[FW][FIX] sale_quotation_builder: checkout product with blockquote description

[fw-bot]

Current behaviour

If we add a blockquote in the website_description of a product on the e-shop, we cannot checkout the product. Silent HTTP 400 error code, due to an exception raised by

odoo/odoo/fields.py

Lines 1987 to 1993 in bf77218

	raise UserError(_(
	"The field value you're saving (%s %s) includes content that is "
	"restricted for security reasons. It is possible that someone "
	"with higher privileges previously modified it, and you are therefore "
	"not able to modify it yourself while preserving the content.",
	record._description, self.string,
	))

Expected behaviour

You should be able to checkout products even if they have blockquote in their website_description.

Steps to reproduce

• Install eCommerce, sale_quotation_builder (issue is present only after installing sale_quotation_builder)
• On a product, with the website editor, add a blockquote to the description of the product > Save
• In a private browser window, as public user, visit the product on the e-shop and try to checkout with it.
• Observe there is no visible error, and we do not proceed in the checkout process.

Reason for the problem

The exception mentioned above is triggered when there is a difference between the html content that is saved in the DB and after sanitization, meaning that someone with escalated privilege saved the HTML content by overriding the sanitization with sanitize_overridable. In our use case the only diff is the presence of the attribute data-o-mail-quote-node which is removed after the sanitization.

Fix

This issue can be resolved two ways:

1. Adding data-o-mail-quote-node to the list of save attributes,
   meaning it will not be removed during the sanitization process.
   Since this is an attribute that we add on <blockquote> nodes,
   it can be considered safe, just like data-o-mail-quote.
2. Remove the attribute sanitization of the website_description,
   just like it is done in the website_sale module.
   Since the website_description and quotation_description are both
   computed from one-another, they should have the same sanitization
   level.
   I am implementing both solutions, 1) because adding the attribute to the safe list seems safe in general, and may prevent future issues of this sort. 2) because it is the root cause of the issue, since the bug is present only after installation of the sale_quotation_builder module.

Affected versions

• 16.0
• saas-16.1
• saas-16.2
• master

---

opw-3297237

---

I confirm I have signed the CLA and read the PR guidelines at www.odoo.com/submit-pr

Forward-Port-Of: #120764

[robodoo]

[fw-bot]

@pivi-odoo @xmo-odoo this PR targets master and is the last of the forward-port chain containing:

• [FW][FIX] sale_quotation_builder: checkout product with blockquote description #122139
• [FW][FIX] sale_quotation_builder: checkout product with blockquote description #122124
• [FW][FIX] sale_quotation_builder: checkout product with blockquote description #122102

To merge the full chain, say

@fw-bot r+

More info at https://github.com/odoo/odoo/wiki/Mergebot#forward-port

[pivi-odoo]

@fw-bot r+

[robodoo]

@pivi-odoo @xmo-odoo staging failed: ci/runbot on 9ee0749355ed1494e0a53b54aa34da01a71da286 (view more at https://runbot.odoo.com/runbot/build/40379721)

[pivi-odoo]

@robodoo retry