From 60ffb6854b2f74d44f220ed4a6f79595157a3bca Mon Sep 17 00:00:00 2001 From: Xavier Morel Date: Fri, 13 Nov 2020 07:45:43 +0000 Subject: [PATCH] [IMP] core: broken symbols on upload closes odoo/odoo#64920 X-original-commit: 9ea507358f21ad836970610fd384dd41e39b99ef Signed-off-by: Thibault Delavallee (tde) --- addons/web/controllers/main.py | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/addons/web/controllers/main.py b/addons/web/controllers/main.py index c651ac9bce7..559ba04698f 100644 --- a/addons/web/controllers/main.py +++ b/addons/web/controllers/main.py @@ -102,6 +102,7 @@ db_list = http.db_list db_monodb = http.db_monodb +def clean(name): return name.replace('\x3c', '') def serialize_exception(f): @functools.wraps(f) def wrap(*args, **kwargs): @@ -1566,7 +1567,7 @@ class Binary(http.Controller): ufile.content_type, pycompat.to_text(base64.b64encode(data))] except Exception as e: args = [False, str(e)] - return out % (json.dumps(callback), json.dumps(args)) if callback else json.dumps(args) + return out % (json.dumps(clean(callback)), json.dumps(args)) if callback else json.dumps(args) @http.route('/web/binary/upload_attachment', type='http', auth="user") @serialize_exception @@ -1599,12 +1600,12 @@ class Binary(http.Controller): _logger.exception("Fail to upload attachment %s" % ufile.filename) else: args.append({ - 'filename': filename, + 'filename': clean(filename), 'mimetype': ufile.content_type, 'id': attachment.id, 'size': attachment.file_size }) - return out % (json.dumps(callback), json.dumps(args)) if callback else json.dumps(args) + return out % (json.dumps(clean(callback)), json.dumps(args)) if callback else json.dumps(args) @http.route([ '/web/binary/company_logo',