diff --git a/addons/web_editor/models/ir_qweb_fields.py b/addons/web_editor/models/ir_qweb_fields.py index af8e172e102..3cccf091d53 100644 --- a/addons/web_editor/models/ir_qweb_fields.py +++ b/addons/web_editor/models/ir_qweb_fields.py @@ -403,19 +403,25 @@ class HTML(models.AbstractModel): if options.get('inherit_branding'): field = record._fields[field_name] if field.sanitize: - if field.sanitize_overridable and not record.user_has_groups('base.group_sanitize_override'): - try: - field.convert_to_column(record[field_name], record) - except UserError: - # The field contains element(s) that would be removed if - # sanitized. It means that someone who was part of a - # group allowing to bypass the sanitation saved that - # field previously. Mark the field as not editable. - attrs['data-oe-sanitize-prevent-edition'] = 1 - if not (field.sanitize_overridable and record.user_has_groups('base.group_sanitize_override')): - # Don't mark the field as 'sanitize' if the sanitize is - # defined as overridable and the user has the right to do so - attrs['data-oe-sanitize'] = 1 if field.sanitize_form else 'allow_form' + if field.sanitize_overridable: + if record.user_has_groups('base.group_sanitize_override'): + # Don't mark the field as 'sanitize' if the sanitize + # is defined as overridable and the user has the right + # to do so + return attrs + else: + try: + field.convert_to_column(record[field_name], record) + except UserError: + # The field contains element(s) that would be + # removed if sanitized. It means that someone who + # was part of a group allowing to bypass the + # sanitation saved that field previously. Mark the + # field as not editable. + attrs['data-oe-sanitize-prevent-edition'] = 1 + return attrs + # The field edition is not fully prevented and the sanitation cannot be bypassed + attrs['data-oe-sanitize'] = 'no_block' if field.sanitize_attributes else 1 if field.sanitize_form else 'allow_form' return attrs diff --git a/addons/web_editor/static/src/js/editor/snippets.editor.js b/addons/web_editor/static/src/js/editor/snippets.editor.js index 5e9640ab41a..8a224822c13 100644 --- a/addons/web_editor/static/src/js/editor/snippets.editor.js +++ b/addons/web_editor/static/src/js/editor/snippets.editor.js @@ -3229,14 +3229,15 @@ var SnippetsMenu = Widget.extend({ * false: always fobid */ _insertDropzone: function ($hook, vertical, style, canBeSanitizedUnless) { + const skip = $hook.closest('[data-oe-sanitize="no_block"]').length; let forbidSanitize; if (canBeSanitizedUnless === 'form') { - forbidSanitize = $hook.closest('[data-oe-sanitize]:not([data-oe-sanitize="allow_form"])').length; + forbidSanitize = $hook.closest('[data-oe-sanitize]:not([data-oe-sanitize="allow_form"]):not([data-oe-sanitize="no_block"])').length; } else { - forbidSanitize = !canBeSanitizedUnless && $hook.closest('[data-oe-sanitize]').length; + forbidSanitize = !canBeSanitizedUnless && $hook.closest('[data-oe-sanitize]:not([data-oe-sanitize="no_block"])').length; } var $dropzone = $('
', { - 'class': 'oe_drop_zone oe_insert' + (vertical ? ' oe_vertical' : '') + + 'class': skip ? 'd-none' : 'oe_drop_zone oe_insert' + (vertical ? ' oe_vertical' : '') + (forbidSanitize ? ' text-center oe_drop_zone_danger' : ''), }); if (style) {