pengyuthon/odoo_source
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[FIX] web: quotes and backslashes in search view

Browse Source 
The commit 6d3ada178f
aimed to solve problems occuring whith (single or
double) quotes when creating new custom filters.
Unfortunately, the point was missed and bugs were
still present. The present commit solves the
orginial problem satisfactorily.
There was also a problem in the management of
backslashes. Type '\\' in the search bar would
lead to a domain like
[('...', 'ilike', '\\\\\\\\\\\\\\\\')].
This has also been fixed. Note that it is
necessary to input "\\" if one is looking for a
backslash in db (as before).

A remark on the _formatAST function (py_utils.js):

We deescape only the chars `'`, `"`, and `\`
because it does not seem possible to produce a
string in the search view that would intend a
search for a line return or a tab for example.

A general remark:

Domains should always be in normalized form.
In that way they could be manipulated and combined
together without a tokenization/parsing!

closes odoo/odoo#29756
This commit is contained in:
Mathieu Duckerts-Antoine
2019-02-12 12:45:51 +00:00
parent 6d5a993cf7
commit 01c159fd9f
9 changed files with 78 additions and 57 deletions
Download Patch File Download Diff File Expand all files Collapse all files
addons/web/static/lib/py.js/lib/py.js
+1 -8
View File
@@ -273,8 +273,7 @@ var py = {};
var Special = '[:;.,`@]';
var Funny = group(Operator, Bracket, Special);
var ContStr = group("([uU])?'([^']*)'", '([uU])?"([^"]*)"');
var ContStr = group("([uU])?'([^\n'\\\\]*(?:\\\\.[^\n'\\\\]*)*)'", '([uU])?"([^\n"\\\\]*(?:\\\\.[^\n"\\\\]*)*)"');
var PseudoToken = Whitespace + group(Number, Funny, ContStr, Name);
var number_pattern = new RegExp('^' + Number + '$');
@@ -282,9 +281,6 @@ var py = {};
var name_pattern = new RegExp('^' + Name + '$');
var strip = new RegExp('^' + Whitespace);
return function tokenize(s) {
s = s
.replace(/\\\"/g, '\\u0022') // for double quote
.replace(/\\\'/g, '\\u0027'); // for single quote
var max=s.length, tokens = [], start, end;
// /g flag makes repeated exec() have memory
var pseudoprog = new RegExp(PseudoToken, 'g');
@@ -313,9 +309,6 @@ var py = {};
} else if (string_pattern.test(token)) {
var m = string_pattern.exec(token);
var value = (m[3] !== undefined ? m[3] : m[5]);
value
.replace(/\\u0022/g, '"')
.replace(/\\u0027/g, "'");
tokens.push(create(symbols['(string)'], {
unicode: !!(m[2] || m[4]),
value: value
addons/web/static/src/js/core/py_utils.js
+9 -1
View File
@@ -415,7 +415,15 @@ function _formatAST(ast, lbp) {
case "(number)":
return String(ast.value);
case "(string)":
return "'" + ast.value + "'";
// ast.value is a string that may contain a mix of single and double quotes.
// But we need to return a string that represents the string ast.value.
// We use for that JSON.stringify. It will return a string with quotes correctly
// escaped. For instance, for x = `""` JSON.stringify(x) is `"\"\""`.
// But this means that if we pass several times here, escapes will be
// done again and again, leading to a profusion of backslashes that we don't want.
// For fun consider y = `\\` and y = JSON.stringify(y).
