What is “secure” in the email template in the email_from field

Question

The Odoo Email Template uses email_from in the email template. in that I saw some kind of example like

${(object.email or '')|safe}

here is a screenshot

that I am confused with |safe , I wanted to know the use of '| safe '.

Answer 1

The structure will automatically remove the HTML. But when you need to prevent the escaping of an HTML template, you can use a "safe" filter. Using a safe filter for variables in which users have control can result in an XSS (JS injection) vulnerability.

Answer 2

Well Safe - these are mainly filters, filters are separated from the variable by the pipe symbol (|). Thus, the output of ${(object.email or '')|safe} will be generated as ${safe(object.email or '')} .

Safe is used to prevent escaping the HTML content template. The safe filter explicitly marks the string as "safe", so it should not be automatically escaped, even if auto-escaping by ODOO structure is enabled.

For more information, visit:

http://jinja.pocoo.org/docs/dev/templates/#working-with-manual-escaping http://jinja.pocoo.org/docs/dev/templates/#working-with-automatic-escaping