Wednesday, April 23, 2025
1 change · 17.0
Security fixes and vulnerability patches
This update fixes how editor banner titles are handled so translated text remains available correctly and title text is safely displayed. It reduces the risk of malicious content being injected into the page while preserving the expected editor experience.
Original PR description
### Description of the issue/feature this PR addresses: - The `_t` call was used with non-static string (title), which breaks translation extraction since only static strings can be exported to .pot files. - Additionally, the title was directly injected into the DOM without escaping posing an XSS (Cross-Site Scripting) risk. ### Desired behavior after PR is merged: - The `_t` call is removed, as title passed to `_getBannerCommand` is already a translated static string. The value is now also passed through `htmlEscape()` before being used in the aria-label attribute, preventing any injected HTML from being rendered or executed. task-4639885 --- I confirm I have signed the CLA and read the PR guidelines at www.odoo.com/submit-pr