From 75f13db36a1d6ceb819ada5b666c57ded538d3e0 Mon Sep 17 00:00:00 2001
From: Xavier Morel <xmo@odoo.com>
Date: Tue, 18 May 2021 10:43:25 +0000
Subject: [PATCH] [IMP] im_livechat: markup-ify im_livechat

Mark the message body as safe pretty much as soon as we receive the
message from the server:

* when receiving message-type notifications
* while loading history

Also reorder history loading a bit while at it:

* convert willStart to async
* immediately reverse & wrap history right there, seems unnecessary to
  wait until willStart since `reverse()` works in-place anyway
* when loading messages into the thread, `_.each` seems unnecessary,
  Array#forEach will do fine
---
 .../static/src/legacy/public_livechat.js      | 31 ++++++++-----------
 .../static/src/legacy/public_livechat.xml     |  2 +-
 2 files changed, 14 insertions(+), 19 deletions(-)

diff --git a/addons/im_livechat/static/src/legacy/public_livechat.js b/addons/im_livechat/static/src/legacy/public_livechat.js
index 25445bde1ea..509fccd23d6 100644
--- a/addons/im_livechat/static/src/legacy/public_livechat.js
+++ b/addons/im_livechat/static/src/legacy/public_livechat.js
@@ -71,31 +71,25 @@ var LivechatButton = Widget.extend({
         this._messages = [];
         this._serverURL = serverURL;
     },
-    willStart: function () {
-        var self = this;
+    async willStart() {
         var cookie = utils.get_cookie('im_livechat_session');
-        var ready;
-        if (!cookie) {
-            ready = session.rpc('/im_livechat/init', { channel_id: this.options.channel_id })
-                .then(function (result) {
-                    if (!result.available_for_me) {
-                        return Promise.reject();
-                    }
-                    self._rule = result.rule;
-                });
-        } else {
+        if (cookie) {
             var channel = JSON.parse(cookie);
-            ready = session.rpc('/mail/chat_history', { uuid: channel.uuid, limit: 100 })
-                .then(function (history) {
-                    self._history = history;
-                });
+            this._history = await session.rpc('/mail/chat_history', {uuid: channel.uuid, limit: 100});
+            this._history.reverse().forEach(message => { message.body = utils.Markup(message.body); });
+        } else {
+            const result = await session.rpc('/im_livechat/init', {channel_id: this.options.channel_id});
+            if (!result.available_for_me) {
+                return Promise.reject();
+            }
+            this._rule = result.rule;
         }
-        return ready.then(this._loadQWebTemplate.bind(this));
+        return this._loadQWebTemplate();
     },
     start: function () {
         this.$el.text(this.options.button_text);
         if (this._history) {
-            _.each(this._history.reverse(), this._addMessage.bind(this));
+            this._history.forEach(m => this._addMessage(m));
             this._openChat();
         } else if (!config.device.isMobile && this._rule.action === 'auto_popup') {
             var autoPopupCookie = utils.get_cookie('im_livechat_auto_popup');
@@ -204,6 +198,7 @@ var LivechatButton = Widget.extend({
                 if (this._messages.some(message => message.getID() === notificationData.id)) {
                     return;
                 }
+                notificationData.body = utils.Markup(notificationData.body);
                 this._addMessage(notificationData);
                 if (this._chatWindow.isFolded() || !this._chatWindow.isAtBottom()) {
                     this._livechat.incrementUnreadCounter();
diff --git a/addons/im_livechat/static/src/legacy/public_livechat.xml b/addons/im_livechat/static/src/legacy/public_livechat.xml
index b5cf12a6ff8..1250bcf4e5a 100644
--- a/addons/im_livechat/static/src/legacy/public_livechat.xml
+++ b/addons/im_livechat/static/src/legacy/public_livechat.xml
@@ -400,7 +400,7 @@
                     </span>
                 </p>
                 <div class="o_thread_message_content">
-                    <t t-raw="message.getBody()"/>
+                    <t t-out="message.getBody()"/>
                     <t t-if="message.hasTrackingValues()">
                         <t t-if="message.hasSubtypeDescription()">
                             <p><t t-esc="message.getSubtypeDescription()"/></p>