pos_*: pos_adyen, pos_six
The use of the Markup was meant to keep the formatting (mostly the line breaks) of the data
given by the payment terminals. The data was stored on the `ticket` attribute of the `Payment`
model. A security issue arose from the fact that it is possible to import orders from a file
via the debug widget.
The `ticket` attribute was initialized in the `init_from_json` method and could be injected
with some malicious code.
Solution:
Instead of replacing all line breaks by the `<br/>` tag whenever terminal data is retrieved,
we can simply store this as it is in the `ticket` attribute. We then escape the value before
replacing the line breaks when exporting the data as a Markup. With this, only our `<br/>` tags
are trusted.
closesodoo/odoo#114770
X-original-commit: 7194506648c3512dc6a80d4a92a986643e60c5d2
Related: odoo/enterprise#37962
Signed-off-by: Heinz Robin (rhe) <rhe@odoo.com>
Signed-off-by: Trinh Jacky (trj) <trj@odoo.com>
Jacky (trj)
ba8bba2add