From 5f1ec49ecdac6d72cd42755c41fbe75d6a1f3587 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Thibault=20Delavall=C3=A9e?= <tde@openerp.com>
Date: Thu, 23 Jan 2014 13:51:37 +0100
Subject: [PATCH 1/3] [FIX] tools: mail: when cleaning, unescape mako specific
 symbols. Indeed those are escaped when contained inside an href or mailto
 element of a tag, leading to mako not rendering the element.

bzr revid: tde@openerp.com-20140123125137-4u4i88f1ajybg5f2
---
 openerp/tools/mail.py | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/openerp/tools/mail.py b/openerp/tools/mail.py
index a97e2aa3971..e0a9625c258 100644
--- a/openerp/tools/mail.py
+++ b/openerp/tools/mail.py
@@ -29,6 +29,7 @@ import re
 import socket
 import threading
 import time
+import xml
 from email.utils import getaddresses
 
 import openerp
@@ -95,6 +96,8 @@ def html_sanitize(src, silent=True, strict=False):
         # some corner cases make the parser crash (such as <SCRIPT/XSS SRC=\"http://ha.ckers.org/xss.js\"></SCRIPT> in test_mail)
         cleaner = clean.Cleaner(**kwargs)
         cleaned = cleaner.clean_html(src)
+        # MAKO compatibility: $, { and } inside quotes are escaped, preventing correct mako execution
+        cleaned = xml.sax.saxutils.unescape(cleaned, {'%24': '$', '%7B': '{', '%7D': '}', '%20': ' '})
     except etree.ParserError, e:
         if 'empty' in str(e):
             return ""

From 69af79ff3d705d19a71ba3ba7851b981cb301077 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Thibault=20Delavall=C3=A9e?= <tde@openerp.com>
Date: Thu, 23 Jan 2014 15:14:35 +0100
Subject: [PATCH 2/3] [FIX] tools: mail: fixed last commit, now simply using
 replace

bzr revid: tde@openerp.com-20140123141435-jstfcaemjplbn7b1
---
 openerp/tools/mail.py | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/openerp/tools/mail.py b/openerp/tools/mail.py
index e0a9625c258..ab376411d65 100644
--- a/openerp/tools/mail.py
+++ b/openerp/tools/mail.py
@@ -29,7 +29,6 @@ import re
 import socket
 import threading
 import time
-import xml
 from email.utils import getaddresses
 
 import openerp
@@ -97,7 +96,10 @@ def html_sanitize(src, silent=True, strict=False):
         cleaner = clean.Cleaner(**kwargs)
         cleaned = cleaner.clean_html(src)
         # MAKO compatibility: $, { and } inside quotes are escaped, preventing correct mako execution
-        cleaned = xml.sax.saxutils.unescape(cleaned, {'%24': '$', '%7B': '{', '%7D': '}', '%20': ' '})
+        cleaned = cleaned.replace('%24', '$')
+        cleaned = cleaned.replace('%7B', '{')
+        cleaned = cleaned.replace('%7D', '}')
+        cleaned = cleaned.replace('%20', ' ')
     except etree.ParserError, e:
         if 'empty' in str(e):
             return ""

From 2bcf4cca79a57dfba84d1f3e3fa7b8908bfe66e8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Thibault=20Delavall=C3=A9e?= <tde@openerp.com>
Date: Thu, 23 Jan 2014 16:28:42 +0100
Subject: [PATCH 3/3] [FIX] tools: mail: support \[ and \] in tmeplates

bzr revid: tde@openerp.com-20140123152842-21b3gsey1mxt4v37
---
 openerp/tools/mail.py | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/openerp/tools/mail.py b/openerp/tools/mail.py
index ab376411d65..85dcfd368fe 100644
--- a/openerp/tools/mail.py
+++ b/openerp/tools/mail.py
@@ -100,6 +100,8 @@ def html_sanitize(src, silent=True, strict=False):
         cleaned = cleaned.replace('%7B', '{')
         cleaned = cleaned.replace('%7D', '}')
         cleaned = cleaned.replace('%20', ' ')
+        cleaned = cleaned.replace('%5B', '[')
+        cleaned = cleaned.replace('%5D', ']')
     except etree.ParserError, e:
         if 'empty' in str(e):
             return ""