Friday, April 7, 2023
1 change · master
Security fixes and vulnerability patches
Point of Sale receipt header and footer fields now accept plain text only instead of rendering embedded HTML. This removes a security risk while still allowing businesses to add custom receipt formatting through approved add-on customization.
Original PR description
Currently, the "receipt_header" and "receipt_footer" text fields of the 'pos.config' model can be rendered as html in the receipt screen. We are now removing this feature because it poses some security issues. After this commit, only regular string can displayed as receipt and footer headers. If user wants to introduce custom markup in the headers, they can properly do so by extending the OrderReceipt template from other addons. TASK-ID: 3256208 --- I confirm I have signed the CLA and read the PR guidelines at www.odoo.com/submit-pr