Tuesday, October 10, 2023
1 change · master
Features or functions removed from Odoo
This change removes a little-used duplicate text escaping function and makes the standard escaping behavior more complete. It helps keep web and mail-related code simpler while maintaining safer handling of quotes in displayed values.
Original PR description
In https://github.com/odoo/odoo/commit/a6fea376bb2e75f2ca617811f41d83768c078f85, escapeHTML was introduced to replace the corresponding
underscore.js function. It is very similar to the widely used escape
function, except it additionally escapes single (') and double (")
quotes.
The additional escaping is not generally harmful, and is necessary to
safely inject values into attributes. As escapeHTML is almost unused,
remove it and update escape to include quotes.
taskId : 3522892