in v14 `_render()` on `ir.ui.view` returned `str`. In v15 it returns
`Markup` instead. This inadvertently changed the behavior of
`_do_request()`. The rendered view stored in `xml_transaction` is
added to the request as the SOAP body and is supposed to be
escaped. This is done by `html_escape(xml_transaction)` but since
`xml_transaction` is already `Markup` it won't escape. On top of that
concatenating the `soap_header` and `soap_footer` `str`s causes them
to be escaped when they shouldn't be.
This commit changes `xml_transaction` to be a single `Markup()` that
inserts the escaped view and password inside of
`<mer:CreditTransaction>`. This has the added benefit of solving an
issue when the password includes a character with a special meaning,
although I'm not aware of a real case where this happened.
opw-2919085
closesodoo/odoo#98759
X-original-commit: 8e51b1df76f35a7c01e5f86920c84b2c1c976d9b
Signed-off-by: Xavier Morel (xmo) <xmo@odoo.com>
Signed-off-by: Masereel Pierre <pim@odoo.com>
Joren Van Onder
aa17542267