[IMP]Website Blog: Make Onboarding tour user friendly and change customi...

...ze cover feature

- Task: https://www.odoo.com/web?debug=#id=8996&view_type=form&model=project.task&menu_id=3942&action=327
- Pad: https://pad.odoo.com/p/r.MnhQk73bZbMtu2Mv
We could try to inject `; DROP DATABASE openerp;` if `order` is not sanitized.
The ORM uses this regexp to check that order is an actual `order` clause https://github.com/odoo/odoo/blob/master/openerp/models.py#L76