Daily updates from Odoo
Monday, July 14, 2025
1 change
Security fixes and vulnerability patches
VoIP error messages now keep their line breaks while being treated as plain text instead of web page content. This improves message readability and reduces the risk of unsafe content being displayed.
Original PR description
To display line breaks in error messages, `voip.triggerError` replaced the `\n` with a `<br>` tag. This required taking some precautions to avoid making the error message an XSS vector. Rather than using `<br>` tags—and therefore promoting the error message to dangerous HTML—we now use the CSS property `white-space: pre-line`, which preserves line breaks in text nodes.