From e0a1381c3fc38517cf02abcea76766714bddb763 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Krier?= <ced@b2ck.com>
Date: Fri, 10 Jul 2020 09:00:01 +0200
Subject: [PATCH] Sanitize translated RichtText fields content

issue9453
review305991002
---
 CHANGELOG        | 1 +
 src/view/form.js | 8 ++++----
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index 02050c6681..4a657298b2 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -1,3 +1,4 @@
+* Sanitize translated RichtText fields content (issue9453)
 * Allow configuration of default colors for graph and calendar
 * Sanitize RichtText fields content (issue9405)
 * Escape external string (issue9394)
diff --git a/src/view/form.js b/src/view/form.js
index 924d86d555..09cef08f72 100644
--- a/src/view/form.js
+++ b/src/view/form.js
@@ -2342,12 +2342,12 @@ function eval_pyson(value){
             el.find('div[contenteditable]').prop('contenteditable', !value);
         },
         translate_widget_set: function(el, value) {
-            el.find('div[contenteditable]').html(value);
+            el.find('div[contenteditable]').html(
+                Sao.HtmlSanitizer.sanitize(value || ''));
         },
         translate_widget_get: function(el) {
-            var input = el.find('div[contenteditable]');
-            this._normalize(input);
-            return input.html();
+            return this._normalize_markup(
+                el.find('div[contenteditable]').html());
         }
     });