From 7689bf27c7c218d49d4915fc0758ce88b3ee2be0 Mon Sep 17 00:00:00 2001
From: Xavier Morel <xmo@odoo.com>
Date: Tue, 27 Apr 2021 07:49:12 +0000
Subject: [PATCH] [IMP] web: remote t-raw from HiddenInputFile

t-call bodies (`0`) should always be markup-safe.
---
 addons/web/static/src/legacy/xml/base.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/addons/web/static/src/legacy/xml/base.xml b/addons/web/static/src/legacy/xml/base.xml
index d7d4010ab9a..7e672f17d46 100644
--- a/addons/web/static/src/legacy/xml/base.xml
+++ b/addons/web/static/src/legacy/xml/base.xml
@@ -1475,7 +1475,7 @@
             <input type="hidden" name="callback" t-att-value="fileupload_id"/>
             <input type="file" class="o_input_file" name="ufile"
                 t-att="{'multiple': multi_upload ? 'multiple' : null, 'accept': widget.accepted_file_extensions || '*'}"/>
-            <t t-raw="0"/>
+            <t t-out="0"/>
         </form>
         <iframe t-att-id="fileupload_id" t-att-name="fileupload_id" style="display: none"/>
     </div>