human language...
I can show you features if you write: start the tour.") + Markup(_("Sorry I'm sleepy. Or not! Maybe I'm just trying to hide my unawareness of human language...
I can show you features if you write: start the tour.")) ]) return False diff --git a/addons/mail_bot/models/res_users.py b/addons/mail_bot/models/res_users.py index b9bb935ee71..293c2aa69ec 100644 --- a/addons/mail_bot/models/res_users.py +++ b/addons/mail_bot/models/res_users.py @@ -1,6 +1,8 @@ # -*- coding: utf-8 -*- # Part of Odoo. See LICENSE file for full copyright and licensing details. +from markupsafe import Markup + from odoo import models, fields, _ class Users(models.Model): @@ -32,7 +34,11 @@ class Users(models.Model): odoobot_id = self.env['ir.model.data']._xmlid_to_res_id("base.partner_root") channel_info = self.env['mail.channel'].channel_get([odoobot_id, self.partner_id.id]) channel = self.env['mail.channel'].browse(channel_info['id']) - message = _("Hello,
Odoo's chat helps employees collaborate efficiently. I'm here to help you discover its features.
Try to send me an emoji :)") + message = Markup("%s
%s
%s :)") % ( + _("Hello,"), + _("Odoo's chat helps employees collaborate efficiently. I'm here to help you discover its features."), + _("Try to send me an emoji") + ) channel.sudo().message_post(body=message, author_id=odoobot_id, message_type="comment", subtype_xmlid="mail.mt_comment") self.sudo().odoobot_state = 'onboarding_emoji' return channel diff --git a/addons/maintenance/models/maintenance.py b/addons/maintenance/models/maintenance.py index 3932e348300..2d5cce39fb5 100644 --- a/addons/maintenance/models/maintenance.py +++ b/addons/maintenance/models/maintenance.py @@ -3,6 +3,7 @@ import ast from datetime import date, datetime, timedelta +from markupsafe import escape from odoo import api, fields, models, SUPERUSER_ID, _ from odoo.exceptions import UserError @@ -386,10 +387,7 @@ class MaintenanceRequest(models.Model): new_user_id=request.user_id.id or request.owner_user_id.id or self.env.uid) if not updated: if request.equipment_id: - note = _( - 'Request planned for %s', - request.equipment_id._get_html_link() - ) + note = escape(_('Request planned for %s')) % request.equipment_id._get_html_link() else: note = False request.activity_schedule( diff --git a/addons/mass_mailing/models/mailing.py b/addons/mass_mailing/models/mailing.py index 91b43a264a4..2ac07c3c815 100644 --- a/addons/mass_mailing/models/mailing.py +++ b/addons/mass_mailing/models/mailing.py @@ -780,8 +780,8 @@ class MassMailing(models.Model): ]) opt_out_records.write({'opt_out': value}) - message = _('The recipient unsubscribed from %s mailing list(s)') \ - if value else _('The recipient subscribed to %s mailing list(s)') + message = Markup(_('The recipient unsubscribed from %s mailing list(s)')) \ + if value else Markup(_('The recipient subscribed to %s mailing list(s)')) for record in records: # filter the list_id by record record_lists = opt_out_records.filtered(lambda rec: rec.contact_id.id == record.id) diff --git a/addons/mass_mailing/wizard/mailing_mailing_test.py b/addons/mass_mailing/wizard/mailing_mailing_test.py index b00684fb8c6..5df68d198bd 100644 --- a/addons/mass_mailing/wizard/mailing_mailing_test.py +++ b/addons/mass_mailing/wizard/mailing_mailing_test.py @@ -77,17 +77,16 @@ class TestMassMailing(models.TransientModel): _('Test mailing successfully sent to %s', mail_sudo.email_to)) elif mail_sudo.state == 'exception': notification_messages.append( - _('Test mailing could not be sent to %s:
%s', - mail_sudo.email_to, - mail_sudo.failure_reason) + _('Test mailing could not be sent to %s:', mail_sudo.email_to) + + (Markup("
") + mail_sudo.failure_reason) ) # manually delete the emails since we passed 'auto_delete: False' mails_sudo.unlink() if notification_messages: - self.mass_mailing_id._message_log(body='
- %s
- %s
- %s
- %s
" + _("Error: %s", self.state_message) + message += Markup("
") + _("Error: %s", self.state_message) else: message = _( ("The transaction with reference %(ref)s for %(amount)s is canceled " @@ -1119,7 +1120,7 @@ class PaymentTransaction(models.Model): provider_name=self.provider_id.name ) if self.state_message: - message += "
" + _("Reason: %s", self.state_message) + message += Markup("
") + _("Reason: %s", self.state_message) return message def _get_last(self): diff --git a/addons/point_of_sale/models/pos_order.py b/addons/point_of_sale/models/pos_order.py index 06f7d92c4ad..746f4843834 100644 --- a/addons/point_of_sale/models/pos_order.py +++ b/addons/point_of_sale/models/pos_order.py @@ -6,6 +6,7 @@ from markupsafe import Markup from functools import partial from itertools import groupby from collections import defaultdict +from markupsafe import escape import psycopg2 import pytz @@ -501,10 +502,9 @@ class PosOrder(models.Model): def _create_invoice(self, move_vals): self.ensure_one() new_move = self.env['account.move'].sudo().with_company(self.company_id).with_context(default_move_type=move_vals['move_type']).create(move_vals) - message = _( - "This invoice has been created from the point of sale session: %s", - self._get_html_link(), - ) + message = escape(_("This invoice has been created from the point of sale session: %s")) % \ + self._get_html_link() + new_move.message_post(body=message) if self.config_id.cash_rounding: rounding_applied = float_round(self.amount_paid - self.amount_total, diff --git a/addons/point_of_sale/models/pos_session.py b/addons/point_of_sale/models/pos_session.py index 851d712cf21..fef7720f3f9 100644 --- a/addons/point_of_sale/models/pos_session.py +++ b/addons/point_of_sale/models/pos_session.py @@ -4,6 +4,7 @@ from collections import defaultdict from datetime import timedelta from itertools import groupby +from markupsafe import Markup from odoo import api, fields, models, _, Command from odoo.exceptions import AccessError, UserError, ValidationError @@ -1500,7 +1501,7 @@ class PosSession(models.Model): f"{self.currency_id.round(difference)} " \ f"{self.currency_id.symbol if self.currency_id.position == 'after' else ''}
" if notes: - message += notes.replace('\n', '
') + message += notes.replace('\n', Markup('
')) if message: self.message_post(body=message) @@ -1563,7 +1564,7 @@ class PosSession(models.Model): message_content = [f"Cash {extras['translatedType']}", f'- Amount: {extras["formattedAmount"]}'] if reason: message_content.append(f'- Reason: {reason}') - self.message_post(body='
\n'.join(message_content)) + self.message_post(body=Markup('
\n').join(message_content)) def get_onboarding_data(self): return { diff --git a/addons/purchase/models/account_invoice.py b/addons/purchase/models/account_invoice.py index 1feb1badfd1..2f6bdd4f81e 100644 --- a/addons/purchase/models/account_invoice.py +++ b/addons/purchase/models/account_invoice.py @@ -3,6 +3,7 @@ import difflib import logging import time +from markupsafe import escape from odoo import api, fields, models, Command, _ @@ -130,7 +131,7 @@ class AccountMove(models.Model): if not purchases: continue refs = [purchase._get_html_link() for purchase in purchases] - message = _("This