From e82cb100bfe60a8e70930c62b2d91ab8c1bf10c8 Mon Sep 17 00:00:00 2001 From: Christophe Matthieu Date: Mon, 13 Jan 2014 09:20:04 +0100 Subject: [PATCH 1/6] [FIX] res.font: add access right: read allow for all user and all allow for group_user bzr revid: chm@openerp.com-20140113082004-x494blqy2xjfc4wl --- openerp/addons/base/security/ir.model.access.csv | 2 ++ 1 file changed, 2 insertions(+) diff --git a/openerp/addons/base/security/ir.model.access.csv b/openerp/addons/base/security/ir.model.access.csv index 4a5331e87c3..28da1f46233 100644 --- a/openerp/addons/base/security/ir.model.access.csv +++ b/openerp/addons/base/security/ir.model.access.csv @@ -122,3 +122,5 @@ access_ir_qweb_field_many2one,access_ir_qweb_field_many2one,model_ir_qweb_field_ access_ir_qweb_field_html,access_ir_qweb_field_html,model_ir_qweb_field_html,,0,0,0,0 access_ir_qweb_field_image,access_ir_qweb_field_image,model_ir_qweb_field_image,,0,0,0,0 access_ir_qweb_field_monetary,access_ir_qweb_field_monetary,model_ir_qweb_field_monetary,,0,0,0,0 +"access_res_font_all","res_res_font all","model_res_font",,1,0,0,0 +"access_res_font_group_user","res_res_font group_user","model_res_font","group_user",1,1,1,1 From bad16022e88bf0fd63096db47b61fede7d707cf1 Mon Sep 17 00:00:00 2001 From: Christophe Matthieu Date: Mon, 13 Jan 2014 09:28:26 +0100 Subject: [PATCH 2/6] [FIX] base_language_install: add access right: access for group_user bzr revid: chm@openerp.com-20140113082826-glv3v4pum6k4l1hh --- openerp/addons/base/security/ir.model.access.csv | 1 + 1 file changed, 1 insertion(+) diff --git a/openerp/addons/base/security/ir.model.access.csv b/openerp/addons/base/security/ir.model.access.csv index 28da1f46233..c90b47a9442 100644 --- a/openerp/addons/base/security/ir.model.access.csv +++ b/openerp/addons/base/security/ir.model.access.csv @@ -124,3 +124,4 @@ access_ir_qweb_field_image,access_ir_qweb_field_image,model_ir_qweb_field_image, access_ir_qweb_field_monetary,access_ir_qweb_field_monetary,model_ir_qweb_field_monetary,,0,0,0,0 "access_res_font_all","res_res_font all","model_res_font",,1,0,0,0 "access_res_font_group_user","res_res_font group_user","model_res_font","group_user",1,1,1,1 +"access_base_language_install_group_user","base_language_install group_user","model_base_language_install","group_user",1,1,1,1 From 94357739bc3c531f8b6acde8fede17dc6d9d284f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thibault=20Delavall=C3=A9e?= Date: Mon, 13 Jan 2014 09:57:01 +0100 Subject: [PATCH 3/6] [IMP] tools: mail: have a strict mode for html_sanitizer (not default) with options before website: without frames, with safe attributes only. We will have to find a way to use the strict mode when parsing incoming emails, but not when sending or storing openerp content. Currently the not strict mode is the default one, to avoid side-effects with the website. bzr revid: tde@openerp.com-20140113085701-f2bzu94cq1z3tl10 --- openerp/tools/mail.py | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-) diff --git a/openerp/tools/mail.py b/openerp/tools/mail.py index 55813bc9f01..3c4dbfdccdd 100644 --- a/openerp/tools/mail.py +++ b/openerp/tools/mail.py @@ -45,10 +45,14 @@ tags_to_remove = ['html', 'body', 'font'] # allow new semantic HTML5 tags