diff --git a/addons/website_twitter/static/src/js/website.twitter.animation.js b/addons/website_twitter/static/src/js/website.twitter.animation.js
index 295ae199868..f511e6a07eb 100644
--- a/addons/website_twitter/static/src/js/website.twitter.animation.js
+++ b/addons/website_twitter/static/src/js/website.twitter.animation.js
@@ -2,6 +2,7 @@ odoo.define('website_twitter.animation', function (require) {
'use strict';
var core = require('web.core');
+const {Markup} = require('web.utils');
var publicWidget = require('web.public.widget');
var qweb = core.qweb;
@@ -47,7 +48,7 @@ publicWidget.registry.twitter = publicWidget.Widget.extend({
}
// Parse tweet text
- tweet.text = tweet.text
+ tweet.text = Markup(_.escape(tweet.text)
.replace(
/[A-Za-z]+:\/\/[A-Za-z0-9-_]+\.[A-Za-z0-9-_:%&~\?\/.=]+/g,
function (url) {
@@ -65,18 +66,12 @@ publicWidget.registry.twitter = publicWidget.Widget.extend({
function (hashtag) {
return _makeLink('http://twitter.com/search?q='+hashtag.replace('#',''), hashtag);
}
- );
+ ));
return qweb.render('website.Twitter.Tweet', {tweet: tweet});
function _makeLink(url, text) {
- var c = $('', {
- text: text,
- href: url,
- target: '_blank',
- rel: 'noreferrer noopener',
- });
- return c.prop('outerHTML');
+ return Markup`${text}`;
}
});
diff --git a/addons/website_twitter/static/src/xml/website.twitter.xml b/addons/website_twitter/static/src/xml/website.twitter.xml
index e6ceb3ccb98..e4c96fdbaa9 100644
--- a/addons/website_twitter/static/src/xml/website.twitter.xml
+++ b/addons/website_twitter/static/src/xml/website.twitter.xml
@@ -16,7 +16,7 @@