From 731811e4096f5a4f4a4961370eb3191c16d13c56 Mon Sep 17 00:00:00 2001 From: Romain Derie Date: Sun, 26 Nov 2023 19:17:38 +0100 Subject: [PATCH] [REV] website: revert 17c6f6f30bf13bd3c303b28d9a314bd76dd8f4dc X-original-commit: 49215f2cd31777d4ba0e845819e181daed82f887 Part-of: odoo/odoo#143879 --- addons/website/controllers/form.py | 17 ++--------- addons/website/models/ir_ui_view.py | 29 ------------------- addons/website/models/website_form.py | 17 +++++------ .../tours/website_form_editor_frontend.js | 3 +- 4 files changed, 11 insertions(+), 55 deletions(-) diff --git a/addons/website/controllers/form.py b/addons/website/controllers/form.py index a2d1a00212b..56fee82ef72 100644 --- a/addons/website/controllers/form.py +++ b/addons/website/controllers/form.py @@ -12,8 +12,7 @@ from odoo import http, SUPERUSER_ID, _, _lt from odoo.addons.base.models.ir_qweb_fields import nl2br, nl2br_enclose from odoo.http import request from odoo.tools import plaintext2html -from odoo.exceptions import AccessDenied, ValidationError, UserError -from odoo.tools.misc import hmac, consteq +from odoo.exceptions import ValidationError, UserError class WebsiteForm(http.Controller): @@ -74,15 +73,6 @@ class WebsiteForm(http.Controller): # for the email queue to process if model_name == 'mail.mail': - form_has_email_cc = {'email_cc', 'email_bcc'} & kwargs.keys() or \ - 'email_cc' in kwargs["website_form_signature"] - # remove the email_cc information from the signature - kwargs["website_form_signature"] = kwargs["website_form_signature"].split(':')[0] - if kwargs.get("email_to"): - value = kwargs['email_to'] + (':email_cc' if form_has_email_cc else '') - hash_value = hmac(model_record.env, 'website_form_signature', value) - if not consteq(kwargs["website_form_signature"], hash_value): - raise AccessDenied('invalid website_form_signature') request.env[model_name].sudo().browse(id_record).send() # Some fields have additional SQL constraints that we can't check generically @@ -194,7 +184,7 @@ class WebsiteForm(http.Controller): custom_fields.append((_('email'), field_value)) # If it's a custom field - elif field_name not in ('context', 'website_form_signature'): + elif field_name != 'context': custom_fields.append((field_name, field_value)) data['custom'] = "\n".join([u"%s : %s" % v for v in custom_fields]) @@ -227,8 +217,7 @@ class WebsiteForm(http.Controller): def insert_record(self, request, model, values, custom, meta=None): model_name = model.sudo().model if model_name == 'mail.mail': - email_from = _('"%s form submission" <%s>') % (request.env.company.name, request.env.company.email) - values.update({'reply_to': values.get('email_from'), 'email_from': email_from}) + values.update({'reply_to': values.get('email_from')}) record = request.env[model_name].with_user(SUPERUSER_ID).with_context( mail_create_nosubscribe=True, ).create(values) diff --git a/addons/website/models/ir_ui_view.py b/addons/website/models/ir_ui_view.py index 5d983d995ad..fa63543345e 100644 --- a/addons/website/models/ir_ui_view.py +++ b/addons/website/models/ir_ui_view.py @@ -4,8 +4,6 @@ import logging import uuid import werkzeug -from odoo.tools.misc import hmac -from lxml import etree from odoo import api, fields, models from odoo import tools @@ -495,33 +493,6 @@ class View(models.Model): 'data-bg-video-src', 'data-shape', 'data-scroll-background-ratio', ] - def _get_combined_arch(self): - root = super(View, self)._get_combined_arch() - if not root.findall('.//form'): # Most efficient way to discard the function if there is no form in the view - return root - nodes = root.xpath('.//form[contains(@action, "/website/form/")]') - for form in nodes: - existing_hash_node = form.find('.//input[@type="hidden"][@name="website_form_signature"]') - if existing_hash_node is not None: - existing_hash_node.getparent().remove(existing_hash_node) - input_nodes = form.xpath('.//input[contains(@name, "email_")]') - form_values = {input_node.attrib['name']: input_node for input_node in input_nodes} - # if this form does not send an email, ignore. But at this stage, - # the value of email_to can still be None in case of default value - if 'email_to' not in form_values.keys(): - continue - elif not form_values['email_to'].attrib.get('value'): - form_values['email_to'].attrib['value'] = self.env.company.email or '' - has_cc = {'email_cc', 'email_bcc'} & form_values.keys() - value = form_values['email_to'].attrib['value'] + (':email_cc' if has_cc else '') - hash_value = hmac(self.sudo().env, 'website_form_signature', value) - hash_node = '' - if has_cc: - hash_value += ':email_cc' - form_values['email_to'].addnext(etree.fromstring(hash_node)) - form_values['email_to'].getnext().attrib['value'] = hash_value - return root - # -------------------------------------------------------------------------- # Snippet saving # -------------------------------------------------------------------------- diff --git a/addons/website/models/website_form.py b/addons/website/models/website_form.py index 896568595ef..3d9f32ffcef 100644 --- a/addons/website/models/website_form.py +++ b/addons/website/models/website_form.py @@ -31,16 +31,13 @@ class website_form_model(models.Model): builders and are writable. By default no field is writable by the form builder. """ - if self.model == "mail.mail": - included = {'email_from', 'email_to', 'email_cc', 'email_bcc', 'body', 'reply_to', 'subject'} - else: - included = { - field.name - for field in self.env['ir.model.fields'].sudo().search([ - ('model_id', '=', self.id), - ('website_form_blacklisted', '=', False) - ]) - } + included = { + field.name + for field in self.env['ir.model.fields'].sudo().search([ + ('model_id', '=', self.id), + ('website_form_blacklisted', '=', False) + ]) + } return { k: v for k, v in self.get_authorized_fields(self.model).items() if k in included diff --git a/addons/website/static/tests/tours/website_form_editor_frontend.js b/addons/website/static/tests/tours/website_form_editor_frontend.js index 01b96520bb7..96fa22cd1f5 100644 --- a/addons/website/static/tests/tours/website_form_editor_frontend.js +++ b/addons/website/static/tests/tours/website_form_editor_frontend.js @@ -28,8 +28,7 @@ registry.category("web_tour.tours").add("website_form_editor_tour_submit", { ":has(.s_website_form_field.s_website_form_required:has(label:contains('State')):has(select[name='State'][required]:has(option[value='France'])))" + ":has(.s_website_form_field:has(label:contains('State')):has(select[name='State'][required]:has(option[value='Canada'])))" + ":has(.s_website_form_field:has(label:contains('Invoice Scan')))" + - ":has(.s_website_form_field:has(input[name='email_to'][value='test@test.test']))" + - ":has(.s_website_form_field:has(input[name='website_form_signature']))", + ":has(.s_website_form_field:has(input[name='email_to'][value='test@test.test']))", trigger: ".s_website_form_send" }, {