From cb5695f46fbd828712a12b58bfef90194eab65ce Mon Sep 17 00:00:00 2001
From: Xavier Morel <xmo@odoo.com>
Date: Thu, 1 Jul 2021 13:38:24 +0000
Subject: [PATCH] [FIX] website: remove t-raw in menu management

Update `_deletePage` to mark `.text` as markup-safe, and modernize the
code base: the outer promise seems useless, and so does the
`cancel_callback` of the dialog.
---
 addons/website/static/src/js/menu/content.js | 38 ++++++++------------
 addons/website/static/src/xml/website.xml    |  4 +--
 2 files changed, 16 insertions(+), 26 deletions(-)

diff --git a/addons/website/static/src/js/menu/content.js b/addons/website/static/src/js/menu/content.js
index abbe89401f5..c0cadc43f67 100644
--- a/addons/website/static/src/js/menu/content.js
+++ b/addons/website/static/src/js/menu/content.js
@@ -7,6 +7,7 @@ import time from 'web.time';
 import weWidgets from 'wysiwyg.widgets';
 import websiteNavbarData from 'website.navbar';
 import Widget from 'web.Widget';
+import { Markup } from 'web.utils';
 
 import { registry } from "@web/core/registry";
 
@@ -1054,35 +1055,24 @@ var PageManagement = Widget.extend({
  *                  It will affect redirect after page deletion: reload or '/'
  */
 // TODO: This function should be integrated in a widget in the future
-function _deletePage(pageId, fromPageManagement) {
-    var self = this;
-    new Promise(function (resolve, reject) {
-        // Search the page dependencies
-        self._getPageDependencies(pageId)
-        .then(function (dependencies) {
-            // Inform the user about those dependencies and ask him confirmation
-            return new Promise(function (confirmResolve, confirmReject) {
-                Dialog.safeConfirm(self, "", {
-                    title: _t("Delete Page"),
-                    $content: $(qweb.render('website.delete_page', {dependencies: dependencies})),
-                    confirm_callback: confirmResolve,
-                    cancel_callback: resolve,
-                });
-            });
-        }).then(function () {
-            // Delete the page if the user confirmed
-            return self._rpc({
-                model: 'website.page',
-                method: 'unlink',
-                args: [pageId],
-            });
-        }).then(function () {
+async function _deletePage(pageId, fromPageManagement) {
+    const dependencies = await this._getPageDependencies(pageId);
+    for (const locs of Object.values(dependencies)) {
+        for (const loc of locs) {
+            loc.text = Markup(loc.text);
+        }
+    }
+    Dialog.safeConfirm(this, "", {
+        title: _t("Delete Page"),
+        $content: $(qweb.render('website.delete_page', {dependencies: dependencies})),
+        async confirm_callback() {
+            await this._rpc({model: 'website.page', method: 'unlink', args: [pageId]});
             if (fromPageManagement) {
                 window.location.reload(true);
             } else {
                 window.location.href = '/';
             }
-        }, reject);
+        }
     });
 }
 /**
diff --git a/addons/website/static/src/xml/website.xml b/addons/website/static/src/xml/website.xml
index 1c747952c54..731f5c089f1 100644
--- a/addons/website/static/src/xml/website.xml
+++ b/addons/website/static/src/xml/website.xml
@@ -44,10 +44,10 @@
                     <ul>
                         <li t-foreach="type_value" t-as="error">
                             <a t-if="!_.contains(['', '#', false], error.link)" t-att-href="error.link">
-                                <t t-raw="error.text"/>
+                                <t t-out="error.text"/>
                             </a>
                             <t t-else="">
-                                <t t-raw="error.text"/>
+                                <t t-out="error.text"/>
                             </t>
                         </li>
                     </ul>