vendor bill has been created from: %s") % ','.join(refs) + message = escape(_("This vendor bill has been created from: %s")) % ','.join(refs) move.message_post(body=message) return moves @@ -145,7 +146,7 @@ class AccountMove(models.Model): diff_purchases = new_purchases - old_purchases[i] if diff_purchases: refs = [purchase._get_html_link() for purchase in diff_purchases] - message = _("This vendor bill has been modified from: %s") % ','.join(refs) + message = escape(_("This vendor bill has been modified from: %s")) % ','.join(refs) move.message_post(body=message) return res diff --git a/addons/sale/models/sale_order.py b/addons/sale/models/sale_order.py index 5281d3ec80b..7f1619c0f0b 100644 --- a/addons/sale/models/sale_order.py +++ b/addons/sale/models/sale_order.py @@ -3,7 +3,7 @@ from datetime import timedelta from itertools import groupby -from markupsafe import Markup +from markupsafe import escape from odoo import api, fields, models, SUPERUSER_ID, _ from odoo.exceptions import AccessError, UserError, ValidationError @@ -989,10 +989,9 @@ class SaleOrder(models.Model): self.show_update_fpos = False if self.partner_id: - self.message_post(body=_( - "Product taxes have been recomputed according to fiscal position %s.", + self.message_post(body=escape(_("Product taxes have been recomputed according to fiscal position %s.")) % \ self.fiscal_position_id._get_html_link() if self.fiscal_position_id else "", - )) + ) def action_update_prices(self): self.ensure_one() @@ -1000,10 +999,8 @@ class SaleOrder(models.Model): self._recompute_prices() if self.pricelist_id: - message = _( - "Product prices have been recomputed according to pricelist %s.", - self.pricelist_id._get_html_link(), - ) + message = escape(_("Product prices have been recomputed according to pricelist %s.")) % \ + self.pricelist_id._get_html_link() else: message = _("Product prices have been recomputed.") self.message_post(body=message) @@ -1508,7 +1505,7 @@ class SaleOrder(models.Model): order.activity_schedule( 'sale.mail_act_sale_upsell', user_id=order.user_id.id or order.partner_id.user_id.id, - note=_("Upsell %(order)s for customer %(customer)s", order=order_ref, customer=customer_ref)) + note=escape(_("Upsell %(order)s for customer %(customer)s")) % {"order":order_ref, "customer":customer_ref}) def _prepare_analytic_account_data(self, prefix=None): """ Prepare SO analytic account creation values. diff --git a/addons/sale/models/sale_order_line.py b/addons/sale/models/sale_order_line.py index b5bb9c1c334..d8c3e0dacc8 100644 --- a/addons/sale/models/sale_order_line.py +++ b/addons/sale/models/sale_order_line.py @@ -3,6 +3,7 @@ from collections import defaultdict from datetime import timedelta +from markupsafe import Markup from odoo import api, fields, models, _ from odoo.exceptions import UserError @@ -1017,18 +1018,18 @@ class SaleOrderLine(models.Model): orders = self.mapped('order_id') for order in orders: order_lines = self.filtered(lambda x: x.order_id == order) - msg = "" + _("The ordered quantity has been updated.") + "
- "
+ msg = Markup("%s
- %s:
" % line.product_id.display_name + msg += Markup(" - %s:
") % line.product_id.display_name msg += _( "Ordered Quantity: %(old_qty)s -> %(new_qty)s", old_qty=line.product_uom_qty, new_qty=values["product_uom_qty"] - ) + "
" + ) + Markup("
") if line.product_id.type in ('consu', 'product'): - msg += _("Delivered Quantity: %s", line.qty_delivered) + "
" - msg += _("Invoiced Quantity: %s", line.qty_invoiced) + "
" - msg += "
- ") % _("The ordered quantity has been updated.")
for line in order_lines:
- msg += "
") + msg += _("Invoiced Quantity: %s", line.qty_invoiced) + Markup("
") + msg += Markup("
Cost: %(price).2f %(currency)s", - carrier_name=self.carrier_id.name, - ref=self.carrier_tracking_ref, - price=self.carrier_price, - currency=order_currency.name - ) + msg = _("Shipment sent to carrier %(carrier_name)s for shipping with tracking number %(ref)s", + carrier_name=self.carrier_id.name, + ref=self.carrier_tracking_ref) + \ + Markup("
") + \ + _("Cost: %(price).2f %(currency)s", + price=self.carrier_price, + currency=order_currency.name) self.message_post(body=msg) self._add_delivery_cost_to_so() @@ -234,9 +235,9 @@ class StockPicking(models.Model): except ValueError: carrier_trackers = self.carrier_tracking_url else: - msg = "Tracking links for shipment:
" + msg = _("Tracking links for shipment:") + Markup("
") for tracker in carrier_trackers: - msg += '' + tracker[0] + '
' + msg += Markup('%s
') % (tracker[1], tracker[0]) self.message_post(body=msg) return self.env["ir.actions.actions"]._for_xml_id("delivery.act_delivery_trackers_url") diff --git a/addons/stock_picking_batch/models/stock_picking.py b/addons/stock_picking_batch/models/stock_picking.py index 8fe9885dff4..01d8d4f94c1 100644 --- a/addons/stock_picking_batch/models/stock_picking.py +++ b/addons/stock_picking_batch/models/stock_picking.py @@ -1,6 +1,8 @@ # -*- coding: utf-8 -*- # Part of Odoo. See LICENSE file for full copyright and licensing details. +from markupsafe import escape + from odoo import _, api, Command, fields, models from odoo.osv import expression from odoo.exceptions import ValidationError @@ -245,7 +247,7 @@ class StockPicking(models.Model): pickings = self.filtered(lambda p: p.user_id.id != user_id) pickings.write({'user_id': user_id}) for pick in pickings: - log_message = _('Assigned to %s Responsible', (pick.batch_id._get_html_link())) + log_message = escape(_('Assigned to %s Responsible')) % pick.batch_id._get_html_link() pick.message_post(body=log_message) def action_view_batch(self): diff --git a/addons/stock_picking_batch/models/stock_picking_batch.py b/addons/stock_picking_batch/models/stock_picking_batch.py index 3adb8e6e39b..cb32a11e0f6 100644 --- a/addons/stock_picking_batch/models/stock_picking_batch.py +++ b/addons/stock_picking_batch/models/stock_picking_batch.py @@ -1,6 +1,8 @@ # -*- coding: utf-8 -*- # Part of Odoo. See LICENSE file for full copyright and licensing details. +from markupsafe import Markup + from odoo import api, fields, models, _ from odoo.exceptions import UserError from odoo.osv.expression import AND @@ -239,7 +241,7 @@ class StockPickingBatch(models.Model): if has_no_qty_done(picking): empty_pickings.add(picking.id) picking.message_post( - body="%s: %s %s" % ( + body=Markup("%s: %s %s") % ( _("Transferred by"), _("Batch Transfer"), picking.batch_id.id, diff --git a/addons/test_mail/tests/test_mail_followers.py b/addons/test_mail/tests/test_mail_followers.py index dba59018ad2..4d52ba5eaa2 100644 --- a/addons/test_mail/tests/test_mail_followers.py +++ b/addons/test_mail/tests/test_mail_followers.py @@ -1,6 +1,8 @@ # -*- coding: utf-8 -*- # Part of Odoo. See LICENSE file for full copyright and licensing details. +from markupsafe import Markup + from odoo.addons.mail.tests.common import MailCommon from odoo.exceptions import AccessError from odoo.tests import tagged, users @@ -660,7 +662,7 @@ class RecipientsNotificationTest(MailCommon): 'status': 'sent', 'type': 'inbox'}], message_info={'content': 'User Choice Notification'}): test.message_post( - body='
User Choice Notification
', + body=Markup('User Choice Notification
