pengyuthon/odoo_source
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[FIX] *: mass replace known t-raws by t-out

Browse Source 
* QWeb bodies should be markup-safe so `0` should always be
  markup-safe.
* `head` is qweb-rendered so the same.
* The `json` pseudo-module in qweb templates is `json.scriptsafe`,
  which should be markup-safe.
This commit is contained in:
Xavier Morel
2021-04-29 05:34:20 +00:00
parent c56e8c9f5a
commit 996cb85c27
25 changed files with 51 additions and 52 deletions
Download Patch File Download Diff File Expand all files Collapse all files
addons/http_routing/views/http_routing_template.xml
+1 -1
View File
@@ -103,7 +103,7 @@
<template id="404" name="Page Not Found">
<t t-call="web.frontend_layout">
<div id="wrap">
<t t-raw="0"/>
<t t-out="0"/>
<div class="oe_structure oe_empty">
<section class="s_text_image pt104 pb104" data-snippet="s_image_text" data-name="Image - Text">
<div class="container">
addons/im_livechat/views/im_livechat_channel_templates.xml
+1 -1
View File
@@ -106,7 +106,7 @@
var button = new im_livechat.LivechatButton(
rootWidget,
"<t t-esc="info['server_url']"/>",
<t t-raw="json.dumps(info.get('options', {}))"/>
<t t-out="json.dumps(info.get('options', {}))"/>
);
button.appendTo(document.body);
window.livechat_button = button;
addons/l10n_de/report/din5008_report.xml
+1 -1
View File
@@ -81,7 +81,7 @@
</t>
</div>
</div>
<t t-raw="0" />
<t t-out="0" />
</div>
<div class="footer o_background_footer din">
addons/mass_mailing/views/mass_mailing_templates_portal.xml
+1 -1
View File
@@ -130,7 +130,7 @@
</header>
<div id="wrap" class="oe_structure oe_empty"/>
<main>
<t t-raw="0"/>
<t t-out="0"/>
</main>
</body>
<xpath expr="//footer" position="replace">
addons/mass_mailing/views/snippets_themes.xml
+1 -1
View File
@@ -829,7 +829,7 @@
<!-- Snippet themes Options -->
<template id="snippet_options">
<t t-call="web_editor.snippet_options"/>
<t t-raw="0"/>
<t t-out="0"/>
<div data-js="mass_mailing_sizing_x"
data-selector="img, .mv, .col_mv, td, th"
addons/point_of_sale/views/pos_assets_index.xml
+1 -1
View File
@@ -26,7 +26,7 @@
<link rel="shortcut icon" href="/web/static/src/img/favicon.ico" type="image/x-icon"/>
<script type="text/javascript">
var odoo = <t t-raw="json.dumps({
var odoo = <t t-out="json.dumps({
'csrf_token': request.csrf_token(None),
'session_info': session_info,
'login_number': login_number,
addons/point_of_sale/views/pos_assets_qunit.xml
+1 -1
View File
@@ -64,7 +64,7 @@
<t t-set="head">
<!-- we need session_info in order to properly instantiate PosModel -->
<script type="text/javascript">
var odoo = <t t-raw="json.dumps({
var odoo = <t t-out="json.dumps({
'csrf_token': request.csrf_token(None),
'session_info': session_info,
'debug': debug,
addons/portal/views/portal_templates.xml
+5 -5
View File
@@ -26,7 +26,7 @@
</div>
</nav>
</xpath>
<xpath expr="//div[@id='wrapwrap']/main/t[@t-raw='0']" position="before">
<xpath expr="//div[@id='wrapwrap']/main/t[@t-out='0']" position="before">
<div t-if="o_portal_fullwidth_alert" class="alert alert-info alert-dismissible rounded-0 fade show d-print-none css_editable_mode_hidden">
<div class="container">
<t t-raw="o_portal_fullwidth_alert"/>
@@ -120,7 +120,7 @@
<t t-if="my_details">
<div class="row justify-content-between mt-4">
<div t-attf-class="col-12 col-md col-lg-6">
<t t-raw="0"/>
<t t-out="0"/>
</div>
<div id="o_my_sidebar" class="pt-3 pt-lg-0 col-12 col-md col-lg-4 col-xl-3 o_my_sidebar">
<div class="o_my_contact" t-if="sales_user">
@@ -140,7 +140,7 @@
</div>
</t>
<t t-else="">
<t t-raw="0"/>
<t t-out="0"/>
</t>
</div>
</div>
@@ -187,7 +187,7 @@
<template id="portal_table" name="My Portal Table">
<div t-attf-class="table-responsive border rounded border-top-0 #{classes if classes else ''}">
<table class="table rounded mb-0 bg-white o_portal_my_doc_table">
<t t-raw="0"/>
<t t-out="0"/>
</table>
</div>
<div t-if="pager" class="o_portal_pager text-center">
@@ -294,7 +294,7 @@
</div>
</div>
</div>
<t t-raw="0"/>
<t t-out="0"/>
</div>
<form t-if="searchbar_inputs" class="form-inline o_portal_search_panel ml-lg-4 col-xl-4 col-md-5">
<div class="input-group input-group-sm w-100">
addons/web/tests/test_js.py
+1 -1
View File
@@ -22,7 +22,7 @@ class WebSuite(odoo.tests.HttpCase):
def _check_only_call(self, suite):
