Thursday, February 1, 2024
1 change · 17.0
Security fixes and vulnerability patches
This update fixes a security vulnerability where HTML code submitted through website contact forms was being rendered as formatted text in emails instead of being treated as plain text. Now all form submissions are properly escaped to display HTML tags as regular text, preventing unintended formatting and potential security issues in received emails and job applications.
Original PR description
Description of the issue/feature this PR addresses: Escape HTML whenever a field is sent through email such as in the contact us form. Current behavior before PR: HTML was supported when an email was sent through the contact us form. Desired behavior after PR is merged: HTML is now escaped. Forward-Port-Of: odoo/odoo#151396 Forward-Port-Of: odoo/odoo#149968