'), message_type='comment', partner_ids=shared_partner.ids, subtype_xmlid='mail.mt_comment', diff --git a/addons/test_mail/tests/test_mail_mail.py b/addons/test_mail/tests/test_mail_mail.py index c402c1da1a3..77d365e0341 100644 --- a/addons/test_mail/tests/test_mail_mail.py +++ b/addons/test_mail/tests/test_mail_mail.py @@ -7,6 +7,7 @@ import smtplib from datetime import datetime, timedelta from freezegun import freeze_time +from markupsafe import Markup from OpenSSL.SSL import Error as SSLError from socket import gaierror, timeout from unittest.mock import call, patch @@ -38,9 +39,9 @@ class TestMailMail(MailCommon): 'email_from': 'ignasse@example.com', }).with_context({}) - cls.test_message = cls.test_record.message_post(body='Message
', subject='Subject') + cls.test_message = cls.test_record.message_post(body=Markup('Message
'), subject='Subject') cls.test_mail = cls.env['mail.mail'].create([{ - 'body': 'Body
', + 'body': Markup('Body
'), 'email_from': False, 'email_to': 'test@example.com', 'is_notification': True, diff --git a/addons/test_mail/tests/test_mail_message.py b/addons/test_mail/tests/test_mail_message.py index d04e3aec4f6..d1609aa18af 100644 --- a/addons/test_mail/tests/test_mail_message.py +++ b/addons/test_mail/tests/test_mail_message.py @@ -2,6 +2,7 @@ # Part of Odoo. See LICENSE file for full copyright and licensing details. import base64 +from markupsafe import Markup from unittest.mock import patch from odoo.addons.mail.tests.common import mail_new_test_user, MailCommon @@ -483,7 +484,7 @@ class TestMessageAccess(MailCommon): test_record.message_subscribe((partner_1 | self.user_admin.partner_id).ids) message = test_record.message_post( - body='This is First Message
', subject='Subject', + body=Markup('This is First Message
'), subject='Subject', message_type='comment', subtype_xmlid='mail.mt_note') # portal user have no rights to read the message with self.assertRaises(AccessError): diff --git a/addons/test_mail/tests/test_mail_thread_internals.py b/addons/test_mail/tests/test_mail_thread_internals.py index 4bafa0458c5..bcee37e22ea 100644 --- a/addons/test_mail/tests/test_mail_thread_internals.py +++ b/addons/test_mail/tests/test_mail_thread_internals.py @@ -1,6 +1,7 @@ # -*- coding: utf-8 -*- # Part of Odoo. See LICENSE file for full copyright and licensing details. +from markupsafe import Markup from unittest.mock import patch from unittest.mock import DEFAULT @@ -36,7 +37,7 @@ class TestAPI(MailCommon, TestRecipients): # post a note message = ticket_record.message_post( attachment_ids=attachments.ids, - body="Initial Body
", + body=Markup("Initial Body
"), message_type="comment", partner_ids=self.partner_1.ids, ) @@ -543,7 +544,7 @@ class TestNoThread(MailCommon, TestRecipients): 'subtype': 'mail.mt_note', }]): _message = self.env['mail.thread'].message_notify( - body='Hello Paulo
', + body=Markup('Hello Paulo
'), partner_ids=self.partner_2.ids, subject='Test Notify', ) diff --git a/addons/test_mail/tests/test_message_post.py b/addons/test_mail/tests/test_message_post.py index e5471931dde..2d0ead3f7f3 100644 --- a/addons/test_mail/tests/test_message_post.py +++ b/addons/test_mail/tests/test_message_post.py @@ -6,7 +6,7 @@ import base64 from datetime import datetime, timedelta from freezegun import freeze_time from itertools import product -from markupsafe import escape +from markupsafe import escape, Markup from unittest.mock import patch from odoo import tools @@ -295,7 +295,7 @@ class TestMessageNotify(TestMessagePostCommon): with self.mock_mail_gateway(): new_notification = test_record.message_notify( - body='You have received a notification
', + body=Markup('You have received a notification
'), partner_ids=[self.partner_1.id, self.partner_admin.id, self.partner_employee_2.id], subject='This should be a subject', ) @@ -342,7 +342,7 @@ class TestMessageNotify(TestMessagePostCommon): with self.mock_mail_gateway(): new_notification = test_record.message_notify( - body='You have received a notification
', + body=Markup('You have received a notification
