From 03af44babe165cc2d26e6de455ecb70a1bc5d689 Mon Sep 17 00:00:00 2001
From: Denis Ledoux <dle@odoo.com>
Date: Mon, 29 Sep 2014 14:57:36 +0200
Subject: [PATCH] [FIX] website_mail: sanitize email templates when displaying
 templates selection

In cases the templates is not html syntax valid
---
 addons/website_mail/controllers/email_designer.py    | 2 ++
 addons/website_mail/views/website_email_designer.xml | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/addons/website_mail/controllers/email_designer.py b/addons/website_mail/controllers/email_designer.py
index 0a3e1043fad..6116dd3cad7 100644
--- a/addons/website_mail/controllers/email_designer.py
+++ b/addons/website_mail/controllers/email_designer.py
@@ -4,6 +4,7 @@ from urllib import urlencode
 
 from openerp.addons.web import http
 from openerp.addons.web.http import request
+from openerp.tools.mail import html_sanitize
 
 
 class WebsiteEmailDesigner(http.Controller):
@@ -64,6 +65,7 @@ class WebsiteEmailDesigner(http.Controller):
             tids = tmpl_obj.search(cr, uid, [], context=context)
         templates = tmpl_obj.browse(cr, uid, tids, context=context)
         values['templates'] = templates
+        values['html_sanitize'] = html_sanitize
 
         return request.website.render("website_mail.email_designer", values)
 
diff --git a/addons/website_mail/views/website_email_designer.xml b/addons/website_mail/views/website_email_designer.xml
index 470e0f1f583..6f64fd3b9c8 100644
--- a/addons/website_mail/views/website_email_designer.xml
+++ b/addons/website_mail/views/website_email_designer.xml
@@ -24,7 +24,7 @@
                     </div>
                     <div t-foreach="templates" t-as="template" class="col-md-3 col-sm-4 text-center">
                         <div class="email_preview_border">
-                            <div t-field="template.body_html" class="email_preview js_content"/>
+                            <div t-field="html_sanitize(template.body_html)" class="email_preview js_content"/>
                         </div>
                         <h4 t-field="template.name"/>
                         <button class="btn btn-primary js_template_set">Select</button>