# As we currently aren't in a request context, we can't render `web.layout`.
# redefinied it as a minimal proxy template.
self.env.ref('web.layout').write({'arch_db': '<t t-name="web.layout"><head><meta charset="utf-8"/><t t-raw="head"/></head></t>'})
self.env.ref('web.layout').write({'arch_db': '<t t-name="web.layout"><head><meta charset="utf-8"/><t t-esc="head"/></head></t>'})
for asset in self.env['ir.qweb']._get_asset_content(suite, options={})[0]:
filename = asset['filename']
addons/web/views/report_templates.xml
+12 -12
View File
@@ -27,7 +27,7 @@
<body t-att-class="'container' if not full_width else 'container-fluid'">
<div id="wrapwrap">
<main>
<t t-raw="0"/>
<t t-out="0"/>
</main>
</div>
</body>
@@ -91,7 +91,7 @@
</head>
<body t-att-class="'container' if not full_width else 'container-fluid'">
<div id="wrapwrap">
<t t-raw="0"/>
<t t-out="0"/>
</div>
</body>
</html>
@@ -100,14 +100,14 @@
<template id="html_container">
<t t-set="body_classname" t-value="'container'"/>
<t t-call="web.report_layout">
<t t-raw="0"/>
<t t-out="0"/>
</t>
</template>
<template id="html_preview_container">
<t t-set="body_classname" t-value="'container'"/>
<t t-call="web.report_preview_layout">
<t t-raw="0"/>
<t t-out="0"/>
</t>
</template>
@@ -323,7 +323,7 @@
<div t-attf-class="o_company_#{company.id}_layout article o_report_layout_background" t-att-data-oe-model="o and o._name" t-att-data-oe-id="o and o.id" t-att-data-oe-lang="o and o.env.context.get('lang')">
<t t-call="web.address_layout"/>
<t t-raw="0"/>
<t t-out="0"/>
</div>
<div t-attf-class="o_company_#{company.id}_layout footer o_background_footer">
@@ -373,7 +373,7 @@
<!-- This div ensures that the address is not cropped by the header. -->
<t t-call="web.address_layout"/>
</div>
<t t-raw="0"/>
<t t-out="0"/>
</div>
<div t-attf-class="footer o_boxed_footer o_company_#{company.id}_layout">
@@ -422,7 +422,7 @@
<div t-attf-class="article o_report_layout_clean o_company_#{company.id}_layout" t-att-data-oe-model="o and o._name" t-att-data-oe-id="o and o.id" t-att-data-oe-lang="o and o.env.context.get('lang')">
<t t-call="web.address_layout"/>
<t t-raw="0"/>
<t t-out="0"/>
</div>
<div t-attf-class="footer o_clean_footer o_company_#{company.id}_layout">
@@ -473,7 +473,7 @@
<!-- This div ensures that the address is not cropped by the header. -->
<t t-call="web.address_layout"/>
</div>
<t t-raw="0"/>
<t t-out="0"/>
</div>
<div t-attf-class="footer o_standard_footer o_company_#{company.id}_layout">
@@ -520,8 +520,8 @@
</t>
</t>
<t t-if="company.external_report_layout_id" t-call="{{company.external_report_layout_id.key}}"><t t-raw="0"/></t>
<t t-else="else" t-call="web.external_layout_standard"><t t-raw="0"/></t>
<t t-if="company.external_report_layout_id" t-call="{{company.external_report_layout_id.key}}"><t t-out="0"/></t>
<t t-else="else" t-call="web.external_layout_standard"><t t-out="0"/></t>
</template>
@@ -559,7 +559,7 @@
</div>
</div>
<div class="article" t-att-data-oe-model="o and o._name" t-att-data-oe-id="o and o.id" t-att-data-oe-lang="o and o.env.context.get('lang')">
<t t-raw="0"/>
<t t-out="0"/>
</div>
</template>
@@ -567,7 +567,7 @@
<t t-call="web.html_container">
<t t-if="not o" t-set="o" t-value="doc"/>
