odoo
/
odoo
2
0
Fork 0
Code Pull Requests Releases Activity

[MERGE] [FIX] tools: mail: when cleaning, unescape mako specific symbols. 

Indeed those are escaped when contained inside an href or mailto element
of a tag, leading to mako not rendering the element.

bzr revid: tde@openerp.com-20140124152528-39njxzbn319jckfn
This commit is contained in:
Thibault Delavallée 2014-01-24 16:25:28 +01:00
parent 76144806af d474cacf74
commit 6e11e3f6ce
1 changed files with 7 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
openerp/tools/mail.py
View File

@ -95,6 +95,13 @@ def html_sanitize(src, silent=True, strict=False):
# some corner cases make the parser crash (such as <SCRIPT/XSS SRC=\"http://ha.ckers.org/xss.js\"></SCRIPT> in test_mail)
cleaner = clean.Cleaner(**kwargs)
cleaned = cleaner.clean_html(src)
# MAKO compatibility: $, { and } inside quotes are escaped, preventing correct mako execution
cleaned = cleaned.replace('%24', '$')
cleaned = cleaned.replace('%7B', '{')
cleaned = cleaned.replace('%7D', '}')
cleaned = cleaned.replace('%20', ' ')
cleaned = cleaned.replace('%5B', '[')
cleaned = cleaned.replace('%5D', ']')
except etree.ParserError, e:
if 'empty' in str(e):
return ""