[FIX] mail: sanitize activity notes

The note content was not sanitized against HTML content.
This is not considered as a security issue as an activity can only be
created by trusted employees, however there is no reason not to
sanitize it.

Courtesy of Lauri Vakkala, silverskin

closes odoo/odoo#48889

X-original-commit: 970b460295c3d33dbb089ef6b7224b472e6b568d
Signed-off-by: Martin Trigaux (mat) <mat@odoo.com>

addons/mail/models/mail_activity.py

@@ -129,7 +129,7 @@ class MailActivity(models.Model):
     activity_decoration = fields.Selection(related='activity_type_id.decoration_type', readonly=True)
     icon = fields.Char('Icon', related='activity_type_id.icon', readonly=True)
     summary = fields.Char('Summary')
-    note = fields.Html('Note')
+    note = fields.Html('Note', sanitize_style=True)
     date_deadline = fields.Date('Due Date', index=True, required=True, default=fields.Date.context_today)
     automated = fields.Boolean(
         'Automated activity', readonly=True,