<div class="article" t-att-data-oe-model="o and o._name" t-att-data-oe-id="o and o.id" t-att-data-oe-lang="o and o.env.context.get('lang')">
<t t-raw="0"/>
<t t-out="0"/>
</div>
</t>
</template>
addons/web/views/webclient_templates.xml
+7 -7
View File
@@ -22,10 +22,10 @@
};
</script>
<t t-raw="head or ''"/>
<t t-out="head or ''"/>
</head>
<body t-att-class="body_classname">
<t t-raw="0"/>
<t t-out="0"/>
</body>
</html>
</template>
@@ -41,7 +41,7 @@
</xpath>
<xpath expr="//head/script[@id='web.layout.odooscript']" position="after">
<script type="text/javascript">
odoo.session_info = <t t-raw="json.dumps(request.env['ir.http'].get_frontend_session_info())"/>;
odoo.session_info = <t t-out="json.dumps(request.env['ir.http'].get_frontend_session_info())"/>;
if (!/(^|;\s)tz=/.test(document.cookie)) {
const userTZ = Intl.DateTimeFormat().resolvedOptions().timeZone;
document.cookie = `tz=${userTZ}; path=/`;
@@ -53,7 +53,7 @@
<t t-call-assets="web.assets_common_lazy" t-css="false" lazy_load="True"/>
<t t-call-assets="web.assets_frontend_lazy" t-css="false" lazy_load="True"/>
</xpath>
<xpath expr="//t[@t-raw='0']" position="replace">
<xpath expr="//t[@t-out='0']" position="replace">
<div id="wrapwrap" t-attf-class="#{pageName or ''}">
<header t-if="not no_header" id="top" data-anchor="true">
<img class="img-responsive d-block mx-auto"
@@ -61,7 +61,7 @@
alt="Logo"/>
</header>
<main>
<t t-raw="0"/>
<t t-out="0"/>
</main>
<footer t-if="not no_footer" id="bottom" data-anchor="true" t-attf-class="bg-light o_footer">
<div id="footer"/>
@@ -118,7 +118,7 @@
<div t-attf-class="text-center pb-3 border-bottom {{'mb-3' if form_small else 'mb-4'}}">
<img t-attf-src="/web/binary/company_logo{{ '?dbname='+db if db else '' }}" alt="Logo" style="max-height:120px; max-width: 100%; width:auto"/>
</div>
<t t-raw="0"/>
<t t-out="0"/>
<div class="text-center small mt-4 pt-3 border-top" t-if="not disable_footer">
<t t-if="not disable_database_manager">
<a class="border-right pr-2 mr-1" href="/web/database/manager">Manage Databases</a>
@@ -286,7 +286,7 @@
<t t-call="web.layout">
<t t-set="head_web">
<script type="text/javascript">
odoo.session_info = <t t-raw="json.dumps(session_info)"/>;
odoo.session_info = <t t-out="json.dumps(session_info)"/>;
odoo.reloadMenus = () => fetch(`/web/webclient/load_menus/${odoo.session_info.cache_hashes.load_menus}`).then(res => res.json());
odoo.loadMenusPromise = odoo.reloadMenus();
</script>
addons/website/views/snippets/s_dynamic_snippet.xml
+1 -1
View File
@@ -39,7 +39,7 @@
<we-button data-select-data-attribute="2">2</we-button>
<we-button data-select-data-attribute="3">3</we-button>
</we-select>
<t t-raw="0"/>
<t t-out="0"/>
</div>
</template>
<template id="s_dynamic_snippet_options" inherit_id="website.snippet_options">
addons/website/views/snippets/s_dynamic_snippet_carousel.xml
+1 -1
View File
@@ -13,7 +13,7 @@
<we-input string="Slider Speed"
data-select-data-attribute="1s" data-name="speed_opt" data-attribute-name="carouselInterval" data-no-preview="true"
data-unit="s" data-save-unit="ms" data-step="0.1"/>
<t t-raw="0"/>
<t t-out="0"/>
</t>
</template>
<template id="s_dynamic_snippet_carousel_options" inherit_id="website.snippet_options">