// This is why we first deescape particular characters in ast.value.
return JSON.stringify(ast.value.replace(/(\\(['"\\]))/g,"\$2"));
case "(constant)":
return ast.value;
case "(name)":
addons/web/static/src/js/views/control_panel/search/filter_menu.js
-2
View File
@@ -89,8 +89,6 @@ var FilterMenu = DropdownMenu.extend({
domain: Domain.prototype.arrayToString(preFilter.attrs.domain),
};
});
// TO DO intercepts 'new_filters' and decide what to do whith filters
// rewrite web.search_filters?
this.trigger_up('new_filters', {filters: filters});
_.invoke(this.propositions, 'destroy');
this.propositions = [];
addons/web/static/src/js/views/control_panel/search/search_filters.js
-9
View File
@@ -171,15 +171,6 @@ var Char = Field.extend({
{value: "∃", text: _lt("is set")},
{value: "∄", text: _lt("is not set")}
],
get_domain: function (field, operator) {
switch (operator.value) {
case '∃': return [[field.name, '!=', false]];
case '∄': return [[field.name, '=', false]];
// does not work in all cases
// default: return "[('" + field.name + "', '" + operator.value + "', '" + this.get_value() + "')]";
default: return [[field.name, operator.value, this.get_value()]];
}
},
get_value: function () {
return this.$el.val();
}
addons/web/static/tests/chrome/action_manager_tests.js
+1 -1
View File
@@ -3133,7 +3133,7 @@ QUnit.module('ActionManager', {
intercepts: {
create_filter: function (event) {
var filter = event.data.filter;
assert.deepEqual(filter.domain, "[('bar', '=', 1)]",
assert.deepEqual(filter.domain, `[("bar", "=", 1)]`,
"should save the correct domain");
assert.deepEqual(filter.context, {shouldBeInFilterContext: true},
"should save the correct context");
addons/web/static/tests/core/py_utils_tests.js
+14 -21
View File
@@ -1149,7 +1149,7 @@ QUnit.module('core', function () {
assert.checkAST("1.4", "float value");
assert.checkAST("-12", "negative integer value");
assert.checkAST("True", "boolean");
assert.checkAST("'some string'", "a string");
assert.checkAST(`"some string"`, "a string");
assert.checkAST("None", "None");
});
@@ -1157,8 +1157,8 @@ QUnit.module('core', function () {
assert.expect(3);
assert.checkAST("{}", "empty dictionary");
assert.checkAST("{'a': 1}", "dictionary with a single key");
assert.checkAST("d['a']", "get a value in a dictionary");
assert.checkAST(`{"a": 1}`, "dictionary with a single key");
assert.checkAST(`d["a"]`, "get a value in a dictionary");
});
QUnit.test("list", function (assert) {
@@ -1225,14 +1225,14 @@ QUnit.module('core', function () {
QUnit.test("strftime", function (assert) {
assert.expect(3);
assert.checkAST("time.strftime('%Y')", "strftime with year");
assert.checkAST("time.strftime('%Y') + '-01-30'", "strftime with year");
assert.checkAST("time.strftime('%Y-%m-%d %H:%M:%S')", "strftime with year");
assert.checkAST(`time.strftime("%Y")`, "strftime with year");
assert.checkAST(`time.strftime("%Y") + "-01-30"`, "strftime with year");
assert.checkAST(`time.strftime("%Y-%m-%d %H:%M:%S")`, "strftime with year");
});
QUnit.test("context_today", function (assert) {
assert.expect(1);
assert.checkAST("context_today().strftime('%Y-%m-%d')", "context today call");
assert.checkAST(`context_today().strftime("%Y-%m-%d")`, "context today call");
});
@@ -1250,17 +1250,10 @@ QUnit.module('core', function () {
assert.checkAST('(a - b).days', "substraction and .days");
assert.checkAST('a + day == date(2002, 3, 3)');
var expr = "[('type', '=', 'in'), ('day', '<=', time.strftime('%Y-%m-%d')), ('day', '>', (context_today() - datetime.timedelta(days = 15)).strftime('%Y-%m-%d'))]";
var expr = `[("type", "=", "in"), ("day", "<=", time.strftime("%Y-%m-%d")), ("day", ">", (context_today() - datetime.timedelta(days = 15)).strftime("%Y-%m-%d"))]`;