'), partner_ids=(self.partner_1 + self.partner_employee).ids, subject='This should be a subject', ) @@ -351,7 +351,7 @@ class TestMessageNotify(TestMessagePostCommon): with self.mock_mail_gateway(): new_notification = test_record.message_notify( - body='You have received a notification
', + body=Markup('You have received a notification
'), notify_author=True, partner_ids=(self.partner_1 + self.partner_employee).ids, subject='This should be a subject', @@ -365,7 +365,7 @@ class TestMessageNotify(TestMessagePostCommon): with self.mock_mail_gateway(): new_notification = test_record.with_context(mail_notify_author=True).message_notify( - body='You have received a notification
', + body=Markup('You have received a notification
'), partner_ids=(self.partner_1 + self.partner_employee).ids, subject='This should be a subject', ) @@ -383,7 +383,7 @@ class TestMessageNotify(TestMessagePostCommon): with self.assertRaises(ValueError): test_records.message_notify( - body='Nice notification content
', + body=Markup('Nice notification content
'), partner_ids=self.partner_employee_2.ids, subject='Notify Subject', ) @@ -473,7 +473,7 @@ class TestMessageNotify(TestMessagePostCommon): self.mock_mail_gateway(), \ self.assertRaises(ValueError): _new_message = test_record.message_notify( - body='You will not receive a notification
', + body=Markup('You will not receive a notification
'), partner_ids=self.partner_1.ids, subject='This should not be accepted', **parameters @@ -481,7 +481,7 @@ class TestMessageNotify(TestMessagePostCommon): # support of subtype xml id new_message = test_record.message_notify( - body='You will not receive a notification
', + body=Markup('You will not receive a notification
'), partner_ids=self.partner_1.ids, subtype_xmlid='mail.mt_note', ) @@ -494,7 +494,7 @@ class TestMessageNotify(TestMessagePostCommon): people without having a document. """ with self.mock_mail_gateway(): new_notification = self.env['mail.thread'].message_notify( - body='You have received a notification
', + body=Markup('You have received a notification
'), partner_ids=[self.partner_1.id, self.partner_admin.id, self.partner_employee_2.id], subject='This should be a subject', ) @@ -535,7 +535,7 @@ class TestMessageLog(TestMessagePostCommon): test_record.message_subscribe(self.partner_employee_2.ids) new_note = test_record._message_log( - body='Labrador
', + body=Markup('Labrador
'), ) self.assertMessageFields( new_note, @@ -559,7 +559,7 @@ class TestMessageLog(TestMessagePostCommon): new_notes = test_records._message_log_batch( bodies=dict( - (test_record.id, 'Test _message_log_batch
') + (test_record.id, Markup('Test _message_log_batch
')) for test_record in test_records ), ) @@ -833,7 +833,7 @@ class TestMessagePost(TestMessagePostCommon, CronMixinCase): self.assertMsgWithoutNotifications(), \ self.capture_triggers(cron_id) as capt: msg = test_record.message_post( - body='Test
', + body=Markup('Test
'), message_type='comment', subject='Subject', subtype_xmlid='mail.mt_comment', @@ -880,7 +880,7 @@ class TestMessagePost(TestMessagePostCommon, CronMixinCase): self.mock_mail_gateway(mail_unlink_sent=False), \ self.capture_triggers(cron_id) as capt: msg = test_record.message_post( - body='Test
', + body=Markup('Test
'), message_type='comment', subject='Subject', subtype_xmlid='mail.mt_comment', @@ -908,7 +908,7 @@ class TestMessagePost(TestMessagePostCommon, CronMixinCase): with freeze_time(now), \ self.assertMsgWithoutNotifications(): msg = test_record.message_post( - body='Test
', + body=Markup('Test
'), message_type='comment', subject='Subject', subtype_xmlid='mail.mt_comment', @@ -1086,7 +1086,7 @@ class TestMessagePost(TestMessagePostCommon, CronMixinCase): ] ), patch.object(MailTestSimple, 'check_access_rights', return_value=True): new_msg = self.test_record.with_user(self.user_portal).message_post( - body='Test
