diff --git a/CHANGELOG b/CHANGELOG index 02050c6681..4a657298b2 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -1,3 +1,4 @@ +* Sanitize translated RichtText fields content (issue9453) * Allow configuration of default colors for graph and calendar * Sanitize RichtText fields content (issue9405) * Escape external string (issue9394) diff --git a/src/view/form.js b/src/view/form.js index 924d86d555..09cef08f72 100644 --- a/src/view/form.js +++ b/src/view/form.js @@ -2342,12 +2342,12 @@ function eval_pyson(value){ el.find('div[contenteditable]').prop('contenteditable', !value); }, translate_widget_set: function(el, value) { - el.find('div[contenteditable]').html(value); + el.find('div[contenteditable]').html( + Sao.HtmlSanitizer.sanitize(value || '')); }, translate_widget_get: function(el) { - var input = el.find('div[contenteditable]'); - this._normalize(input); - return input.html(); + return this._normalize_markup( + el.find('div[contenteditable]').html()); } });