Martin Trigaux
d11ee78019
The title of notification is the author name escaped (for security
reasons).
if (message.hasAuthor()) {
title = _.escape(message.getAuthorName());
}
When forwarded to the system notification, it does not need to be
escaped though, as the system notification is not HTML based.
Without this patch, a user named "Bob's friend" sending a message was
creating a notification with the title "Bob's friend"
Unescaping the notification body just in case but the HTML of the body
in a mail.messages should be stripped by _notifyIncomingMessage.
Unescaping will just ignored unescaped characters and should do
nothing on messages not escaped.
Fixes odoo/odoo#24846
closes odoo/odoo#44550
Signed-off-by: Martin Trigaux (mat) <mat@odoo.com>
Odoo
Odoo is a suite of web based open source business apps.
The main Odoo Apps include an Open Source CRM, Website Builder, eCommerce, Warehouse Management, Project Management, Billing & Accounting, Point of Sale, Human Resources, Marketing, Manufacturing, ...
Odoo Apps can be used as stand-alone applications, but they also integrate seamlessly so you get a full-featured Open Source ERP when you install several Apps.
Getting started with Odoo
For a standard installation please follow the Setup instructions from the documentation.
To learn the software, we recommend the Odoo eLearning, or Scale-up, the business game. Developers can start with the developer tutorials