escape html in plain text messages (#1326)

conditional_escape is used to prevent double escaping, ImapEmail.viewmail_plain()
in modoboa-webmail overrides this method and escapes content before calling
Email.viewmail_plain(), SQLemail in modoboa-amavis doesn't and can potentially
allow harmful html to be displayed.

modoboa/lib/email_utils.py

@@ -11,6 +11,7 @@ import time
 
 from django.conf import settings
 from django.utils.encoding import smart_text
+from django.utils.html import conditional_escape
 from django.template.loader import render_to_string
 from django.utils import six
 
@@ -199,6 +200,7 @@ class Email(object):
         })
 
     def viewmail_plain(self, content, **kwargs):
+        content = conditional_escape(content)
         return "<pre>%s</pre>" % content
 
     def viewmail_html(self, content, **kwargs):