From c3063778ce389b7b186a4683faaed5635163a8d7 Mon Sep 17 00:00:00 2001
From: Martin Trigaux <mat@openerp.com>
Date: Thu, 21 Nov 2013 16:13:05 +0100
Subject: [PATCH] [FIX] email.template: add safe filter over email address to
 allow emails to be sent in the format 'Name <name@company.com>' and avoid
 escaping

bzr revid: mat@openerp.com-20131121151305-t5je12s4w5uctu0k
---
 addons/account/edi/invoice_action_data.xml       |  2 +-
 .../account_analytic_analysis_cron.xml           |  4 ++--
 .../account_followup/account_followup_data.xml   | 16 ++++++++--------
 addons/auth_signup/auth_signup_data.xml          |  8 ++++----
 addons/event/email_template.xml                  |  8 ++++----
 .../marketing_campaign_demo.xml                  |  6 +++---
 addons/portal_sale/portal_sale_data.xml          |  4 ++--
 .../purchase/edi/purchase_order_action_data.xml  |  2 +-
 addons/sale/edi/sale_order_action_data.xml       |  2 +-
 9 files changed, 26 insertions(+), 26 deletions(-)

diff --git a/addons/account/edi/invoice_action_data.xml b/addons/account/edi/invoice_action_data.xml
index 18ac71f55ce..4b62ef16faf 100644
--- a/addons/account/edi/invoice_action_data.xml
+++ b/addons/account/edi/invoice_action_data.xml
@@ -22,7 +22,7 @@
         <!--Email template -->
         <record id="email_template_edi_invoice" model="email.template">
             <field name="name">Invoice - Send by Email</field>
-            <field name="email_from">${object.user_id.email or object.company_id.email or 'noreply@localhost'}</field>
+            <field name="email_from">${object.user_id.email or object.company_id.email or 'noreply@localhost'|safe}</field>
             <field name="subject">${object.company_id.name} Invoice (Ref ${object.number or 'n/a'})</field>
             <field name="email_recipients">${object.partner_id.id}</field>
             <field name="model_id" ref="account.model_account_invoice"/>
diff --git a/addons/account_analytic_analysis/account_analytic_analysis_cron.xml b/addons/account_analytic_analysis/account_analytic_analysis_cron.xml
index 4a9cf457c3f..c8368bc51f7 100644
--- a/addons/account_analytic_analysis/account_analytic_analysis_cron.xml
+++ b/addons/account_analytic_analysis/account_analytic_analysis_cron.xml
@@ -4,9 +4,9 @@
 
         <record id="account_analytic_cron_email_template" model="email.template">
             <field name="name">Contract expiration reminder</field>
-            <field name="email_from">${object.email or ''}</field>
+            <field name="email_from">${object.email or ''|safe}</field>
             <field name="subject">Contract expiration reminder ${user.company_id.name}</field>
-            <field name="email_to">${object.email}</field>
+            <field name="email_to">${object.email|safe}</field>
             <field name="lang">${object.lang}</field>
             <field name="model_id" ref="base.model_res_users"/>
             <field name="auto_delete" eval="True"/>
diff --git a/addons/account_followup/account_followup_data.xml b/addons/account_followup/account_followup_data.xml
index 1a11db5e5f7..7dfc5dc0851 100644
--- a/addons/account_followup/account_followup_data.xml
+++ b/addons/account_followup/account_followup_data.xml
@@ -6,9 +6,9 @@
         <!--Mail template level 0-->
         <record id="email_template_account_followup_level0" model="email.template">
             <field name="name">First polite payment follow-up reminder email</field>
-            <field name="email_from">${user.email or ''}</field>
+            <field name="email_from">${user.email or ''|safe}</field>
             <field name="subject">${user.company_id.name} Payment Reminder</field>
-            <field name="email_to">${object.email}</field>
+            <field name="email_to">${object.email|safe}</field>
             <field name="lang">${object.lang}</field>
             <field name="model_id" ref="base.model_res_partner"/>
             <field name="auto_delete" eval="True"/>
@@ -45,9 +45,9 @@ ${object.get_followup_table_html() | safe}
         <!--Mail template level 1 -->
         <record id="email_template_account_followup_level1" model="email.template">
             <field name="name">A bit urging second payment follow-up reminder email</field>
-            <field name="email_from">${user.email or ''}</field>
+            <field name="email_from">${user.email or ''|safe}</field>
             <field name="subject">${user.company_id.name} Payment Reminder</field>
-            <field name="email_to">${object.email}</field>
+            <field name="email_to">${object.email|safe}</field>
             <field name="lang">${object.lang}</field>
             <field name="model_id" ref="base.model_res_partner"/>
             <field name="auto_delete" eval="True"/>
@@ -85,9 +85,9 @@ ${object.get_followup_table_html() | safe}
         <!--Mail template level 2 -->
         <record id="email_template_account_followup_level2" model="email.template">
             <field name="name">Urging payment follow-up reminder email</field>
-            <field name="email_from">${user.email or ''}</field>
+            <field name="email_from">${user.email or ''|safe}</field>
             <field name="subject">${user.company_id.name} Payment Reminder</field>
-            <field name="email_to">${object.email}</field>
+            <field name="email_to">${object.email|safe}</field>
             <field name="lang">${object.lang}</field>
             <field name="model_id" ref="base.model_res_partner"/>
             <field name="auto_delete" eval="True"/>
@@ -122,9 +122,9 @@ ${object.get_followup_table_html() | safe}
         <!-- Default follow up message -->
         <record id="email_template_account_followup_default" model="email.template">
             <field name="name">Default payment follow-up reminder e-mail</field>
-            <field name="email_from">${user.email or ''}</field>
+            <field name="email_from">${user.email or ''|safe}</field>
             <field name="subject">${user.company_id.name} Payment Reminder</field>
-            <field name="email_to">${object.email}</field>
+            <field name="email_to">${object.email|safe}</field>
             <field name="lang">${object.lang}</field>
             <field name="model_id" ref="base.model_res_partner"/>
             <field name="auto_delete" eval="True"/>
diff --git a/addons/auth_signup/auth_signup_data.xml b/addons/auth_signup/auth_signup_data.xml
index 1b4e3e05502..dc34e4d8117 100644
--- a/addons/auth_signup/auth_signup_data.xml
+++ b/addons/auth_signup/auth_signup_data.xml
@@ -22,8 +22,8 @@
         <record id="reset_password_email" model="email.template">
             <field name="name">Reset Password</field>
             <field name="model_id" ref="base.model_res_users"/>
-            <field name="email_from"><![CDATA[${object.company_id.name} <${object.company_id.email or user.email}>]]></field>
-            <field name="email_to">${object.email}</field>
+            <field name="email_from"><![CDATA[${object.company_id.name} <${object.company_id.email or user.email|safe}>]]></field>
+            <field name="email_to">${object.email|safe}</field>
             <field name="subject">Password reset</field>
             <field name="body_html"><![CDATA[
 <p>A password reset was requested for the OpenERP account linked to this email.</p>
@@ -37,8 +37,8 @@
         <record id="set_password_email" model="email.template">
             <field name="name">OpenERP Enterprise Connection</field>
             <field name="model_id" ref="base.model_res_users"/>
-            <field name="email_from"><![CDATA[${object.company_id.name} <${object.company_id.email or user.email}>]]></field>
-            <field name="email_to">${object.email}</field>
+            <field name="email_from"><![CDATA[${object.company_id.name} <${object.company_id.email or user.email|safe}>]]></field>
+            <field name="email_to">${object.email|safe}</field>
             <field name="subject"><![CDATA[${object.company_id.name} invitation to connect on OpenERP]]></field>
             <field name="body_html">
                 <![CDATA[
diff --git a/addons/event/email_template.xml b/addons/event/email_template.xml
index 95ffbf46d8d..74c47da2c7b 100644
--- a/addons/event/email_template.xml
+++ b/addons/event/email_template.xml
@@ -4,8 +4,8 @@
         <record id="confirmation_event" model="email.template">
         <field name="name">Confirmation of the Event</field>
         <field name="model_id" ref="event.model_event_registration"/>
-        <field name="email_from" >${object.user_id.email or object.company_id.email or 'noreply@' + object.company_id.name + '.com'}</field>
-        <field name="email_to" >${object.email}</field>
+        <field name="email_from" >${object.user_id.email or object.company_id.email or 'noreply@' + object.company_id.name + '.com'|safe}</field>
+        <field name="email_to" >${object.email|safe}</field>
         <field name="subject">Your registration at ${object.event_id.name}</field>
         <field name="body_html"><![CDATA[
         <p>Hello ${object.name},</p>
@@ -21,8 +21,8 @@
         <record id="confirmation_registration" model="email.template">
         <field name="name">Confirmation of the Registration</field>
         <field name="model_id" ref="event.model_event_registration"/>
-        <field name="email_from" >${object.user_id.email or object.company_id.email or 'noreply@' + object.company_id.name + '.com'}</field>
-        <field name="email_to" >${object.email}</field>
+        <field name="email_from" >${object.user_id.email or object.company_id.email or 'noreply@' + object.company_id.name + '.com'|safe}</field>
+        <field name="email_to" >${object.email|safe}</field>
         <field name="subject">Your registration at ${object.event_id.name}</field>
         <field name="body_html"><![CDATA[
         <p>Hello ${object.name},</p>
diff --git a/addons/marketing_campaign/marketing_campaign_demo.xml b/addons/marketing_campaign/marketing_campaign_demo.xml
index 92443fe987d..9b246286a5f 100644
--- a/addons/marketing_campaign/marketing_campaign_demo.xml
+++ b/addons/marketing_campaign/marketing_campaign_demo.xml
@@ -6,7 +6,7 @@
             <field name="name">welcome new partner</field>
             <field name="email_from">info@openerp.com</field>
             <field name="subject">Welcome to the OpenERP Partner Channel!</field>
-            <field name="email_to">${object.email or ''}</field>
+            <field name="email_to">${object.email or ''|safe}</field>
             <field name="model_id" ref="base.model_res_partner"/>
             <field name="body_html">Hello, you will receive your welcome pack via email shortly.</field>
         </record>
@@ -14,7 +14,7 @@
             <field name="name">congrats silver partner</field>
             <field name="email_from">info@openerp.com</field>
             <field name="subject">Congratulations! You are now a Silver Partner!</field>
-            <field name="email_to">${object.email or ''}</field>
+            <field name="email_to">${object.email or ''|safe}</field>
             <field name="model_id" ref="base.model_res_partner"/>
             <field name="body_html">Hi, we are delighted to welcome you among our Silver Partners as of today!</field>
         </record>
@@ -23,7 +23,7 @@
             <field name="name">congrats gold partner</field>
             <field name="email_from">info@openerp.com</field>
             <field name="subject">Congratulations! You are now one of our Gold Partners!</field>
-            <field name="email_to">${object.email or ''}</field>
+            <field name="email_to">${object.email or ''|safe}</field>
             <field name="model_id" ref="base.model_res_partner"/>
             <field name="body_html">Hi, we are delighted to let you know that you have entered the select circle of our Gold Partners</field>
         </record>
diff --git a/addons/portal_sale/portal_sale_data.xml b/addons/portal_sale/portal_sale_data.xml
index 31a2f19ef28..778f2d4f129 100644
--- a/addons/portal_sale/portal_sale_data.xml
+++ b/addons/portal_sale/portal_sale_data.xml
@@ -6,7 +6,7 @@
         <!--Email template -->
         <record id="email_template_edi_sale" model="email.template">
             <field name="name">Sales Order - Send by Email (Portal)</field>
-            <field name="email_from">${object.user_id.email or ''}</field>
+            <field name="email_from">${object.user_id.email or ''|safe}</field>
             <field name="subject">${object.company_id.name} ${object.state in ('draft', 'sent') and 'Quotation' or 'Order'} (Ref ${object.name or 'n/a' })</field>
             <field name="email_recipients">${object.partner_invoice_id.id}</field>
             <field name="model_id" ref="sale.model_sale_order"/>
@@ -95,7 +95,7 @@
 
         <record id="email_template_edi_invoice" model="email.template">
             <field name="name">Invoice - Send by Email (Portal)</field>
-            <field name="email_from">${object.user_id.email or object.company_id.email or 'noreply@localhost'}</field>
+            <field name="email_from">${object.user_id.email or object.company_id.email or 'noreply@localhost'|safe}</field>
             <field name="subject">${object.company_id.name} Invoice (Ref ${object.number or 'n/a' })</field>
             <field name="email_recipients">${object.partner_id.id}</field>
             <field name="model_id" ref="account.model_account_invoice"/>
diff --git a/addons/purchase/edi/purchase_order_action_data.xml b/addons/purchase/edi/purchase_order_action_data.xml
index 3b02be574ef..19b4d14b2be 100644
--- a/addons/purchase/edi/purchase_order_action_data.xml
+++ b/addons/purchase/edi/purchase_order_action_data.xml
@@ -19,7 +19,7 @@
         <!--Email template -->
         <record id="email_template_edi_purchase" model="email.template">
             <field name="name">Purchase Order - Send by mail</field>
-            <field name="email_from">${object.validator.email or ''}</field>
+            <field name="email_from">${object.validator.email or ''|safe}</field>
             <field name="subject">${object.company_id.name} Order (Ref ${object.name or 'n/a' })</field>
             <field name="email_recipients">${object.partner_id.id}</field>
             <field name="model_id" ref="purchase.model_purchase_order"/>
diff --git a/addons/sale/edi/sale_order_action_data.xml b/addons/sale/edi/sale_order_action_data.xml
index 16712532285..fe289559584 100644
--- a/addons/sale/edi/sale_order_action_data.xml
+++ b/addons/sale/edi/sale_order_action_data.xml
@@ -20,7 +20,7 @@
         <!--Email template -->
         <record id="email_template_edi_sale" model="email.template">
             <field name="name">Sales Order - Send by Email</field>
-            <field name="email_from">${object.user_id.email or ''}</field>
+            <field name="email_from">${object.user_id.email or ''|safe}</field>
             <field name="subject">${object.company_id.name} ${object.state in ('draft', 'sent') and 'Quotation' or 'Order'} (Ref ${object.name or 'n/a' })</field>
             <field name="email_recipients">${object.partner_invoice_id.id}</field>
             <field name="model_id" ref="sale.model_sale_order"/>