assert.checkAST(expr);
});
QUnit.test("parse escaped quoted strings", function (assert) {
assert.expect(2);
assert.checkAST(`'\"'`, "a string containing \"");
assert.checkAST(`'\'`, "a string containing \'");
});
QUnit.module('pyutils (_normalizeDomain)');
QUnit.assert.checkNormalization = function (domain, normalizedDomain) {
@@ -1278,23 +1271,23 @@ QUnit.module('core', function () {
assert.expect(3);
assert.checkNormalization("[]");
assert.checkNormalization("[('a', '=', 1)]");
assert.checkNormalization("['!', ('a', '=', 1)]");
assert.checkNormalization(`[("a", "=", 1)]`);
assert.checkNormalization(`["!", ("a", "=", 1)]`);
});
QUnit.test("properly add the & in a non normalized domain", function (assert) {
assert.expect(1);
assert.checkNormalization(
"[('a', '=', 1), ('b', '=', 2)]",
"['&', ('a', '=', 1), ('b', '=', 2)]"
`[("a", "=", 1), ("b", "=", 2)]`,
`["&", ("a", "=", 1), ("b", "=", 2)]`
);
});
QUnit.test("normalize domain with ! operator", function (assert) {
assert.expect(1);
assert.checkNormalization(
"['!', ('a', '=', 1), ('b', '=', 2)]",
"['&', '!', ('a', '=', 1), ('b', '=', 2)]"
`["!", ("a", "=", 1), ("b", "=", 2)]`,
`["&", "!", ("a", "=", 1), ("b", "=", 2)]`
);
});
addons/web/static/tests/views/search_filter_menu_tests.js
+47 -9
View File
@@ -1,9 +1,10 @@
odoo.define('web.search_filters_menu_tests', function (require) {
"use strict";
var FilterMenu = require('web.FilterMenu');
var testUtils = require('web.test_utils');
var Domain = require('web.Domain');
var FilterMenu = require('web.FilterMenu');
var pyUtils = require('web.py_utils');
var testUtils = require('web.test_utils');
function createFilterMenu(filters, fields, params) {
params = params || {};
@@ -134,33 +135,70 @@ QUnit.module('FilterMenu', {
filterMenu.destroy();
});
QUnit.skip('commit search with an extended proposition with field char does not cause a crash', function (assert) {
assert.expect(0);
QUnit.test('commit search with an extended proposition with field char does not cause a crash', function (assert) {
assert.expect(6);
this.fields = {many2one_field: {string: "Trululu", type: "many2one", relation: 'partner', selectable: true, searchable: true}};
var expectedDomains = [
[['many2one_field','ilike', `a`]],
[['many2one_field','ilike', `"a"`]],
[['many2one_field','ilike', `'a'`]],
[['many2one_field','ilike', `'`]],
[['many2one_field','ilike', `"`]],
[['many2one_field','ilike', `\\`]],
];
var filterMenu = createFilterMenu([], this.fields, {
intercepts: {
new_filters: function (ev) {
var filter = ev.data.filters[0];
Domain.prototype.stringToArray(filter.domain);
// this step combine a tokenization/parsing followed by a string formatting
var domain = pyUtils.assembleDomains([filter.domain]);
domain = Domain.prototype.stringToArray(domain);
assert.deepEqual(domain, expectedDomains.shift());
},
}
});
// open menu dropdown and custom filter submenu, select trululu field and enter string "a", then click apply
// open menu dropdown and custom filter submenu, select trululu field and enter string `a`, then click apply
testUtils.dom.click(filterMenu.$('span.fa-filter'));
testUtils.dom.click(filterMenu.$('.o_add_custom_filter'));
testUtils.fields.editSelect(filterMenu.$('.o_filter_condition select.o_input.o_searchview_extended_prop_field'), 'many2one_field');
testUtils.fields.editInput(filterMenu.$('.o_filter_condition .o_searchview_extended_prop_value input'), "a");
testUtils.fields.editInput(filterMenu.$('.o_filter_condition .o_searchview_extended_prop_value input'), `a`);
testUtils.dom.click(filterMenu.$('.o_apply_filter'));
// open custom filter submenu, select trululu field and enter string "'a'", then click apply
