Martin Trigaux
d11ee78019
The title of notification is the author name escaped (for security
reasons).
if (message.hasAuthor()) {
title = _.escape(message.getAuthorName());
}
When forwarded to the system notification, it does not need to be
escaped though, as the system notification is not HTML based.
Without this patch, a user named "Bob's friend" sending a message was
creating a notification with the title "Bob's friend"
Unescaping the notification body just in case but the HTML of the body
in a mail.messages should be stripped by _notifyIncomingMessage.
Unescaping will just ignored unescaped characters and should do
nothing on messages not escaped.
Fixes odoo/odoo#24846
closes odoo/odoo#44550
Signed-off-by: Martin Trigaux (mat) <mat@odoo.com>