[FIX] Wrap werkzeug.utils.escape() to accomodate signature change in 0.9

We always want to escape quotes (") as part of the process of
generating HTML output. This option (quote=True) turned into
an implicit flag with a DeprecationWarning in werkzeug 0.9.0
It is likely to disappear in a future release of werkzeug too.
A wrapper avoids this warning without loss of compatibility

addons/website/models/ir_qweb.py

@@ -25,6 +25,7 @@ import openerp.modules
 import openerp
 from openerp.osv import orm, fields
 from openerp.tools import ustr, DEFAULT_SERVER_DATE_FORMAT, DEFAULT_SERVER_DATETIME_FORMAT
+from openerp.tools import html_escape as escape
 from openerp.addons.web.http import request
 from openerp.addons.base.ir import ir_qweb
 
@@ -276,7 +277,7 @@ class Image(orm.AbstractModel):
                 url_params[options_key] = options[options_key]
 
         return ir_qweb.HTMLSafe('<img class="%s" src="/website/image?%s"/>' % (
-            ' '.join(itertools.imap(werkzeug.utils.escape, classes)),
+            ' '.join(itertools.imap(escape, classes)),
             werkzeug.urls.url_encode(url_params)
         ))
 

addons/website/models/website.py

@@ -27,6 +27,7 @@ except ImportError:
 
 import openerp
 from openerp.osv import orm, osv, fields
+from openerp.tools import html_escape as escape
 from openerp.tools.safe_eval import safe_eval
 from openerp.addons.web.http import request
 
@@ -728,7 +729,7 @@ class ir_attachment(osv.osv):
         for attachment in self.browse(cr, uid, ids, context=context):
             # in-document URLs are html-escaped, a straight search will not
             # find them
-            url = werkzeug.utils.escape(attachment.website_url)
+            url = escape(attachment.website_url)
             ids = Views.search(cr, uid, ["|", ('arch', 'like', '"%s"' % url), ('arch', 'like', "'%s'" % url)], context=context)
 
             if ids:

addons/website_event_track/controllers/event.py

@@ -24,9 +24,9 @@ import datetime
 import re
 
 import pytz
-import werkzeug.utils
 
 import openerp
+import openerp.tools
 from openerp.addons.web import http
 from openerp.addons.web.http import request
 
@@ -150,7 +150,7 @@ class website_event(http.Controller):
             if post.get('tag_'+str(tag.id)):
                 tags.append(tag.id)
 
-        e = werkzeug.utils.escape
+        e = openerp.tools.escape
         track_description = '''<section data-snippet-id="text-block">
     <div class="container">
         <div class="row">

openerp/addons/base/ir/ir_qweb.py

@@ -11,12 +11,12 @@ import xml  # FIXME use lxml and etree
 
 import babel
 import babel.dates
-import werkzeug.utils
 from PIL import Image
 
 import openerp.tools
-from openerp.tools.safe_eval import safe_eval as eval
 from openerp.osv import osv, orm, fields
+from openerp.tools import html_escape as escape
+from openerp.tools.safe_eval import safe_eval as eval
 from openerp.tools.translate import _
 
 _logger = logging.getLogger(__name__)
@@ -259,14 +259,14 @@ class QWeb(orm.AbstractModel):
                     for attribute in self._render_att:
                         if attribute_name[2:].startswith(attribute):
                             att, val = self._render_att[attribute](self, element, attribute_name, attribute_value, qwebcontext)
-                            generated_attributes += val and ' %s="%s"' % (att, werkzeug.utils.escape(val)) or " "
+                            generated_attributes += val and ' %s="%s"' % (att, escape(val)) or " "
                             break
                     else:
                         if attribute_name[2:] in self._render_tag:
                             t_render = attribute_name[2:]
                         template_attributes[attribute_name[2:]] = attribute_value
                 else:
-                    generated_attributes += ' %s="%s"' % (attribute_name, werkzeug.utils.escape(attribute_value))
+                    generated_attributes += ' %s="%s"' % (attribute_name, escape(attribute_value))
 
             if 'debug' in template_attributes:
                 debugger = template_attributes.get('debug', 'pdb')
@@ -454,7 +454,7 @@ class FieldConverter(osv.AbstractModel):
         """
         Generates the metadata attributes (prefixed by ``data-oe-`` for the
         root node of the field conversion. Attribute values are escaped by the
-        parent using ``werkzeug.utils.escape``.
+        parent.
 
         The default attributes are:
 
@@ -507,7 +507,7 @@ class FieldConverter(osv.AbstractModel):
                 record._model._all_columns[field_name].column,
                 options, context=context)
             if options.get('html-escape', True):
-                content = werkzeug.utils.escape(content)
+                content = escape(content)
             elif hasattr(content, '__html__'):
                 content = content.__html__()
         except Exception:
@@ -518,7 +518,7 @@ class FieldConverter(osv.AbstractModel):
         if context and context.get('inherit_branding'):
             # add branding attributes
             g_att += ''.join(
-                ' %s="%s"' % (name, werkzeug.utils.escape(value))
+                ' %s="%s"' % (name, escape(value))
                 for name, value in self.attributes(
                     cr, uid, field_name, record, options,
                     source_element, g_att, t_att, qweb_context)
@@ -841,7 +841,7 @@ class Contact(orm.AbstractModel):
 
         val = {
             'name': value.split("\n")[0],
-            'address': werkzeug.utils.escape("\n".join(value.split("\n")[1:])),
+            'address': escape("\n".join(value.split("\n")[1:])),
             'phone': field_browse.phone,
             'mobile': field_browse.mobile,
             'fax': field_browse.fax,
@@ -885,7 +885,7 @@ class QwebWidget(osv.AbstractModel):
         return self.pool['ir.qweb'].eval_str(inner, qwebcontext)
 
     def format(self, inner, options, qwebcontext):
-        return werkzeug.utils.escape(self._format(inner, options, qwebcontext))
+        return escape(self._format(inner, options, qwebcontext))
 
 class QwebWidgetMonetary(osv.AbstractModel):
     _name = 'ir.qweb.widget.monetary'
@@ -945,7 +945,7 @@ def nl2br(string, options=None):
     if options is None: options = {}
 
     if options.get('html-escape', True):
-        string = werkzeug.utils.escape(string)
+        string = escape(string)
     return HTMLSafe(string.replace('\n', '<br>\n'))
 
 def get_field_type(column, options):

openerp/addons/test_converter/tests/test_html.py

@@ -4,9 +4,8 @@ import os
 import xml.dom.minidom
 import datetime
 
-from werkzeug.utils import escape as e
-
 from openerp.tests import common
+from openerp.tools import html_escape as e
 from openerp.addons.base.ir import ir_qweb
 
 directory = os.path.dirname(__file__)

openerp/tools/misc.py

@@ -34,6 +34,7 @@ import socket
 import sys
 import threading
 import time
+import werkzeug.utils
 import zipfile
 from collections import defaultdict, Mapping
 from datetime import datetime
@@ -50,6 +51,7 @@ except ImportError:
 
 from config import config
 from cache import *
+from .parse_version import parse_version 
 
 import openerp
 # get_encodings, ustr and exception_to_unicode were originally from tools.misc.
@@ -1208,6 +1210,12 @@ def dumpstacks(sig=None, frame=None):
 
     _logger.info("\n".join(code))
 
-
+# Avoid DeprecationWarning while still remaining compatible with werkzeug pre-0.9
+if parse_version(getattr(werkzeug, '__version__', '0.0')) < parse_version('0.9.0'):
+    def html_escape(text):
+        return werkzeug.utils.escape(text, quote=True)
+else:
+    def html_escape(text):
+        return werkzeug.utils.escape(text)
 
 # vim:expandtab:smartindent:tabstop=4:softtabstop=4:shiftwidth=4: