From 4bd8e3e2ed48eb05b9e155826fd47753a85b5731 Mon Sep 17 00:00:00 2001
From: rde <rde@odoo.com>
Date: Fri, 29 Sep 2017 13:48:33 +0200
Subject: [PATCH] [IMP] website: Script injected in DOM: window.onerror empty
 params

Before this commit, error thrown by scripts injected in DOM won't return a
clean error on window.onerror.
It would open the crash_manager's show_error's dialog that wouldn't display
any informations except "Script Error." and "Traceback:".
This is because of browser's security reason: it will just give you a
'Script error.' as message and nothing else for security issue.

Now, this kind of error will show a clearer message informing that it is
probably originating from a Javascript file served from a different origin.
There is now also the possibility for developers to handle/override the
behavior when this kind of error is catch to prevent the dialog to open for
example.

Might be of use:
https://blog.sentry.io/2016/05/17/what-is-script-error.html
https://stackoverflow.com/a/7778424
https://danlimerick.wordpress.com/2014/01/18/how-to-catch-javascript-errors-with-window-onerror-even-on-chrome-and-firefox/ (Search for Script Error)
---
 .../src/js/chrome/abstract_web_client.js      | 35 +++++++++++++++----
 .../static/src/js/backend/dashboard.js        |  5 +++
 .../static/src/xml/website.backend.xml        |  1 +
 3 files changed, 35 insertions(+), 6 deletions(-)

diff --git a/addons/web/static/src/js/chrome/abstract_web_client.js b/addons/web/static/src/js/chrome/abstract_web_client.js
index 9a629ec3393..febfecad0bc 100644
--- a/addons/web/static/src/js/chrome/abstract_web_client.js
+++ b/addons/web/static/src/js/chrome/abstract_web_client.js
@@ -167,12 +167,35 @@ var AbstractWebClient = Widget.extend(mixins.ServiceProvider, {
         // crash manager integration
         session.on('error', crash_manager, crash_manager.rpc_error);
         window.onerror = function (message, file, line, col, error) {
-            var traceback = error ? error.stack : '';
-            crash_manager.show_error({
-                type: _t("Odoo Client Error"),
-                message: message,
-                data: {debug: file + ':' + line + "\n" + _t('Traceback:') + "\n" + traceback}
-            });
+            // Scripts injected in DOM (eg: google API's js files) won't return a clean error on window.onerror.
+            // The browser will just give you a 'Script error.' as message and nothing else for security issue.
+            // To enable onerror to work properly with CORS file, you should:
+            //   1. add crossorigin="anonymous" to your <script> tag loading the file
+            //   2. enabling 'Access-Control-Allow-Origin' on the server serving the file.
+            // Since in some case it wont be possible to to this, this handle should have the possibility to be
+            // handled by the script manipulating the injected file. For this, you will use window.onOriginError
+            // If it is not handled, we should display something clearer than the common crash_manager error dialog
+            // since it won't show anything except "Script error."
+            // This link will probably explain it better: https://blog.sentry.io/2016/05/17/what-is-script-error.html
+            if (message === "Script error." && !file && !line && !col && !error) {
+                if (window.onOriginError) {
+                    window.onOriginError();
+                    delete window.onOriginError;
+                } else {
+                    crash_manager.show_error({
+                        type: _t("Odoo Client Error"),
+                        message: _t("Unknown CORS error"),
+                        data: {debug: _t("An unknown CORS error occured. The error probably originates from a JavaScript file served from a different origin.")},
+                    });
+                }
+            } else {
+                var traceback = error ? error.stack : '';
+                crash_manager.show_error({
+                    type: _t("Odoo Client Error"),
+                    message: message,
+                    data: {debug: file + ':' + line + "\n" + _t('Traceback:') + "\n" + traceback},
+                });
+            }
         };
     },
     set_action_manager: function () {
diff --git a/addons/website/static/src/js/backend/dashboard.js b/addons/website/static/src/js/backend/dashboard.js
index c48da63e59d..c140e61c3e5 100644
--- a/addons/website/static/src/js/backend/dashboard.js
+++ b/addons/website/static/src/js/backend/dashboard.js
@@ -198,10 +198,15 @@ var Dashboard = Widget.extend(ControlPanelMixin, {
             $analytics_components.empty();
             // 1. Authorize component
             var $analytics_auth = $('<div>').addClass('col-md-12');
+            window.onOriginError = function () {
+                $analytics_components.find('.js_unauthorized_message').remove();
+                self.display_unauthorized_message($analytics_components, 'not_initialized');
+            };
             gapi.analytics.auth.authorize({
                 container: $analytics_auth[0],
                 clientid: client_id
             });
+
             $analytics_auth.appendTo($analytics_components);
 
             self.handle_analytics_auth($analytics_components);
diff --git a/addons/website/static/src/xml/website.backend.xml b/addons/website/static/src/xml/website.backend.xml
index c96396ea9a9..e0d467489e6 100644
--- a/addons/website/static/src/xml/website.backend.xml
+++ b/addons/website/static/src/xml/website.backend.xml
@@ -89,6 +89,7 @@
     <div t-name="website.unauthorized_analytics" class="col-xs-12 js_unauthorized_message mb16">
         <span t-if="reason === 'not_connected'">You need to log in to your Google Account before: </span>
         <span t-if="reason === 'no_right'">You do not seem to have access to this Analytics Account.</span>
+        <span t-if="reason === 'not_initialized'">Google Analytics initialization failed. Maybe this domain is not whitelisted in your Google Analytics project for this client ID.</span>
     </div>
 
     <div t-name="website.ga_dialog_content">