[tryton-commits] [tryton] [default] Escape title and text when rendering HTML editor

[Cédric Krier]

details:   https://code.tryton.org/tryton/commit/0c76d2bc7558
branch:    default
user:      Cédric Krier <c...@b2ck.com>
date:      Wed Sep 30 09:39:21 2026 +0200
description:
        Escape title and text when rendering HTML editor

        Closes #15032
diffstat:

 trytond/CHANGELOG            |  1 +
 trytond/trytond/ir/routes.py |  5 +++--
 2 files changed, 4 insertions(+), 2 deletions(-)

diffs (30 lines):

diff -r 38edbf96602b -r 0c76d2bc7558 trytond/CHANGELOG
--- a/trytond/CHANGELOG Thu Oct 01 15:32:58 2026 +0200
+++ b/trytond/CHANGELOG Wed Sep 30 09:39:21 2026 +0200
@@ -1,3 +1,4 @@
+* Escape title and text when rendering HTML editor (issue15032)
 * Allow trytond-admin to manage any user
 * Add bulk_create, bulk_delete, bulk_save and bulk_func to ModelStorage
 * Add editable state on field
diff -r 38edbf96602b -r 0c76d2bc7558 trytond/trytond/ir/routes.py
--- a/trytond/trytond/ir/routes.py      Thu Oct 01 15:32:58 2026 +0200
+++ b/trytond/trytond/ir/routes.py      Wed Sep 30 09:39:21 2026 +0200
@@ -3,6 +3,7 @@
 import csv
 import datetime as dt
 import hashlib
+import html
 import io
 import json
 import os.path
@@ -306,8 +307,8 @@
                     'class': get_config(
                         ['class', model, field.name], default="''"),
                     'language': transaction.language,
-                    'title': title,
-                    'text': text,
+                    'title': html.escape(title),
+                    'text': html.escape(text),
                     'csrf_token': csrf_token,
                     'error': error,
                     }, status, content_type='text/html')