From ad54273e9c91a5616cfbc7273e8a05013e81b09a Mon Sep 17 00:00:00 2001 From: Martin Trigaux Date: Tue, 3 Mar 2020 13:53:13 +0000 Subject: [PATCH] [FIX] mail: sanitize activity notes The note content was not sanitized against HTML content. This is not considered as a security issue as an activity can only be created by trusted employees, however there is no reason not to sanitize it. Courtesy of Lauri Vakkala, silverskin closes odoo/odoo#48889 X-original-commit: 970b460295c3d33dbb089ef6b7224b472e6b568d Signed-off-by: Martin Trigaux (mat) --- addons/mail/models/mail_activity.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/addons/mail/models/mail_activity.py b/addons/mail/models/mail_activity.py index 9ce3b5bcd7b..827dcc5e33e 100644 --- a/addons/mail/models/mail_activity.py +++ b/addons/mail/models/mail_activity.py @@ -129,7 +129,7 @@ class MailActivity(models.Model): activity_decoration = fields.Selection(related='activity_type_id.decoration_type', readonly=True) icon = fields.Char('Icon', related='activity_type_id.icon', readonly=True) summary = fields.Char('Summary') - note = fields.Html('Note') + note = fields.Html('Note', sanitize_style=True) date_deadline = fields.Date('Due Date', index=True, required=True, default=fields.Date.context_today) automated = fields.Boolean( 'Automated activity', readonly=True,