addons/website/views/website_templates.xml
+4 -4
View File
@@ -214,7 +214,7 @@
<!-- Navbar Nav -->
<template id="navbar_nav" name="Navbar Nav">
<ul id="top_menu" t-attf-class="nav navbar-nav o_menu_loading #{_nav_class}">
<t t-raw="0"/>
<t t-out="0"/>
</ul>
</template>
@@ -1336,7 +1336,7 @@
<template id="login_layout" inherit_id="web.login_layout" name="Website Login Layout" priority="20">
<xpath expr="t" position="replace">
<t t-call="website.layout">
<div class="oe_website_login_container" t-raw="0"/>
<div class="oe_website_login_container" t-out="0"/>
</t>
</xpath>
</template>
@@ -1932,7 +1932,7 @@
t-attf-class="o_record_cover_container d-flex flex-column h-100 o_colored_level o_cc #{_cp.get('background_color_class')} #{use_size and _cp.get('resize_class')} #{use_text_align and _cp.get('text_align_class')} #{additionnal_classes}">
<div t-attf-class="o_record_cover_component o_record_cover_image #{snippet_autofocus and 'o_we_snippet_autofocus'}" t-attf-style="background-image: #{_bg};"/>
<div t-if="use_filters" t-attf-class="o_record_cover_component o_record_cover_filter oe_black" t-attf-style="opacity: #{_cp.get('opacity', 0.0)};"/>
<t t-raw="0"/>
<t t-out="0"/>
</div>
</template>
@@ -1944,7 +1944,7 @@
<button class="btn btn-success js_publish_btn">Published</button>
<button type="button" t-attf-class="btn btn-default dropdown-toggle dropdown-toggle-split" t-att-id="'dopprod-%s' % object.id" data-toggle="dropdown"/>
<div class="dropdown-menu" role="menu" t-att-aria-labelledby="'dopprod-%s' % object.id">
<t t-raw="0"/>
<t t-out="0"/>
<a role="menuitem" t-attf-href="/web#view_type=form&amp;model=#{object._name}&amp;id=#{object.id}&amp;action=#{action}&amp;menu_id=#{menu or object.env['ir.model.data'].xmlid_to_res_id('website.menu_website_configuration')}"
title='Edit in backend' class="dropdown-item" t-if="publish_edit">Edit</a>
</div>
addons/website_blog/views/website_blog_templates.xml
+1 -1
View File
@@ -6,7 +6,7 @@
<template id="index" name="Blog Navigation">
<t t-call="website.layout">
<div id="wrap" class="js_blog website_blog">
<t t-raw="0"/>
<t t-out="0"/>
<!-- Droppable-area shared across all blog's pages -->
<t t-set="oe_structure_blog_footer_description">Visible in all blogs' pages</t>
addons/website_event/views/event_templates_page.xml
+1 -1
View File
@@ -62,7 +62,7 @@
</div>
</nav>
</t>
<t t-raw="0"/>
<t t-out="0"/>
<t t-set="editor_sub_message">Following content will appear on all events.</t>
<div class="oe_structure oe_empty" id="oe_structure_website_event_layout_1" t-att-data-editor-sub-message="editor_sub_message"/>
</div>
addons/website_event/views/event_templates_page_registration.xml
+1 -1
View File
@@ -22,7 +22,7 @@
<t t-call="website_event.registration_template"/>
</div>
</t>
<t t-raw="0"/>
<t t-out="0"/>
</div>
</t>
</template>
addons/website_event/views/event_templates_widgets.xml
+1 -1
View File
@@ -13,7 +13,7 @@
<input t-if="search != 'search' and search_value != 'all'" type="hidden"
t-att-name="search" t-att-value="search_value"/>
</t>
<t t-raw="0"/>
<t t-out="0"/>
</form>
</xpath>
</template>
addons/website_event_track/views/event_templates.xml
+2 -2
View File
@@ -19,7 +19,7 @@
