Daily updates from Odoo
Thursday, February 1, 2024
2 changes · 17.0
Security fixes and vulnerability patches
This update fixes a security vulnerability where HTML code submitted through website contact forms was being rendered as formatted text in emails instead of being treated as plain text. Now all form submissions are properly escaped to display HTML tags as regular text, preventing unintended formatting and potential security issues in received emails and job applications.
Original PR description
Description of the issue/feature this PR addresses: Escape HTML whenever a field is sent through email such as in the contact us form. Current behavior before PR: HTML was supported when an email was sent through the contact us form. Desired behavior after PR is merged: HTML is now escaped. Forward-Port-Of: odoo/odoo#151396 Forward-Port-Of: odoo/odoo#149968
Resolved issues and error corrections
The reCAPTCHA security feature was using an invalid default score of 0.5, which doesn't comply with Google's requirements. This fix updates the score to use one of Google's approved values (0.1, 0.3, 0.7, or 0.9) to ensure proper security validation and compliance with Google's reCAPTCHA Enterprise standards.
Original PR description
The reCaptcha score was set by default on 0.5. According to [Google's documentation], that score isn't valid by default. It should be one of 0.1, 0.3, 0.7, 0.9. To use other values you must first go through a security review from reCaptcha. [Google's documentation]: https://cloud.google.com/recaptcha-enterprise/docs/interpret-assessment-website#before_you_begin task-3585213 Forward-Port-Of: odoo/odoo#151929 Forward-Port-Of: odoo/odoo#150208