diff --git a/addons/website_forum/models/forum.py b/addons/website_forum/models/forum.py index 1efb7cade15..94df769a88d 100644 --- a/addons/website_forum/models/forum.py +++ b/addons/website_forum/models/forum.py @@ -533,7 +533,7 @@ class Post(models.Model): question = self.parent_id values = { 'author_id': self.sudo().create_uid.partner_id.id, # use sudo here because of access to res.users model - 'body': tools.html2plaintext(self.content), + 'body': tools.html_sanitize(self.content, strict=True, strip_style=True, strip_classes=True), 'type': 'comment', 'subtype': 'mail.mt_comment', 'date': self.create_date, diff --git a/openerp/tools/mail.py b/openerp/tools/mail.py index b1f5768a320..46443481acf 100644 --- a/openerp/tools/mail.py +++ b/openerp/tools/mail.py @@ -53,7 +53,7 @@ safe_attrs = clean.defs.safe_attrs | frozenset( ]) -def html_sanitize(src, silent=True, strict=False, strip_style=False): +def html_sanitize(src, silent=True, strict=False, strip_style=False, strip_classes=False): if not src: return src src = ustr(src, errors='replace') @@ -88,9 +88,13 @@ def html_sanitize(src, silent=True, strict=False, strip_style=False): if strict: if etree.LXML_VERSION >= (3, 1, 0): # lxml < 3.1.0 does not allow to specify safe_attrs. We keep all attributes in order to keep "style" + if strip_classes: + current_safe_attrs = safe_attrs - frozenset(['class']) + else: + current_safe_attrs = safe_attrs kwargs.update({ 'safe_attrs_only': True, - 'safe_attrs': safe_attrs, + 'safe_attrs': current_safe_attrs, }) else: kwargs['safe_attrs_only'] = False # keep oe-data attributes + style