From a8e326e3b6af17a7108d620698908a6faed2c123 Mon Sep 17 00:00:00 2001 From: Antoine Guenet Date: Fri, 27 Jan 2023 11:10:51 +0000 Subject: [PATCH] [FIX] web_editor: properly forbid video command in sanitized fields The video command is supposed to be forbidden in tag-sanitized fields. A field gets tag-sanitized if sanitize_tags is true or by default if the field is to be sanitized (and sanitize_tags is undefined). Before this commit, the video command was not forbidden if sanitize was true, regardless of the value of sanitize_tags. closes odoo/odoo#111777 X-original-commit: 96b4edfd40a3c131a7709986fc3e1599c177f986 Signed-off-by: David Monjoie (dmo) --- addons/web_editor/static/src/js/backend/field_html.js | 4 ++-- addons/web_editor/static/src/js/backend/html_field.js | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/addons/web_editor/static/src/js/backend/field_html.js b/addons/web_editor/static/src/js/backend/field_html.js index 80245b19007..7c7b1ec4559 100644 --- a/addons/web_editor/static/src/js/backend/field_html.js +++ b/addons/web_editor/static/src/js/backend/field_html.js @@ -265,8 +265,8 @@ var FieldHtml = basic_fields.DebouncedField.extend(TranslatableFieldMixin, { // default can be set elsewhere otherwise. wysiwygOptions.allowCommandImage = Boolean(this.nodeOptions.allowCommandImage); } - if (this.field.sanitize && this.field.sanitize_tags) { - wysiwygOptions.allowCommandVideo = false; // Sanitized fields remove videos. + if (this.field.sanitize_tags || (this.field.sanitize_tags === undefined && this.field.sanitize)) { + wysiwygOptions.allowCommandVideo = false; // Tag-sanitized fields remove videos. } else if ('allowCommandVideo' in this.nodeOptions) { // Set the option only if it is explicitly set in the view so a // default can be set elsewhere otherwise. diff --git a/addons/web_editor/static/src/js/backend/html_field.js b/addons/web_editor/static/src/js/backend/html_field.js index d5105bd7285..4dd5f0a7a64 100644 --- a/addons/web_editor/static/src/js/backend/html_field.js +++ b/addons/web_editor/static/src/js/backend/html_field.js @@ -640,8 +640,8 @@ HtmlField.extractProps = ({ attrs, field }) => { // can be set elsewhere otherwise. wysiwygOptions.allowCommandImage = Boolean(attrs.options.allowCommandImage); } - if (field.sanitize && field.sanitize_tags) { - wysiwygOptions.allowCommandVideo = false; // Sanitized fields remove videos. + if (field.sanitize_tags || (field.sanitize_tags === undefined && field.sanitize)) { + wysiwygOptions.allowCommandVideo = false; // Tag-sanitized fields remove videos. } else if ('allowCommandVideo' in attrs.options) { // Set the option only if it is explicitly set in the view so a default // can be set elsewhere otherwise.