[IMP] base: add support to company_dependent for html fields

Issue:

 Html fields cannot add company_dependent

Cause:

 Neven have html type for company property

Solution:

 Add html type inside ir.property

closes odoo/odoo#121243

Signed-off-by: Rémy Voet <ryv@odoo.com>

odoo/addons/base/models/ir_property.py

@@ -17,6 +17,7 @@ TYPE2FIELD = {
     'date': 'value_datetime',
     'datetime': 'value_datetime',
     'selection': 'value_text',
+    'html': 'value_text',
 }
 
 TYPE2CLEAN = {
@@ -29,6 +30,7 @@ TYPE2CLEAN = {
     'binary': lambda val: val or False,
     'date': lambda val: val.date() if val else False,
     'datetime': lambda val: val or False,
+    'html': lambda val: val or False,
 }
 
 
@@ -56,6 +58,7 @@ class Property(models.Model):
                              ('date', 'Date'),
                              ('datetime', 'DateTime'),
                              ('selection', 'Selection'),
+                             ('html', 'Html'),
                              ],
                             required=True,
                             default='many2one',

odoo/addons/test_new_api/models/test_new_api.py

@@ -585,6 +585,8 @@ class CompanyDependent(models.Model):
     truth = fields.Boolean(company_dependent=True)
     count = fields.Integer(company_dependent=True)
     phi = fields.Float(company_dependent=True, digits=(2, 5))
+    html1 = fields.Html(company_dependent=True, sanitize=False)
+    html2 = fields.Html(company_dependent=True, sanitize_attributes=True, strip_classes=True, strip_style=True)
 
 
 class CompanyDependentAttribute(models.Model):

odoo/addons/test_new_api/tests/test_new_fields.py

@@ -1664,6 +1664,85 @@ class TestFields(TransactionCaseWithUserDemo):
             'not in': ([tag1.id, tag2.id], [tag2.id, False], [False], []),
         })
 
+    def test_29_company_dependent_html(self):
+        company0 = self.env.ref('base.main_company')
+        company1 = self.env['res.company'].create({'name': 'A'})
+        company2 = self.env['res.company'].create({'name': 'B'})
+
+        user0 = self.env['res.users'].create({
+            'name': 'Foo', 'login': 'foo', 'company_id': company0.id,
+            'company_ids': [Command.set([company0.id, company1.id, company2.id])]})
+        user1 = self.env['res.users'].create({
+            'name': 'Bar', 'login': 'bar', 'company_id': company1.id,
+            'company_ids': [Command.set([company0.id, company1.id, company2.id])]})
+        user2 = self.env['res.users'].create({
+            'name': 'Baz', 'login': 'baz', 'company_id': company2.id,
+            'company_ids': [Command.set([company0.id, company1.id, company2.id])]})
+
+        some_ugly_html_0 = """<p>Oops this should maybe be sanitized
+% if object.some_field and not object.oriented:
+<table>
+    % if object.other_field:
+    <tr style="margin: 0px; border: 10px solid black;">
+        ${object.mako_thing}
+        <td>
+    </tr>
+    <tr class="custom_class">
+        This is some html.
+    </tr>
+    % endif
+    <tr>
+%if object.dummy_field:
+        <p>user0</p>
+%endif"""
+
+        some_ugly_html_1 = """<p>Oops this should maybe be sanitized
+% if object.some_field and not object.oriented:
+<table>
+    % if object.other_field:
+    <tr style="margin: 0px; border: 10px solid black;">
+        ${object.mako_thing}
+        <td>
+    </tr>
+    <tr class="custom_class">
+        This is some html.
+    </tr>
+    % endif
+    <tr>
+%if object.dummy_field:
+        <p>user1</p>
+%endif"""
+
+        record = self.env['test_new_api.company'].create({
+            'html1': some_ugly_html_0,
+            'html2': some_ugly_html_0,
+        })
+
+        self.assertEqual(record.with_user(user0).html1, some_ugly_html_0, 'Error in HTML field: content was sanitized but field has sanitize=False')
+        self.assertEqual(record.with_user(user1).html1, False)
+        self.assertEqual(record.with_user(user2).html1, False)
+
+        # sanitize should have closed tags left open in the original html for user0
+        self.assertIn('</table>', record.with_user(user0).html2, 'Error in HTML field: content does not seem to have been sanitized despise sanitize=True')
+        self.assertIn('</td>', record.with_user(user0).html2, 'Error in HTML field: content does not seem to have been sanitized despise sanitize=True')
+        self.assertNotIn('<tr class="', record.with_user(user0).html2, 'Class attr should have been stripped')
+        self.assertNotIn('<tr style="', record.with_user(user0).html2, 'Style attr should have been stripped')
+
+        record.with_user(user1).write({
+            'html1': some_ugly_html_1,
+            'html2': some_ugly_html_1,
+        })
+
+        self.assertEqual(record.with_user(user0).html1, some_ugly_html_0, 'Error in HTML field: content was sanitized but field has sanitize=False')
+        self.assertEqual(record.with_user(user1).html1, some_ugly_html_1, 'Error in HTML field: content was sanitized but field has sanitize=False')
+        self.assertEqual(record.with_user(user2).html1, False)
+
+        # sanitize should have closed tags left open in the original html for user1
+        self.assertIn('</table>', record.with_user(user1).html2, 'Error in HTML field: content does not seem to have been sanitized despise sanitize=True')
+        self.assertIn('</td>', record.with_user(user1).html2, 'Error in HTML field: content does not seem to have been sanitized despise sanitize=True')
+        self.assertNotIn('<tr class="', record.with_user(user1).html2, 'Class attr should have been stripped')
+        self.assertNotIn('<tr style="', record.with_user(user1).html2, 'Style attr should have been stripped')
+
     def test_30_read(self):
         """ test computed fields as returned by read(). """
         discussion = self.env.ref('test_new_api.discussion_0')