', + body=Markup('Test
'), message_type='comment', subject='Subject', subtype_xmlid='mail.mt_comment', @@ -1095,7 +1095,7 @@ class TestMessagePost(TestMessagePostCommon, CronMixinCase): with self.assertRaises(AccessError): self.test_record.with_user(self.user_portal).message_post( - body='Test
', + body=Markup('Test
'), message_type='comment', subject='Subject', subtype_xmlid='mail.mt_comment', @@ -1108,7 +1108,7 @@ class TestMessagePost(TestMessagePostCommon, CronMixinCase): with self.mock_mail_gateway(): parent_msg = test_record.message_post( - body='Test
', + body=Markup('Test
'), message_type='comment', subject='Test Subject', subtype_xmlid='mail.mt_comment', @@ -1121,7 +1121,7 @@ class TestMessagePost(TestMessagePostCommon, CronMixinCase): [{'content': 'Test Answer
', 'notif': [{'partner': self.partner_1, 'type': 'email'}]}] ): msg = test_record.message_post( - body='Test Answer
', + body=Markup('Test Answer
'), message_type='comment', parent_id=parent_msg.id, partner_ids=[self.partner_1.id], @@ -1144,7 +1144,7 @@ class TestMessagePost(TestMessagePostCommon, CronMixinCase): # post a reply to the reply: check parent is the first one with self.mock_mail_gateway(): new_msg = test_record.message_post( - body='Test Answer Bis
', + body=Markup('Test Answer Bis
'), message_type='comment', subtype_xmlid='mail.mt_comment', parent_id=msg.id, @@ -1697,7 +1697,7 @@ class TestMessagePostLang(MailCommon, TestRecipients): with self.mock_mail_gateway(): test_records[1].message_post( - body='Hello
', + body=Markup('Hello
'), email_layout_xmlid='mail.test_layout', message_type='comment', subject='Subject', @@ -1820,7 +1820,7 @@ class TestMessagePostLang(MailCommon, TestRecipients): with self.mock_mail_gateway(mail_unlink_sent=False), \ self.mock_mail_app(): record.message_post( - body='Hi there
', + body=Markup('Hi there
'), email_layout_xmlid=email_layout_xmlid, message_type='comment', subject='TeDeum', diff --git a/addons/test_mail/tests/test_performance.py b/addons/test_mail/tests/test_performance.py index ce57c95d01e..9f8508f6d57 100644 --- a/addons/test_mail/tests/test_performance.py +++ b/addons/test_mail/tests/test_performance.py @@ -1,7 +1,7 @@ # -*- coding: utf-8 -*- # Part of Odoo. See LICENSE file for full copyright and licensing details. -from contextlib import nullcontext +from markupsafe import Markup from unittest.mock import patch from odoo.addons.base.tests.common import TransactionCaseWithUserDemo @@ -589,7 +589,7 @@ class TestMailAPIPerformance(BaseMailPerformance): with self.assertQueryCount(admin=1, employee=1): record._message_log( - body='Test _message_log
', + body=Markup('Test _message_log
'), message_type='comment') @users('admin', 'employee') @@ -603,7 +603,7 @@ class TestMailAPIPerformance(BaseMailPerformance): with self.assertQueryCount(admin=1, employee=1): records._message_log_batch( bodies=dict( - (record.id, 'Test _message_log
') + (record.id, Markup('Test _message_log
')) for record in records ), message_type='comment') @@ -629,7 +629,7 @@ class TestMailAPIPerformance(BaseMailPerformance): with self.assertQueryCount(admin=7, employee=7): record.message_post( - body='Test message_post as log
', + body=Markup('Test message_post as log
'), subtype_xmlid='mail.mt_note', message_type='comment') @@ -640,7 +640,7 @@ class TestMailAPIPerformance(BaseMailPerformance): with self.assertQueryCount(admin=7, employee=7): record.message_post( - body='Test Post Performances basic
', + body=Markup('Test Post Performances basic
'), partner_ids=[], message_type='comment', subtype_xmlid='mail.mt_comment') @@ -653,7 +653,7 @@ class TestMailAPIPerformance(BaseMailPerformance): with self.assertQueryCount(admin=30, employee=30): record.message_post( - body='Test Post Performances with an email ping
', + body=Markup('Test Post Performances with an email ping
