diff --git a/addons/website/models/ir_qweb.py b/addons/website/models/ir_qweb.py index 0e1fe2beb89..6c466355d07 100644 --- a/addons/website/models/ir_qweb.py +++ b/addons/website/models/ir_qweb.py @@ -25,6 +25,7 @@ import openerp.modules import openerp from openerp.osv import orm, fields from openerp.tools import ustr, DEFAULT_SERVER_DATE_FORMAT, DEFAULT_SERVER_DATETIME_FORMAT +from openerp.tools import html_escape as escape from openerp.addons.web.http import request from openerp.addons.base.ir import ir_qweb @@ -276,7 +277,7 @@ class Image(orm.AbstractModel): url_params[options_key] = options[options_key] return ir_qweb.HTMLSafe('' % ( - ' '.join(itertools.imap(werkzeug.utils.escape, classes)), + ' '.join(itertools.imap(escape, classes)), werkzeug.urls.url_encode(url_params) )) diff --git a/addons/website/models/website.py b/addons/website/models/website.py index 9828e9aa39d..434712933f0 100644 --- a/addons/website/models/website.py +++ b/addons/website/models/website.py @@ -27,6 +27,7 @@ except ImportError: import openerp from openerp.osv import orm, osv, fields +from openerp.tools import html_escape as escape from openerp.tools.safe_eval import safe_eval from openerp.addons.web.http import request @@ -728,7 +729,7 @@ class ir_attachment(osv.osv): for attachment in self.browse(cr, uid, ids, context=context): # in-document URLs are html-escaped, a straight search will not # find them - url = werkzeug.utils.escape(attachment.website_url) + url = escape(attachment.website_url) ids = Views.search(cr, uid, ["|", ('arch', 'like', '"%s"' % url), ('arch', 'like', "'%s'" % url)], context=context) if ids: diff --git a/addons/website_event_track/controllers/event.py b/addons/website_event_track/controllers/event.py index e24aee7e62d..c2bcb3f2e4b 100644 --- a/addons/website_event_track/controllers/event.py +++ b/addons/website_event_track/controllers/event.py @@ -24,9 +24,9 @@ import datetime import re import pytz -import werkzeug.utils import openerp +import openerp.tools from openerp.addons.web import http from openerp.addons.web.http import request @@ -150,7 +150,7 @@ class website_event(http.Controller): if post.get('tag_'+str(tag.id)): tags.append(tag.id) - e = werkzeug.utils.escape + e = openerp.tools.escape track_description = '''
diff --git a/openerp/addons/base/ir/ir_qweb.py b/openerp/addons/base/ir/ir_qweb.py index 940c7844628..48cb8afbae2 100644 --- a/openerp/addons/base/ir/ir_qweb.py +++ b/openerp/addons/base/ir/ir_qweb.py @@ -11,12 +11,12 @@ import xml # FIXME use lxml and etree import babel import babel.dates -import werkzeug.utils from PIL import Image import openerp.tools -from openerp.tools.safe_eval import safe_eval as eval from openerp.osv import osv, orm, fields +from openerp.tools import html_escape as escape +from openerp.tools.safe_eval import safe_eval as eval from openerp.tools.translate import _ _logger = logging.getLogger(__name__) @@ -259,14 +259,14 @@ class QWeb(orm.AbstractModel): for attribute in self._render_att: if attribute_name[2:].startswith(attribute): att, val = self._render_att[attribute](self, element, attribute_name, attribute_value, qwebcontext) - generated_attributes += val and ' %s="%s"' % (att, werkzeug.utils.escape(val)) or " " + generated_attributes += val and ' %s="%s"' % (att, escape(val)) or " " break else: if attribute_name[2:] in self._render_tag: t_render = attribute_name[2:] template_attributes[attribute_name[2:]] = attribute_value else: - generated_attributes += ' %s="%s"' % (attribute_name, werkzeug.utils.escape(attribute_value)) + generated_attributes += ' %s="%s"' % (attribute_name, escape(attribute_value)) if 'debug' in template_attributes: debugger = template_attributes.get('debug', 'pdb') @@ -454,7 +454,7 @@ class FieldConverter(osv.AbstractModel): """ Generates the metadata attributes (prefixed by ``data-oe-`` for the root node of the field conversion. Attribute values are escaped by the - parent using ``werkzeug.utils.escape``. + parent. The default attributes are: @@ -507,7 +507,7 @@ class FieldConverter(osv.AbstractModel): record._model._all_columns[field_name].column, options, context=context) if options.get('html-escape', True): - content = werkzeug.utils.escape(content) + content = escape(content) elif hasattr(content, '__html__'): content = content.__html__() except Exception: @@ -518,7 +518,7 @@ class FieldConverter(osv.AbstractModel): if context and context.get('inherit_branding'): # add branding attributes g_att += ''.join( - ' %s="%s"' % (name, werkzeug.utils.escape(value)) + ' %s="%s"' % (name, escape(value)) for name, value in self.attributes( cr, uid, field_name, record, options, source_element, g_att, t_att, qweb_context) @@ -841,7 +841,7 @@ class Contact(orm.AbstractModel): val = { 'name': value.split("\n")[0], - 'address': werkzeug.utils.escape("\n".join(value.split("\n")[1:])), + 'address': escape("\n".join(value.split("\n")[1:])), 'phone': field_browse.phone, 'mobile': field_browse.mobile, 'fax': field_browse.fax, @@ -885,7 +885,7 @@ class QwebWidget(osv.AbstractModel): return self.pool['ir.qweb'].eval_str(inner, qwebcontext) def format(self, inner, options, qwebcontext): - return werkzeug.utils.escape(self._format(inner, options, qwebcontext)) + return escape(self._format(inner, options, qwebcontext)) class QwebWidgetMonetary(osv.AbstractModel): _name = 'ir.qweb.widget.monetary' @@ -945,7 +945,7 @@ def nl2br(string, options=None): if options is None: options = {} if options.get('html-escape', True): - string = werkzeug.utils.escape(string) + string = escape(string) return HTMLSafe(string.replace('\n', '
\n')) def get_field_type(column, options): diff --git a/openerp/addons/test_converter/tests/test_html.py b/openerp/addons/test_converter/tests/test_html.py index 3ef6566e829..c3fbca1b982 100644 --- a/openerp/addons/test_converter/tests/test_html.py +++ b/openerp/addons/test_converter/tests/test_html.py @@ -4,9 +4,8 @@ import os import xml.dom.minidom import datetime -from werkzeug.utils import escape as e - from openerp.tests import common +from openerp.tools import html_escape as e from openerp.addons.base.ir import ir_qweb directory = os.path.dirname(__file__) diff --git a/openerp/tools/misc.py b/openerp/tools/misc.py index b9fdef9b421..8829e15dca7 100644 --- a/openerp/tools/misc.py +++ b/openerp/tools/misc.py @@ -34,6 +34,7 @@ import socket import sys import threading import time +import werkzeug.utils import zipfile from collections import defaultdict, Mapping from datetime import datetime @@ -50,6 +51,7 @@ except ImportError: from config import config from cache import * +from .parse_version import parse_version import openerp # get_encodings, ustr and exception_to_unicode were originally from tools.misc. @@ -1208,6 +1210,12 @@ def dumpstacks(sig=None, frame=None): _logger.info("\n".join(code)) - +# Avoid DeprecationWarning while still remaining compatible with werkzeug pre-0.9 +if parse_version(getattr(werkzeug, '__version__', '0.0')) < parse_version('0.9.0'): + def html_escape(text): + return werkzeug.utils.escape(text, quote=True) +else: + def html_escape(text): + return werkzeug.utils.escape(text) # vim:expandtab:smartindent:tabstop=4:softtabstop=4:shiftwidth=4: