[14.0][FIX] document_page: Stored XSS

[SergiCForgeFlow]

Currently Knowledge pages are vulnerable to stored XSS attacks. This is because the 'content' field is type Text, so it doesn't receive the default sanitize provided by Html fields.

This PR solves this, changing 'content' field to type Html.

[OriolMForgeFlow]

LGTM!

[pedrobaeza]

All existing contents that are not HTML will show incorrectly after this change. You need to incorporate a migration script that converts them to HTML.

[PabloEForgeFlow]

It might be worth adding a test which verifies that the content is indeed sanitized after writing the record.

[SergiCForgeFlow]

All existing contents that are not HTML will show incorrectly after this change. You need to incorporate a migration script that converts them to HTML.

All existing contents currently are stored in a HTML format. Regardless of whether the Field is type Text, the editor takes the input, generates and stores the data in a HTML format.

[pedrobaeza]

/ocabot merge nobump

[OCA-git-bot]

Hey, thanks for contributing! Proceeding to merge this for you.
Prepared branch 14.0-ocabot-merge-pr-426-by-pedrobaeza-bump-nobump, awaiting test results.

[SergiCForgeFlow]

All existing contents that are not HTML will show incorrectly after this change. You need to incorporate a migration script that converts them to HTML.

All existing contents currently are stored in a HTML format. Regardless of whether the Field is type Text, the editor takes the input, generates and stores the data in a HTML format.

Field 'content' on 'document.page' model is compute. So when Field Type is changed to HTML this receives default sanitize. This data is computed from 'content' field on model 'document.page.history', which is stored. If some 'content' data was malicious the malicious script is still stored on the database on model 'document.page.history'. That's why I have added post-migration script on the recent commit. Just by reassigning the content data, now this field also receives default HTML sanitize and the script is completely erased from database.

[OCA-git-bot]

@pedrobaeza The merge process could not be finalized, because command git push origin 14.0-ocabot-merge-pr-426-by-pedrobaeza-bump-nobump:14.0 failed with output:

To https://github.com/OCA/knowledge
 ! [rejected]          14.0-ocabot-merge-pr-426-by-pedrobaeza-bump-nobump -> 14.0 (fetch first)
error: failed to push some refs to 'https://***@github.com/OCA/knowledge'
hint: Updates were rejected because the remote contains work that you do
hint: not have locally. This is usually caused by another repository pushing
hint: to the same ref. You may want to first integrate the remote changes
hint: (e.g., 'git pull ...') before pushing again.
hint: See the 'Note about fast-forwards' in 'git push --help' for details.

[OCA-git-bot]

Congratulations, your PR was merged at 002e1b8. Thanks a lot for contributing to OCA. ❤️