'), partner_ids=self.customer.ids, message_type='comment', subtype_xmlid='mail.mt_comment') @@ -665,7 +665,7 @@ class TestMailAPIPerformance(BaseMailPerformance): with self.assertQueryCount(admin=17, employee=17): record.message_post( - body='Test Post Performances with an inbox ping
', + body=Markup('Test Post Performances with an inbox ping
'), partner_ids=self.user_test.partner_id.ids, message_type='comment', subtype_xmlid='mail.mt_comment') @@ -854,7 +854,7 @@ class TestMailComplexPerformance(BaseMailPerformance): # about 20 (19?) queries per additional customer group with self.assertQueryCount(admin=53, employee=52): record.message_post( - body='Test Post Performances
', + body=Markup('Test Post Performances
'), message_type='comment', subtype_xmlid='mail.mt_comment') @@ -1311,7 +1311,7 @@ class TestMailHeavyPerformancePost(BaseMailPerformance): # with self.assertQueryCount(employee=63), enable_logging: with self.assertQueryCount(employee=60): record_container.with_context({}).message_post( - body='Test body
Test body
Test Content
', + body=Markup('Test Content
'), message_type='comment', subject='Test Subject', subtype_xmlid='mail.mt_comment', diff --git a/addons/website_crm_partner_assign/models/crm_lead.py b/addons/website_crm_partner_assign/models/crm_lead.py index 30f65fe277d..51200f659dc 100644 --- a/addons/website_crm_partner_assign/models/crm_lead.py +++ b/addons/website_crm_partner_assign/models/crm_lead.py @@ -2,6 +2,7 @@ # Part of Odoo. See LICENSE file for full copyright and licensing details. import random +from markupsafe import Markup from odoo import api, fields, models, _ from odoo.exceptions import AccessDenied, AccessError, UserError @@ -189,23 +190,23 @@ class CrmLead(models.Model): return res_partner_ids def partner_interested(self, comment=False): - message = _('I am interested by this lead.
') + message = Markup('%s
') % _('I am interested by this lead.') if comment: - message += '%s
' % html_escape(comment) + message += Markup('%s
') % comment for lead in self: lead.message_post(body=message) lead.sudo().convert_opportunity(lead.partner_id) # sudo required to convert partner data def partner_desinterested(self, comment=False, contacted=False, spam=False): if contacted: - message = '%s
' % _('I am not interested by this lead. I contacted the lead.') + message = Markup('%s
') % _('I am not interested by this lead. I contacted the lead.') else: - message = '%s
' % _('I am not interested by this lead. I have not contacted the lead.') + message = Markup('%s
') % _('I am not interested by this lead. I have not contacted the lead.') partner_ids = self.env['res.partner'].search( [('id', 'child_of', self.env.user.partner_id.commercial_partner_id.id)]) self.message_unsubscribe(partner_ids=partner_ids.ids) if comment: - message += '%s
' % html_escape(comment) + message += Markup('%s
') % comment self.message_post(body=message) values = { 'partner_assigned_id': False, diff --git a/addons/website_payment/models/payment_transaction.py b/addons/website_payment/models/payment_transaction.py index e416179de3e..d8d9aefb48a 100644 --- a/addons/website_payment/models/payment_transaction.py +++ b/addons/website_payment/models/payment_transaction.py @@ -1,6 +1,7 @@ # -*- coding: utf-8 -*- # Part of Odoo. See LICENSE file for full copyright and licensing details. +from markupsafe import Markup from odoo import _, fields, models @@ -20,8 +21,8 @@ class PaymentTransaction(models.Model): if value: if hasattr(value, 'name'): value = value.name - msg.append('- %s: %s' % (field_name, value)) - tx.payment_id._message_log(body=''.join(msg)) + msg.append(Markup('
- %s: %s') % (field_name, value)) + tx.payment_id._message_log(body=Markup().join(msg)) def _send_donation_email(self, is_internal_notification=False, comment=None, recipient_email=None): self.ensure_one()