pengyuthon/odoo_source
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[FIX] mail: escape user and channel names to prevent xss

Browse Source 
However, users shouldn't be allowed to have xss in their name, imo.
This commit is contained in:
Aaron Bohy
2015-12-09 11:16:24 +01:00
parent 085f6e0e68
commit 6cf8ebab3d
2 changed files with 8 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
addons/mail/static/src/js/chat_manager.js
+1 -1
View File
@@ -98,7 +98,7 @@ function add_message (data, options) {
if (!query.is_displayed) {
var title = _t('New message');
if (msg.author_id[1]) {
title += _t(' from ') + msg.author_id[1];
title += _t(' from ') + _.escape(msg.author_id[1]);
}
var trunc_text = function (t, limit) {
return (t.length > limit) ? t.substr(0, limit-1)+'…' : t;
addons/mail/static/src/js/client_action.js
+7 -5
View File
@@ -76,7 +76,7 @@ var PartnerInviteDialog = Dialog.extend({
var ChannelModel = new Model('mail.channel');
return ChannelModel.call('channel_invite', [], {ids : [this.channel_id], partner_ids: _.pluck(data, 'id')})
.then(function(){
var names = _.pluck(data, 'text').join(', ');
var names = _.escape(_.pluck(data, 'text').join(', '));
var notification = _.str.sprintf(_t('You added <b>%s</b> to the conversation.'), names);
self.do_notify(_t('New people'), notification);
});
@@ -293,9 +293,10 @@ var ChatAction = Widget.extend(ControlPanelMixin, {
return Channel.call('channel_search_to_join', [search_val]).then(function(result){
var values = [];
_.each(result, function(channel){
var escaped_name = _.escape(channel.name);
values.push(_.extend(channel, {
'value': channel.name,
'label': channel.name,
'value': escaped_name,
'label': escaped_name,
}));
});
return values;
@@ -307,9 +308,10 @@ var ChatAction = Widget.extend(ControlPanelMixin, {
return Partner.call('im_search', [search_val, 20]).then(function(result){
var values = [];
_.each(result, function(user){
var escaped_name = _.escape(user.name);
values.push(_.extend(user, {
'value': user.name,
'label': user.name,
'value': escaped_name,
'label': escaped_name,
}));
});
return values;