[tryton-commits] [tryton] [7.0] Escape title and text when rendering HTML editor

[Cédric Krier]

details:   https://code.tryton.org/tryton/commit/50500d0c24b5
branch:    7.0
user:      Cédric Krier <c...@b2ck.com>
date:      Wed Sep 30 09:39:21 2026 +0200
description:
        Escape title and text when rendering HTML editor

        Closes #15032
        (grafted from 0c76d2bc755882d3633a9452c585412f7847d797)
diffstat:

 trytond/CHANGELOG            |  2 ++
 trytond/trytond/ir/routes.py |  5 +++--
 2 files changed, 5 insertions(+), 2 deletions(-)

diffs (31 lines):

diff -r 75f14eab69ea -r 50500d0c24b5 trytond/CHANGELOG
--- a/trytond/CHANGELOG Wed Sep 30 15:13:05 2026 +0200
+++ b/trytond/CHANGELOG Wed Sep 30 09:39:21 2026 +0200
@@ -1,3 +1,5 @@
+* Escape title and text when rendering HTML editor (issue15032)
+* Allow trytond-admin to manage any user
 
 Version 7.0.57 - 2026-09-16
 ---------------------------
diff -r 75f14eab69ea -r 50500d0c24b5 trytond/trytond/ir/routes.py
--- a/trytond/trytond/ir/routes.py      Wed Sep 30 15:13:05 2026 +0200
+++ b/trytond/trytond/ir/routes.py      Wed Sep 30 09:39:21 2026 +0200
@@ -2,6 +2,7 @@
 # this repository contains the full copyright notices and license terms.
 import csv
 import datetime as dt
+import html
 import io
 import json
 from numbers import Number
@@ -92,8 +93,8 @@
                 'class': get_config(
                     ['class', model, field.name], default="''"),
                 'language': transaction.language,
-                'title': title,
-                'text': text,
+                'title': html.escape(title),
+                'text': html.escape(text),
                 'csrf_token': csrf_token,
                 'error': error,
                 }, status, content_type='text/html')