// open custom filter submenu, select trululu field and enter string `"a"`, then click apply
testUtils.dom.click(filterMenu.$('.o_add_custom_filter'));
testUtils.fields.editSelect(filterMenu.$('.o_filter_condition select.o_input.o_searchview_extended_prop_field'), 'many2one_field');
testUtils.fields.editInput(filterMenu.$('.o_filter_condition .o_searchview_extended_prop_value input'), '"a"');
testUtils.fields.editInput(filterMenu.$('.o_filter_condition .o_searchview_extended_prop_value input'), `"a"`);
testUtils.dom.click(filterMenu.$('.o_apply_filter'));
// open custom filter submenu, select trululu field and enter string `'a'`, then click apply
testUtils.dom.click(filterMenu.$('.o_add_custom_filter'));
testUtils.fields.editSelect(filterMenu.$('.o_filter_condition select.o_input.o_searchview_extended_prop_field'), 'many2one_field');
testUtils.fields.editInput(filterMenu.$('.o_filter_condition .o_searchview_extended_prop_value input'), `'a'`);
testUtils.dom.click(filterMenu.$('.o_apply_filter'));
// open custom filter submenu, select trululu field and enter string `'`, then click apply
testUtils.dom.click(filterMenu.$('.o_add_custom_filter'));
testUtils.fields.editSelect(filterMenu.$('.o_filter_condition select.o_input.o_searchview_extended_prop_field'), 'many2one_field');
testUtils.fields.editInput(filterMenu.$('.o_filter_condition .o_searchview_extended_prop_value input'), `'`);
testUtils.dom.click(filterMenu.$('.o_apply_filter'));
// open custom filter submenu, select trululu field and enter string `"`, then click apply
testUtils.dom.click(filterMenu.$('.o_add_custom_filter'));
testUtils.fields.editSelect(filterMenu.$('.o_filter_condition select.o_input.o_searchview_extended_prop_field'), 'many2one_field');
testUtils.fields.editInput(filterMenu.$('.o_filter_condition .o_searchview_extended_prop_value input'), `"`);
testUtils.dom.click(filterMenu.$('.o_apply_filter'));
// open custom filter submenu, select trululu field and enter string `\`, then click apply
testUtils.dom.click(filterMenu.$('.o_add_custom_filter'));
testUtils.fields.editSelect(filterMenu.$('.o_filter_condition select.o_input.o_searchview_extended_prop_field'), 'many2one_field');
testUtils.fields.editInput(filterMenu.$('.o_filter_condition .o_searchview_extended_prop_value input'), `\\`);
testUtils.dom.click(filterMenu.$('.o_apply_filter'));
filterMenu.destroy();
});
});
addons/web/static/tests/views/search_view_tests.js
+5 -5
View File
@@ -747,10 +747,10 @@ QUnit.module('Search View', {
create_filter: function (ev) {
assert.equal(
ev.data.filter.domain,
"['&', " +
"('date_field', '>=', (context_today() + relativedelta()).strftime('%Y-%m-%d')), " +
"('date_field', '<', (context_today() + relativedelta(days = 1)).strftime('%Y-%m-%d'))"+
"]");
`["&", ` +
`("date_field", ">=", (context_today() + relativedelta()).strftime("%Y-%m-%d")), ` +
`("date_field", "<", (context_today() + relativedelta(days = 1)).strftime("%Y-%m-%d"))`+
`]`);
},
},
});
@@ -838,7 +838,7 @@ QUnit.module('Search View', {
data: this.data,
intercepts: {
create_filter: function (ev) {
assert.ok(ev.data.filter.domain === "[['foo', 'ilike', 'a']]");
assert.ok(ev.data.filter.domain === `[["foo", "ilike", "a"]]`);
},
},
});
addons/web/static/tests/views/view_dialogs_tests.js
+1 -1
View File
@@ -443,7 +443,7 @@ QUnit.module('Views', {
intercepts: {
create_filter: function (event) {
var filter = event.data.filter;
assert.deepEqual(filter.domain, "[('bar', '=', True)]",
assert.deepEqual(filter.domain, `[("bar", "=", True)]`,
"should save the correct domain");
assert.deepEqual(filter.context, {shouldBeInFilterContext: true},
"should save the correct context");