[FIX] account, mail: defensively evaluate 'partner_to' on mail templates

MailTemplate model has a 'partner_to' field is dynamically rendered to contain
partners being recipients. After rendering it should hold a comma-separated
list of partner IDs.

However as we are unsure it was correctly written better be defensive. We now
check that we can effectively transform items to IDs using 'isdigit()'.

Task-2612945 (Mail: Defensive email formatting)

X-original-commit: f96834b
Part-of: #134374

addons/account/wizard/account_move_send.py

@@ -121,7 +121,7 @@ def _get_default_mail_partners(self, mail_template, lang, move):
                 partners |= partners.find_or_create(mail_data)
         if mail_template.partner_to:
             partner_to = self._get_mail_default_field_value_from_template(mail_template, lang, move, 'partner_to')
-            partner_ids = [int(pid) for pid in partner_to.split(',') if pid]
+            partner_ids = mail_template._parse_partner_to(partner_to)
             partners |= self.env['res.partner'].sudo().browse(partner_ids).exists()
         return partners
 

addons/mail/models/mail_template.py

@@ -375,18 +375,17 @@ def _generate_template_recipients(self, res_ids, render_fields,
 
         # update 'partner_to' rendered value to 'partner_ids'
         all_partner_to = {
-            int(pid)
+            pid
             for record_values in render_results.values()
-            for pid in record_values.get('partner_to', '').split(',')
-            if pid and pid.strip()
+            for pid in self._parse_partner_to(record_values.get('partner_to', ''))
         }
         existing_pids = set()
         if all_partner_to:
             existing_pids = set(self.env['res.partner'].sudo().browse(list(all_partner_to)).exists().ids)
         for res_id, record_values in render_results.items():
             partner_to = record_values.pop('partner_to', '')
             if partner_to:
-                tpl_partner_ids = set(int(pid) for pid in partner_to.split(',') if pid) & existing_pids
+                tpl_partner_ids = set(self._parse_partner_to(partner_to)) & existing_pids
                 record_values.setdefault('partner_ids', []).extend(tpl_partner_ids)
 
         return render_results
@@ -526,6 +525,13 @@ def _generate_template(self, res_ids, render_fields,
 
         return render_results
 
+    @classmethod
+    def _parse_partner_to(cls, partner_to):
+        return [
+            int(pid.strip()) for pid in partner_to.split(',')
+            if (pid and pid.strip().isdigit())
+        ]
+
     # ------------------------------------------------------------
     # EMAIL
     # ------------------------------------------------------------