From 399e2bcf6dd16955e04f57f52c292f708beaa040 Mon Sep 17 00:00:00 2001 From: Olivier Dony Date: Fri, 8 Jul 2016 14:26:26 +0200 Subject: [PATCH] [FIX] ir.attachment: simplify xhtml-like mimetypes matching Simplify/complements revision f6090e69e648d5891cb887e82fbfcbc868b574ac, forcing text/plain for xml-like files. Ignore forced `mimetype` when downloading attachments, if the model has its own mimetype or if we can guess it. `default_mimetype` still available as a fallback. See also the list of mimetypes supported by common browsers, e.g.: - Firefox: CParserContext::SetMimeType in: https://hg.mozilla.org/firefox/file/default/parser/htmlparser/CParserContext.cpp - Chrome: kSupportedNonImageTypes constant: https://cs.chromium.org/chromium/src/components/mime_util/mime_util.cc?sq=package:chromium&rcl=1467904650&l=89 --- openerp/addons/base/ir/ir_attachment.py | 9 +++------ openerp/addons/base/ir/ir_http.py | 5 ++--- 2 files changed, 5 insertions(+), 9 deletions(-) diff --git a/openerp/addons/base/ir/ir_attachment.py b/openerp/addons/base/ir/ir_attachment.py index 243fd7222de..80699e28086 100644 --- a/openerp/addons/base/ir/ir_attachment.py +++ b/openerp/addons/base/ir/ir_attachment.py @@ -212,12 +212,9 @@ class ir_attachment(osv.osv): def _check_contents(self, cr, uid, values, context=None): mimetype = values['mimetype'] = self._compute_mimetype(values) - needs_escape = 'htm' in mimetype or '/ht' in mimetype # hta, html, xhtml, etc. - if needs_escape and not self.pool['res.users']._is_admin(cr, uid, [uid]): - if 'datas' in values: - values['datas'] = html_escape(values['datas'].decode('base64')).encode('base64') - else: - values['mimetype'] = 'text/plain' + xml_like = 'ht' in mimetype or 'xml' in mimetype # hta, html, xhtml, etc. + if xml_like and not self.pool['res.users']._is_admin(cr, uid, [uid]): + values['mimetype'] = 'text/plain' return values def _index(self, cr, uid, bin_data, datas_fname, file_type): diff --git a/openerp/addons/base/ir/ir_http.py b/openerp/addons/base/ir/ir_http.py index e04bd270eea..90f03470696 100644 --- a/openerp/addons/base/ir/ir_http.py +++ b/openerp/addons/base/ir/ir_http.py @@ -295,10 +295,9 @@ class ir_http(osv.AbstractModel): filename = "%s-%s-%s" % (obj._model._name, obj.id, field) # mimetype + mimetype = 'mimetype' in obj and obj.mimetype or False if not mimetype: - if 'mimetype' in obj and obj.mimetype and obj.mimetype != 'application/octet-stream': - mimetype = obj.mimetype - elif filename: + if filename: mimetype = mimetypes.guess_type(filename)[0] if not mimetype and getattr(env[model]._fields[field], 'attachment', False): # for binary fields, fetch the ir_attachement for mimetype check