<xpath expr='//t[@t-call="website.layout"]' position="inside">
<t t-set="pageName" t-value="'event'"/>
<t t-set="head">
<t t-raw="head"/>
<t t-out="head"/>
<t t-call="website_event_track.pwa_manifest"/>
</t>
</xpath>
@@ -29,7 +29,7 @@
<xpath expr='//t[@t-call="website.layout"]' position="inside">
<t t-set="pageName" t-value="'event'"/>
<t t-set="head">
<t t-raw="head"/>
<t t-out="head"/>
<t t-call="website_event_track.pwa_manifest"/>
</t>
</xpath>
addons/website_forum/views/ir_qweb.xml
+1 -1
View File
@@ -21,7 +21,7 @@
<span class="fa fa-trophy badge-bronze ml-2" role="img" aria-label="Bronze badge" title="Bronze badge"/>
<t t-esc="object.bronze_badge"/>
</div>
<t t-raw="0"/>
<t t-out="0"/>
<div t-if="options.get('UserBio')" class="mt-2">
<div class="o_forum_tooltip_line" t-if="object.partner_id.country_id or object.partner_id.city">
<span t-field="object.partner_id.city"/><span t-if="object.partner_id.city and object.partner_id.country_id">, </span><span t-field="object.partner_id.country_id"/>
addons/website_forum/views/website_forum.xml
+2 -2
View File
@@ -90,7 +90,7 @@
<li t-elif="tags" class="breadcrumb-item">All Tags</li>
</ol>
</nav>
<t t-raw="0"/>
<t t-out="0"/>
</div>
<aside t-if="uid" class="d-none d-lg-flex justify-content-end col-auto">
<t t-call="website_forum.user_sidebar"/>
@@ -1021,7 +1021,7 @@
t-att-data-karma="forum.karma_downvote"
t-att-data-can-downvote="can_downvote"
aria-label="Negative vote" title="Negative vote"/>
<t t-raw="0"/>
<t t-out="0"/>
</div>
</template>
addons/website_sale/views/templates.xml
+2 -2
View File
@@ -155,7 +155,7 @@
<form t-attf-class="o_wsale_products_searchbar_form o_wait_lazy_js #{_classes}" t-att-action="action if action else '/shop'" method="get" t-att-data-snippet="_snippet">
<t>$0</t>
<input name="order" type="hidden" class="o_wsale_search_order_by" value=""/>
<t t-raw="0"/>
<t t-out="0"/>
</form>
</xpath>
</template>
@@ -934,7 +934,7 @@
<!-- We use this template where we want to give the user a link to the product of a sale order line. -->
<template id="cart_line_product_link" name="Shopping Cart Line Product Link">
<a t-att-href="line.product_id.website_url">
<t t-raw="0"/>
<t t-out="0"/>
</a>
</template>
odoo/addons/base/models/ir_qweb.py
-1
View File
@@ -2,7 +2,6 @@
from __future__ import print_function
import ast
import copy
import json
import logging
from collections import OrderedDict
from time import time
odoo/addons/base/tests/test_qweb.py
+1 -1
View File
@@ -82,7 +82,7 @@ class TestQWebTField(TransactionCase):
<t t-name="base.dummy">
<root>
<script type="application/javascript">
var s = <t t-raw="json.dumps({'key': malicious})"/>;
var s = <t t-esc="json.dumps({'key': malicious})"/>;
</script>
</root>
</t>
odoo/addons/base/views/onboarding_views.xml
+1 -1
View File
@@ -33,7 +33,7 @@
<i class="fa fa-times" title="Close the onboarding panel" />
</a>
<div class="o_onboarding_steps">
<t t-raw="0" />
<t t-out="0" />
</div>
<div t-att-class="'o_onboarding_completed_message text-center' + (' o_onboarding_steps_done' if state.get('onboarding_state') in ('done', 'just_done') else '') + (' o_onboarding_steps_just_done' if state.get('onboarding_state') == 'just_done' else '')">
<i class="fa fa-check text-success mr8" />