pengyuthon/odoo_source
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[FIX] core: fix typo + improve variable name and comment placement

Browse Source 
Extracted in its own commit to ease review of next one which is fixing
the sanitize_overide mechanism.

Note that 'Escalated' is meant to be used when talking about "Privilege
Escalation Attack". It's quite misleading when someone is reading this
"error". 'Elevated' is better (confusion brought by internal team).
Since the translation will be broken by this change anyway, the chance
is taken to make it cleaner and more helpful.

X-original-commit: 34235c48bd511d68f513e747dd3f50b9ea6f46d6
Part-of: odoo/odoo#110903
This commit is contained in:
Romain Derie
2023-01-25 05:06:02 +01:00
parent 48c7827d6b
commit 8d3e917e31
2 changed files with 21 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
odoo/addons/base/i18n/base.pot
+11 -9
View File
@@ -19938,15 +19938,6 @@ msgstr ""
msgid "Somalia"
msgstr ""
#. module: base
#. odoo-python
#: code:addons/fields.py:0
#, python-format
msgid ""
"Someone with escalated rights previously modified this field (%s %s), you "
"are therefore not able to modify it yourself."
msgstr ""
#. module: base
#: model:ir.model.fields,help:base.field_res_bank__bic
#: model:ir.model.fields,help:base.field_res_partner_bank__bank_bic
@@ -21020,6 +21011,17 @@ msgid ""
" <code>partner_id.company_id.name</code>."
msgstr ""
#. module: base
#. odoo-python
#: code:addons/fields.py:0
#, python-format
msgid ""
"The field value you're saving (%s %s) includes content that is restricted "
"for security reasons. It is possible that someone with higher privileges "
"previously modified it, and you are therefore not able to modify it yourself"
" while preserving the content."
msgstr ""
#. module: base
#. odoo-python
#: code:addons/base/wizard/base_module_upgrade.py:0
odoo/fields.py
+10 -5
View File
@@ -1988,21 +1988,26 @@ class Html(_String):
original_value = record[self.name]
if original_value:
initial_value_sanitized = html_sanitize(original_value, **sanitize_vals)
original_value_sanitized = html_sanitize(original_value, **sanitize_vals)
def get_parsed(val):
return etree.tostring(html.fromstring(val))
# could have been emptied by the sanitizer
if (
not initial_value_sanitized
or get_parsed(original_value) != get_parsed(initial_value_sanitized)
not original_value_sanitized # sanitizer could empty it
or get_parsed(original_value) != get_parsed(original_value_sanitized)
):
# The field contains element(s) that would be removed if
# sanitized. It means that someone who was part of a group
# allowing to bypass the sanitation saved that field
# previously.
raise UserError(_("Someone with escalated rights previously modified this field (%s %s), you are therefore not able to modify it yourself.", record._description, self.string))
raise UserError(_(
"The field value you're saving (%s %s) includes content that is "
"restricted for security reasons. It is possible that someone "
"with higher privileges previously modified it, and you are therefore "
"not able to modify it yourself while preserving the content.",
record._description, self.string,
))
return html_sanitize(value, **sanitize_vals)