[FIX] mail.py: escape plaintext email

A plaintext email is displayed in a `<pre/>` tag to conserve spacing. But since there is no escaping, if in this text there was XML tags or HTML entities, they would appear as HTML in browser which is not wanted. Do note that this was not a security issue since the content will still be subjected to the checks and foundling of HTML emails. Without the change, the added test would fail because character &,<,> were not escaped. opw-2242323 closes #50003 closes odoo/odoo#50101 X-original-commit: 932532b5 Signed-off-by: Nicolas Lempereur (nle) <nle@odoo.com> Signed-off-by: Martin Trigaux (mat) <mat@odoo.com>

[FIX] mail.py: escape plaintext email
acee06aa · Nicolas Lempereur · 4e97aec6 · acee06aa · acee06aa
Commit acee06aa authored 5 years ago by Nicolas Lempereur
--- a/odoo/addons/base/tests/test_mail.py
+++ b/odoo/addons/base/tests/test_mail.py
@@ -317,6 +317,8 @@ class TestHtmlTools(BaseCase):
             '<!DOCTYPE...><html encoding="blah">some <b>content</b>\n<pre>--\nYours truly</pre>\n</html>'),
            ('<!DOCTYPE...><HTML encoding="blah">some <b>content</b></HtMl>', '--\nYours truly', True, False, False,
             '<!DOCTYPE...><html encoding="blah">some <b>content</b>\n<p>--<br/>Yours truly</p>\n</html>'),
+            ('<html><body>some <b>content</b></body></html>', '--\nYours & <truly>', True, True, False,
+             '<html><body>some <b>content</b>\n<pre>--\nYours &amp; &lt;truly&gt;</pre>\n</body></html>'),
            ('<html><body>some <b>content</b></body></html>', '<!DOCTYPE...>\n<html><body>\n<p>--</p>\n<p>Yours truly</p>\n</body>\n</html>', False, False, False,
             '<html><body>some <b>content</b>\n\n\n<p>--</p>\n<p>Yours truly</p>\n\n\n</body></html>'),
        ]

--- a/odoo/tools/mail.py
+++ b/odoo/tools/mail.py
@@ -392,7 +392,7 @@ def append_content_to_html(html, content, plaintext=True, preserve=False, contai
    """
    html = ustr(html)
    if plaintext and preserve:
-        content = u'\n<pre>%s</pre>\n' % ustr(content)
+        content = u'\n<pre>%s</pre>\n' % misc.html_escape(ustr(content))
    elif plaintext:
        content = '\n%s\n' % plaintext2html(content, container_tag)
    else: