From e5aeefadced43f117d064100ac04a2b7f27bff3a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thibault=20Delavall=C3=A9e?= Date: Thu, 21 Mar 2013 10:23:32 +0100 Subject: [PATCH] [FIX] mail: rpely_to of sent emails is sanitized. bzr revid: tde@openerp.com-20130321092332-8cp59mu3idrpbnke --- addons/mail/mail_mail.py | 8 ++++++-- addons/mail/tests/test_mail_features.py | 9 +++++++-- 2 files changed, 13 insertions(+), 4 deletions(-) diff --git a/addons/mail/mail_mail.py b/addons/mail/mail_mail.py index c6584b1e0cb..1a21bb17ad9 100644 --- a/addons/mail/mail_mail.py +++ b/addons/mail/mail_mail.py @@ -21,6 +21,7 @@ import base64 import logging +import re from urllib import urlencode from urlparse import urljoin @@ -82,7 +83,7 @@ class mail_mail(osv.Model): # protection for `default_type` values leaking from menu action context (e.g. for invoices) # To remove when automatic context propagation is removed in web client if context and context.get('default_type') and context.get('default_type') not in self._all_columns['type'].column.selection: - context = dict(context, default_type = None) + context = dict(context, default_type=None) return super(mail_mail, self).default_get(cr, uid, fields, context=context) def create(self, cr, uid, values, context=None): @@ -213,7 +214,10 @@ class mail_mail(osv.Model): if email_reply_to and mail.model and mail.res_id: document_name = self.pool.get(mail.model).name_get(cr, SUPERUSER_ID, [mail.res_id], context=context)[0] if document_name: - email_reply_to = _('Followers of %s <%s>') % (document_name[1], email_reply_to) + # sanitize document name + sanitized_doc_name = re.sub(r'[^\w+.]+', '-', document_name[1]) + # generate reply to + email_reply_to = _('"Followers of %s" <%s>') % (sanitized_doc_name, email_reply_to) return email_reply_to diff --git a/addons/mail/tests/test_mail_features.py b/addons/mail/tests/test_mail_features.py index 83ad165c16c..2d0019c0b8a 100644 --- a/addons/mail/tests/test_mail_features.py +++ b/addons/mail/tests/test_mail_features.py @@ -216,6 +216,8 @@ class test_mail(TestMailBase): # Data: set alias_domain to see emails with alias self.registry('ir.config_parameter').set_param(self.cr, self.uid, 'mail.catchall.domain', 'schlouby.fr') + # Data: change Pigs name to test reply_to + self.mail_group.write(cr, uid, [self.group_pigs_id], {'name': '"Pigs" !รน $%-'}) # Do: subscribe Raoul new_follower_ids = [self.partner_raoul_id] @@ -290,7 +292,7 @@ class test_mail(TestMailBase): 'message_post: notification email sent to more than one email address instead of a precise partner') self.assertIn(sent_email['email_to'][0], test_emailto, 'message_post: notification email email_to incorrect') - self.assertEqual(sent_email['reply_to'], 'Followers of Pigs ', + self.assertEqual(sent_email['reply_to'], '"Followers of -Pigs-" ', 'message_post: notification email reply_to incorrect') self.assertEqual(_subject, sent_email['subject'], 'message_post: notification email subject incorrect') @@ -313,6 +315,9 @@ class test_mail(TestMailBase): self.assertEqual(notif_pids, test_pids, 'message_post: mail.message created mail.notification incorrect') + # Data: Pigs name back to normal + self.mail_group.write(cr, uid, [self.group_pigs_id], {'name': 'Pigs'}) + # -------------------------------------------------- # CASE2: reply + parent_id + parent notification # -------------------------------------------------- @@ -357,7 +362,7 @@ class test_mail(TestMailBase): 'message_post: notification email sent to more than one email address instead of a precise partner') self.assertIn(sent_email['email_to'][0], test_emailto, 'message_post: notification email email_to incorrect') - self.assertEqual(sent_email['reply_to'], 'Followers of Pigs ', + self.assertEqual(sent_email['reply_to'], '"Followers of Pigs" ', 'message_post: notification email reply_to incorrect: should name Followers of Pigs, and have raoul email') self.assertEqual(_mail_subject, sent_email['subject'], 'message_post: notification email subject incorrect')