[FIX] web_editor: fix issues related to loading image info

In order to allow modifying background images, we need information on
the image, this is done by creating a placeholder img and calling the
loadImageInfo function on it. However this function did not account for
the case where an image had not src attribute, which causes an
unnecessary rpc. Other problems could arise from this as an attachment
that doesn't have the correct mimetype but has a matching src could be
returned, causing its image_src field to be false, which we would then
attempt to load as a valid image, causing crashes.

This commit fixes that by not trying to load image infos when the src of
an image is empty, only looking for attachments of the supported
mimetypes, and also checking that we actually did receive an image_src
before setting it as the original src of the image, which will prevent
accidentally trying to load a falsy src as an actual image.

closes odoo/odoo#60982

X-original-commit: b0993370b6fcec1f966e4bf2994eee7f31da82d5
Signed-off-by: Quentin Smetz (qsm) <qsm@odoo.com>

addons/web_editor/controllers/main.py

@@ -17,6 +17,8 @@ from odoo.exceptions import UserError
 from odoo.modules.module import get_module_path, get_resource_path
 from odoo.tools.misc import file_open
 
+from ..models.ir_attachment import SUPPORTED_IMAGE_MIMETYPES
+
 logger = logging.getLogger(__name__)
 DEFAULT_LIBRARY_ENDPOINT = 'https://media-api.odoo.com'
 
@@ -224,7 +226,10 @@ class Web_Editor(http.Controller):
         else:
             # Find attachment by url. There can be multiple matches because of default
             # snippet images referencing the same image in /static/, so we limit to 1
-            attachment = request.env['ir.attachment'].search([('url', '=like', src)], limit=1)
+            attachment = request.env['ir.attachment'].search([
+                ('url', '=like', src),
+                ('mimetype', 'in', SUPPORTED_IMAGE_MIMETYPES),
+            ], limit=1)
         if not attachment:
             return {
                 'attachment': False,

addons/web_editor/models/ir_attachment.py

@@ -5,6 +5,7 @@ from werkzeug.urls import url_quote
 
 from odoo import api, models, fields, tools
 
+SUPPORTED_IMAGE_MIMETYPES = ['image/gif', 'image/jpe', 'image/jpeg', 'image/jpg', 'image/gif', 'image/png', 'image/svg+xml']
 
 class IrAttachment(models.Model):
 
@@ -27,7 +28,7 @@ class IrAttachment(models.Model):
     def _compute_image_src(self):
         for attachment in self:
             # Only add a src for supported images
-            if attachment.mimetype not in ['image/gif', 'image/jpe', 'image/jpeg', 'image/jpg', 'image/gif', 'image/png', 'image/svg+xml']:
+            if attachment.mimetype not in SUPPORTED_IMAGE_MIMETYPES:
                 attachment.image_src = False
                 continue
 

addons/web_editor/static/src/js/editor/image_processing.js

@@ -305,17 +305,19 @@ async function activateCropper(image, aspectRatio, dataset) {
  *   this would be passed as 'this._rpc.bind(this)' from widgets.
  */
 async function loadImageInfo(img, rpc) {
+    const src = img.getAttribute('src');
     // If there is a marked originalSrc, the data is already loaded.
-    if (img.dataset.originalSrc) {
+    if (img.dataset.originalSrc || !src) {
         return;
     }
 
     const {original} = await rpc({
         route: '/web_editor/get_image_info',
-        params: {src: img.getAttribute('src').split(/[?#]/)[0]},
+        params: {src: src.split(/[?#]/)[0]},
     });
     // Check that url is local.
-    if (original && new URL(original.image_src, window.location.origin).origin === window.location.origin) {
+    const isLocal = original && new URL(original.image_src, window.location.origin).origin === window.location.origin;
+    if (isLocal && original.image_src) {
         img.dataset.originalId = original.id;
         img.dataset.originalSrc = original.image_src;
         img.dataset.mimetype = original.mimetype;