[IMP] tools, forum: allow to strip classes from sanitized html.

This behavior is not the default behavior to remain consistent with
the previous behavior of the sanitizer.

website_forum: when converting a post into a comment the html is now
completely sanitized instead of parsed into plaintext. Inded comment
are mail.message, thus holding html content. Styling and classes are
removed to ensure only the basic html pattern is kept.

addons/website_forum/models/forum.py

@@ -533,7 +533,7 @@ class Post(models.Model):
         question = self.parent_id
         values = {
             'author_id': self.sudo().create_uid.partner_id.id,  # use sudo here because of access to res.users model
-            'body': tools.html2plaintext(self.content),
+            'body': tools.html_sanitize(self.content, strict=True, strip_style=True, strip_classes=True),
             'type': 'comment',
             'subtype': 'mail.mt_comment',
             'date': self.create_date,

openerp/tools/mail.py

@@ -53,7 +53,7 @@ safe_attrs = clean.defs.safe_attrs | frozenset(
      ])
 
 
-def html_sanitize(src, silent=True, strict=False, strip_style=False):
+def html_sanitize(src, silent=True, strict=False, strip_style=False, strip_classes=False):
     if not src:
         return src
     src = ustr(src, errors='replace')
@@ -88,9 +88,13 @@ def html_sanitize(src, silent=True, strict=False, strip_style=False):
     if strict:
         if etree.LXML_VERSION >= (3, 1, 0):
             # lxml < 3.1.0 does not allow to specify safe_attrs. We keep all attributes in order to keep "style"
+            if strip_classes:
+                current_safe_attrs = safe_attrs - frozenset(['class'])
+            else:
+                current_safe_attrs = safe_attrs
             kwargs.update({
                 'safe_attrs_only': True,
-                'safe_attrs': safe_attrs,
+                'safe_attrs': current_safe_attrs,
             })
     else:
         kwargs['safe_attrs_only'] = False    # keep oe-data attributes + style