[FIX] web_editor: properly forbid video command in sanitized fields

The video command is supposed to be forbidden in tag-sanitized fields. A
field gets tag-sanitized if sanitize_tags is true or by default if the
field is to be sanitized (and sanitize_tags is undefined). Before this
commit, the video command was not forbidden if sanitize was true,
regardless of the value of sanitize_tags.

closes odoo/odoo#111777

X-original-commit: 96b4edfd40a3c131a7709986fc3e1599c177f986
Signed-off-by: David Monjoie (dmo) <dmo@odoo.com>

addons/web_editor/static/src/js/backend/field_html.js

@@ -265,8 +265,8 @@ var FieldHtml = basic_fields.DebouncedField.extend(TranslatableFieldMixin, {
             // default can be set elsewhere otherwise.
             wysiwygOptions.allowCommandImage = Boolean(this.nodeOptions.allowCommandImage);
         }
-        if (this.field.sanitize && this.field.sanitize_tags) {
-            wysiwygOptions.allowCommandVideo = false; // Sanitized fields remove videos.
+        if (this.field.sanitize_tags || (this.field.sanitize_tags === undefined && this.field.sanitize)) {
+            wysiwygOptions.allowCommandVideo = false; // Tag-sanitized fields remove videos.
         } else if ('allowCommandVideo' in this.nodeOptions) {
             // Set the option only if it is explicitly set in the view so a
             // default can be set elsewhere otherwise.

addons/web_editor/static/src/js/backend/html_field.js

@@ -640,8 +640,8 @@ HtmlField.extractProps = ({ attrs, field }) => {
         // can be set elsewhere otherwise.
         wysiwygOptions.allowCommandImage = Boolean(attrs.options.allowCommandImage);
     }
-    if (field.sanitize && field.sanitize_tags) {
-        wysiwygOptions.allowCommandVideo = false; // Sanitized fields remove videos.
+    if (field.sanitize_tags || (field.sanitize_tags === undefined && field.sanitize)) {
+        wysiwygOptions.allowCommandVideo = false; // Tag-sanitized fields remove videos.
     } else if ('allowCommandVideo' in attrs.options) {
         // Set the option only if it is explicitly set in the view so a default
         // can be set elsewhere otherwise.