From 926d8c6c5d22a3a363b624e4e28d95e253b6f7cd Mon Sep 17 00:00:00 2001 From: "Julien (jula)" Date: Tue, 31 Jan 2023 13:07:44 +0000 Subject: [PATCH] [FIX] web, stock: escape JSON error when downloading report __Description of the issue:__ When something goes wrong while downloading a report file, a 500 error is sent as JSON. However the frontend interprets this response as HTML and then try to parse the text content as JSON. Most of the time this works, but if the response contains any HTML tags, like `` from a Python stacktrace, the JSON response will get misinterpreted as HTML instead of regular text, causing the subsequent JSON interpretation to fail. The end result for the user is that empty tracebacks will be displayed instead of User Errors or actual tracebacks. __Desired behavior:__ The JSON response is HTML escaped before being sent and will therefore be correctly parsed and displayed to the user. This basically restore what was done prior of #104594. Enterprise: odoo/enterprise#36523 X-original-commit: 5999a7d336553053c5638f69344cdfbc84a8c681 Part-of: odoo/odoo#112453 --- addons/stock/controllers/main.py | 7 ++----- addons/web/controllers/report.py | 7 ++----- 2 files changed, 4 insertions(+), 10 deletions(-) diff --git a/addons/stock/controllers/main.py b/addons/stock/controllers/main.py index 805b9378428..6c1a743391e 100644 --- a/addons/stock/controllers/main.py +++ b/addons/stock/controllers/main.py @@ -4,6 +4,7 @@ from werkzeug.exceptions import InternalServerError from odoo import http from odoo.http import request +from odoo.tools.misc import html_escape import json @@ -33,9 +34,5 @@ class StockReportController(http.Controller): 'message': 'Odoo Server Error', 'data': se } - res = werkzeug.wrappers.Response( - json.dumps(error), - status=500, - headers=[("Content-Type", "application/json")] - ) + res = request.make_response(html_escape(json.dumps(error))) raise InternalServerError(response=res) from e diff --git a/addons/web/controllers/report.py b/addons/web/controllers/report.py index e7001a11c9d..a51384a910d 100644 --- a/addons/web/controllers/report.py +++ b/addons/web/controllers/report.py @@ -12,6 +12,7 @@ from werkzeug.urls import url_parse from odoo import http from odoo.http import content_disposition, request +from odoo.tools.misc import html_escape from odoo.tools.safe_eval import safe_eval, time @@ -143,11 +144,7 @@ class ReportController(http.Controller): 'message': "Odoo Server Error", 'data': se } - res = werkzeug.wrappers.Response( - json.dumps(error), - status=500, - headers=[("Content-Type", "application/json")] - ) + res = request.make_response(html_escape(json.dumps(error))) raise werkzeug.exceptions.InternalServerError(response=res) from e @http.route(['/report/check_wkhtmltopdf'], type='json', auth="user")