allowed_tags = clean.defs.tags | frozenset('article section header footer hgroup nav aside figure main'.split()) -safe_attrs = clean.defs.safe_attrs | frozenset(['style']) +safe_attrs = clean.defs.safe_attrs | frozenset( + ['style', + 'data-oe-model', 'data-oe-id', 'data-oe-field', 'data-oe-type', 'data-oe-expression', 'data-oe-translate', 'data-oe-nodeid', + 'data-snippet-id', 'data-publish', 'data-id', 'data-res_id', 'data-member_id', 'data-view-id' + ]) -def html_sanitize(src, silent=True): +def html_sanitize(src, silent=True, strict=False): if not src: return src src = ustr(src, errors='replace') @@ -62,11 +66,18 @@ def html_sanitize(src, silent=True): kwargs = { 'page_structure': True, 'style': False, # do not remove style attributes - 'frames': False, # de not remove frames (embbed video in CMS blogs) 'forms': True, # remove form tags 'remove_unknown_tags': False, 'allow_tags': allowed_tags, } + if strict and etree.LXML_VERSION >= (3, 1, 0): # lxml < 3.1.0 does not allow to specify safe_attrs; however we always want to keep style + kwargs['safe_attrs_only'] = False + kwargs['safe_attrs_only'] = True + kwargs['safe_attrs'] = safe_attrs + else: + kwargs['frames'] = False, # do not remove frames (embbed video in CMS blogs) + kwargs['safe_attrs_only'] = False, # keep oe-data attributes + style + if etree.LXML_VERSION >= (2, 3, 1): # kill_tags attribute has been added in version 2.3.1 kwargs.update({ @@ -76,8 +87,6 @@ def html_sanitize(src, silent=True): else: kwargs['remove_tags'] = tags_to_kill + tags_to_remove - kwargs['safe_attrs_only'] = False - try: # some corner cases make the parser crash (such as in test_mail) cleaner = clean.Cleaner(**kwargs) From fe0af74eab3bef3738ca79e31135d224391f6bd5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thibault=20Delavall=C3=A9e?= Date: Mon, 13 Jan 2014 17:54:23 +0100 Subject: [PATCH 4/6] [REV] Reverted last commit. bzr revid: tde@openerp.com-20140113165423-8nu3838d4yj3h3j4 --- openerp/tools/mail.py | 19 +++++-------------- 1 file changed, 5 insertions(+), 14 deletions(-) diff --git a/openerp/tools/mail.py b/openerp/tools/mail.py index 3c4dbfdccdd..55813bc9f01 100644 --- a/openerp/tools/mail.py +++ b/openerp/tools/mail.py @@ -45,14 +45,10 @@ tags_to_remove = ['html', 'body', 'font'] # allow new semantic HTML5 tags allowed_tags = clean.defs.tags | frozenset('article section header footer hgroup nav aside figure main'.split()) -safe_attrs = clean.defs.safe_attrs | frozenset( - ['style', - 'data-oe-model', 'data-oe-id', 'data-oe-field', 'data-oe-type', 'data-oe-expression', 'data-oe-translate', 'data-oe-nodeid', - 'data-snippet-id', 'data-publish', 'data-id', 'data-res_id', 'data-member_id', 'data-view-id' - ]) +safe_attrs = clean.defs.safe_attrs | frozenset(['style']) -def html_sanitize(src, silent=True, strict=False): +def html_sanitize(src, silent=True): if not src: return src src = ustr(src, errors='replace') @@ -66,18 +62,11 @@ def html_sanitize(src, silent=True, strict=False): kwargs = { 'page_structure': True, 'style': False, # do not remove style attributes + 'frames': False, # de not remove frames (embbed video in CMS blogs) 'forms': True, # remove form tags 'remove_unknown_tags': False, 'allow_tags': allowed_tags, } - if strict and etree.LXML_VERSION >= (3, 1, 0): # lxml < 3.1.0 does not allow to specify safe_attrs; however we always want to keep style - kwargs['safe_attrs_only'] = False - kwargs['safe_attrs_only'] = True - kwargs['safe_attrs'] = safe_attrs - else: - kwargs['frames'] = False, # do not remove frames (embbed video in CMS blogs) - kwargs['safe_attrs_only'] = False, # keep oe-data attributes + style - if etree.LXML_VERSION >= (2, 3, 1): # kill_tags attribute has been added in version 2.3.1 kwargs.update({ @@ -87,6 +76,8 @@ def html_sanitize(src, silent=True, strict=False): else: kwargs['remove_tags'] = tags_to_kill + tags_to_remove + kwargs['safe_attrs_only'] = False + try: # some corner cases make the parser crash (such as in test_mail) cleaner = clean.Cleaner(**kwargs) From a02797b26bb5b6394558ea65a5e1d6d18458bb74 Mon Sep 17 00:00:00 2001 From: Christophe Matthieu Date: Mon, 13 Jan 2014 18:35:09 +0100 Subject: [PATCH 5/6] [FIX] base.language.install remove explicit access access_base_language_install_group_user bzr revid: chm@openerp.com-20140113173509-4syed8md6drifv2q --- openerp/addons/base/security/ir.model.access.csv | 1 - 1 file changed, 1 deletion(-) diff --git a/openerp/addons/base/security/ir.model.access.csv b/openerp/addons/base/security/ir.model.access.csv index c90b47a9442..28da1f46233 100644 --- a/openerp/addons/base/security/ir.model.access.csv +++ b/openerp/addons/base/security/ir.model.access.csv @@ -124,4 +124,3 @@ access_ir_qweb_field_image,access_ir_qweb_field_image,model_ir_qweb_field_image, access_ir_qweb_field_monetary,access_ir_qweb_field_monetary,model_ir_qweb_field_monetary,,0,0,0,0 "access_res_font_all","res_res_font all","model_res_font",,1,0,0,0 "access_res_font_group_user","res_res_font group_user","model_res_font","group_user",1,1,1,1 -"access_base_language_install_group_user","base_language_install group_user","model_base_language_install","group_user",1,1,1,1 From 58ff27688776fba6a7aeb3b0d8d704e1d2c7920a Mon Sep 17 00:00:00 2001 From: Xavier Morel Date: Tue, 14 Jan 2014 13:48:43 +0100 Subject: [PATCH 6/6] [FIX] pillow-compatible import bzr revid: xmo@openerp.com-20140114124843-zpg2qzua90uq1pxu --- openerp/addons/base/ir/ir_fields.py | 4 ---- openerp/addons/base/ir/ir_qweb.py | 2 +- 2 files changed, 1 insertion(+), 5 deletions(-) diff --git a/openerp/addons/base/ir/ir_fields.py b/openerp/addons/base/ir/ir_fields.py index 21fcc7c6926..f238bf78719 100644 --- a/openerp/addons/base/ir/ir_fields.py +++ b/openerp/addons/base/ir/ir_fields.py @@ -5,14 +5,10 @@ import functools import operator import itertools import time -import Image import psycopg2 import pytz -import werkzeug.utils -import openerp.osv.fields -import openerp.tools.func from openerp.osv import orm from openerp.tools.translate import _ from openerp.tools.misc import DEFAULT_SERVER_DATE_FORMAT,\ diff --git a/openerp/addons/base/ir/ir_qweb.py b/openerp/addons/base/ir/ir_qweb.py index f18d0316351..63c5f7afdd7 100644 --- a/openerp/addons/base/ir/ir_qweb.py +++ b/openerp/addons/base/ir/ir_qweb.py @@ -11,8 +11,8 @@ import xml # FIXME use lxml and etree import babel import babel.dates import dateutil.relativedelta -import Image import werkzeug.utils +from PIL import Image import openerp.tools from openerp.osv import osv, orm, fields