From 1528f9273b52703c617222f748215c1ebcf49deb Mon Sep 17 00:00:00 2001
From: Anael Closson <acl@openerp.com>
Date: Tue, 15 Apr 2014 16:37:36 +0200
Subject: [PATCH] [FIX] tools: Comments in e-mail templates are removed before
 mako/jinja2 processing - opw 605315

bzr revid: acl@openerp.com-20140415143736-bcgwgribsv2hsbvo
---
 openerp/tools/mail.py | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/openerp/tools/mail.py b/openerp/tools/mail.py
index 85dcfd368fe..5cbd0304735 100644
--- a/openerp/tools/mail.py
+++ b/openerp/tools/mail.py
@@ -45,7 +45,7 @@ tags_to_kill = ["script", "head", "meta", "title", "link", "style", "frame", "if
 tags_to_remove = ['html', 'body', 'font']
 
 # allow new semantic HTML5 tags
-allowed_tags = clean.defs.tags | frozenset('article section header footer hgroup nav aside figure main'.split())
+allowed_tags = clean.defs.tags | frozenset('article section header footer hgroup nav aside figure main'.split() + [etree.Comment])
 safe_attrs = clean.defs.safe_attrs | frozenset(
     ['style',
      'data-oe-model', 'data-oe-id', 'data-oe-field', 'data-oe-type', 'data-oe-expression', 'data-oe-translate', 'data-oe-nodeid',
@@ -70,6 +70,8 @@ def html_sanitize(src, silent=True, strict=False):
         'forms': True,              # remove form tags
         'remove_unknown_tags': False,
         'allow_tags': allowed_tags,
+        'comments': False,
+        'processing_instructions' : False
     }
     if etree.LXML_VERSION >= (2, 3, 1):
         # kill_tags attribute has been added in version 2.3.1
@@ -339,10 +341,14 @@ def html_email_clean(html, remove=False, shorten=False, max_length=300, expand_o
     overlength_section_count = 0
     cur_char_nbr = 0
     for node in root.iter():
+        # comments do not need processing
+        if node.tag == etree.Comment:
+            continue
         # do not take into account multiple spaces that are displayed as max 1 space in html
         node_text = ' '.join((node.text and node.text.strip(' \t\r\n') or '').split())
 
         # root: try to tag the client used to write the html
+        # note: bug in node.get(value, default) for HtmlComments, default never returned
         if 'WordSection1' in node.get('class', '') or 'MsoNormal' in node.get('class', ''):
             root.set('msoffice', '1')
         if 'SkyDrivePlaceholder' in node.get('class', '') or 'SkyDrivePlaceholder' in node.get('id', ''):
@@ -657,4 +663,4 @@ def email_split(text):
                 # sometimes returns emails without at least '@'. The '@'
                 # is strictly required in RFC2822's `addr-spec`.
                 if addr[1]
-                if '@' in addr[1]]
\ No newline at end of file
+                if '@' in addr[1]]