[FIX] website: de-raw-ify

Convert `custom_code_*` to `Html` with no sanitization, such that qweb
considers them markup-safe.

`base_popup_options` value comes from a rendered XML body so should
already be safe

raw -> out in the extended website info template, not sure why this
was even raw

Also mark robots_txt as an unsanitized Html field, that's
not *actually* true but it is true enough for our purposes, especially
since the field gets edited through a text-mode wizard.

addons/website/models/website.py

@@ -117,10 +117,10 @@ class Website(models.Model):
     partner_id = fields.Many2one(related='user_id.partner_id', string='Public Partner', readonly=False)
     menu_id = fields.Many2one('website.menu', compute='_compute_menu', string='Main Menu')
     homepage_id = fields.Many2one('website.page', string='Homepage')
-    custom_code_head = fields.Text('Custom <head> code')
-    custom_code_footer = fields.Text('Custom end of <body> code')
+    custom_code_head = fields.Html('Custom <head> code', sanitize=False)
+    custom_code_footer = fields.Html('Custom end of <body> code', sanitize=False)
 
-    robots_txt = fields.Text('Robots.txt', translate=False, groups='website.group_website_designer')
+    robots_txt = fields.Html('Robots.txt', translate=False, groups='website.group_website_designer', sanitize=False)
 
     def _default_favicon(self):
         img_path = get_resource_path('web', 'static/src/img/favicon.ico')

addons/website/views/snippets/s_popup.xml

@@ -59,11 +59,11 @@
             </we-select>
         </t>
         <div data-js="SnippetPopup" data-selector=".s_popup" data-exclude="#website_cookies_bar" data-target=".modal">
-            <t t-raw="base_popup_options"/>
-            <t t-raw="extra_popup_options"/>
+            <t t-out="base_popup_options"/>
+            <t t-out="extra_popup_options"/>
         </div>
         <div data-js="SnippetPopup" data-selector=".s_popup#website_cookies_bar" data-target=".modal">
-            <t t-raw="base_popup_options"/>
+            <t t-out="base_popup_options"/>
         </div>
     </xpath>
 </template>

addons/website/views/website_templates.xml

@@ -176,10 +176,10 @@
 
 <template id="custom_code_layout" name="Custom Code Layout" inherit_id="website.layout" priority="55">
     <xpath expr="//head" position="inside">
-        <t t-raw="website.custom_code_head"/>
+        <t t-out="website.custom_code_head"/>
     </xpath>
     <xpath expr="//body" position="inside">
-        <t t-raw="website.custom_code_footer"/>
+        <t t-out="website.custom_code_footer"/>
     </xpath>
 </template>
 
@@ -1995,7 +1995,7 @@
               </t>
               <t t-if="version">
                 <h1><t t-esc="res_company.name"/>
-                    <small>Odoo Version <t t-raw="version.get('server_version')"/></small>
+                    <small>Odoo Version <t t-out="version.get('server_version')"/></small>
                 </h1>
                 <p>
                     Information about the <t t-esc="res_company.name"/> instance of Odoo, the <a target="_blank" href="https://www.odoo.com">Open Source ERP</a>.
@@ -2011,12 +2011,12 @@
                 <dl class="dl-horizontal" t-foreach="apps" t-as="app">
                     <dt>
                         <a t-att-href="app.website" t-if="app.website">
-                            <t t-raw="app.shortdesc"/>
+                            <t t-out="app.shortdesc"/>
                         </a>
-                        <span t-raw="app.shortdesc" t-if="not app.website"/>
+                        <span t-out="app.shortdesc" t-if="not app.website"/>
                     </dt>
                     <dd>
-                        <span t-raw="app.summary"/>
+                        <span t-out="app.summary"/>
                     </dd><dd class="text-muted" groups='base.group_no_one'>
                         Technical name: <span t-field="app.name"/>, author: <span t-field="app.author"/>
                     </dd>
@@ -2027,11 +2027,11 @@
                     <dl class="dl-horizontal" t-foreach="l10n" t-as="app">
                         <dt>
                             <a t-attf-href="https://www.odoo.com/page/accounting/#{app.name}">
-                                <t t-raw="app.shortdesc"/>
+                                <t t-out="app.shortdesc"/>
                             </a>
                         </dt>
                         <dd>
-                            <span t-raw="app.summary"/>
+                            <span t-out="app.summary"/>
                         </dd><dd class="text-muted" groups='base.group_no_one'>
                             Technical name: <span t-field="app.name"/>, author: <span t-field="app.author"/>
                         </dd>
@@ -2240,7 +2240,7 @@ Sitemap: <t t-esc="url_root"/>sitemap.xml
 #   custom   #
 ##############
 
-<t t-raw="request.website.sudo().robots_txt" />
+<t t-out="request.website.sudo().robots_txt" />
 </t>
 </template>
 
@@ -2255,7 +2255,7 @@ Sitemap: <t t-esc="url_root"/>sitemap.xml
 
 <template id="sitemap_xml">&lt;?xml version="1.0" encoding="UTF-8"?&gt;
 <urlset t-attf-xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
-    <t t-raw="content"/>
+    <t t-out="content"/>
 </urlset>
 </template>