From c7002c7be7e3c6704cf64d8c58e511121c23d893 Mon Sep 17 00:00:00 2001
From: Xavier Morel <xmo@odoo.com>
Date: Wed, 10 Mar 2021 10:49:49 +0000
Subject: [PATCH] [FIX] portal: de-t-raw-ify

As part of that, also mark one of the searchbar_inputs label as markup-safe.
---
 addons/portal/views/portal_templates.xml | 16 ++++++++--------
 addons/project/controllers/portal.py     |  4 +++-
 2 files changed, 11 insertions(+), 9 deletions(-)

diff --git a/addons/portal/views/portal_templates.xml b/addons/portal/views/portal_templates.xml
index 227458942cd..9ae14030823 100644
--- a/addons/portal/views/portal_templates.xml
+++ b/addons/portal/views/portal_templates.xml
@@ -94,7 +94,7 @@
 
     <template id="portal_back_in_edit_mode" name="Back to edit mode">
         <div t-ignore="true" class="text-center">
-            <t t-if="custom_html" t-raw="custom_html"/>
+            <t t-if="custom_html" t-out="custom_html"/>
             <t t-else="">This is a preview of the customer portal.</t>
             <a t-att-href="backend_url"><i class="fa fa-arrow-right mr-1"/>Back to edit mode</a>
         </div>
@@ -199,9 +199,9 @@
         <div t-attf-class="#{classes}">
             <div class="card bg-white mb-4 sticky-top" id="sidebar_content">
                 <div t-if="title" class="card-body text-center pb-2 pt-3">
-                    <t t-raw="title"/>
+                    <t t-out="title"/>
                 </div>
-                <t t-if="entries" t-raw="entries"/>
+                <t t-if="entries" t-out="entries"/>
                 <div class="card-footer small text-center text-muted border-top-0 pt-1 pb-1 d-none d-lg-block">
                     Powered by <a target="_blank" href="http://www.odoo.com?utm_source=db&amp;utm_medium=portal" title="odoo"><img src="/web/static/src/img/logo.png" alt="Odoo Logo" height="15"/></a>
                 </div>
@@ -302,9 +302,9 @@
                             <button type="button" class="btn btn-secondary dropdown-toggle" data-toggle="dropdown"/>
                             <div class="dropdown-menu" role="menu">
                                 <t t-foreach='searchbar_inputs' t-as='input'>
-                                    <a t-att-href="'#' + searchbar_inputs[input]['input']"
-                                        t-attf-class="dropdown-item#{search_in == searchbar_inputs[input]['input'] and ' active' or ''}">
-                                        <span t-raw="searchbar_inputs[input]['label']"/>
+                                    <a t-att-href="'#' + input_value['input']"
+                                        t-attf-class="dropdown-item#{search_in == input_value['input'] and ' active' or ''}">
+                                        <span t-out="input_value['label']"/>
                                     </a>
                                 </t>
                             </div>
@@ -324,10 +324,10 @@
     <template id="portal_record_layout" name="Portal single record layout">
         <div t-attf-class="card mt-0 border-top-0 rounded-0 rounded-bottom #{classes if classes else ''}">
             <div t-if="card_header" t-attf-class="card-header #{header_classes if header_classes else ''}">
-                <t t-raw="card_header"/>
+                <t t-out="card_header"/>
             </div>
             <div t-if="card_body" t-attf-class="card-body #{body_classes if body_classes else ''}">
-                <t t-raw="card_body"/>
+                <t t-out="card_body"/>
             </div>
         </div>
     </template>
diff --git a/addons/project/controllers/portal.py b/addons/project/controllers/portal.py
index 10f8f86511f..ab3a61858d0 100644
--- a/addons/project/controllers/portal.py
+++ b/addons/project/controllers/portal.py
@@ -4,6 +4,8 @@
 from collections import OrderedDict
 from operator import itemgetter
 
+from markupsafe import Markup
+
 from odoo import http, _
 from odoo.exceptions import AccessError, MissingError
 from odoo.http import request
@@ -113,7 +115,7 @@ class CustomerPortal(portal.CustomerPortal):
             'all': {'label': _('All'), 'domain': []},
         }
         searchbar_inputs = {
-            'content': {'input': 'content', 'label': _('Search <span class="nolabel"> (in Content)</span>')},
+            'content': {'input': 'content', 'label': Markup(_('Search <span class="nolabel"> (in Content)</span>'))},
             'message': {'input': 'message', 'label': _('Search in Messages')},
             'customer': {'input': 'customer', 'label': _('Search in Customer')},
             'stage': {'input': 'stage', 'label': _('Search in Stages')},