[FIX] website: prevent crash on cors protect img used with animation
The image mouseover animation, introduced with [1], can crash through legit UI flows: - Visit your website on domain 1 (you will need to access the same website from another domain later): 1. On local: use http://localhost:8069/ and http://127.0.0.1:8069/ 2. On runbot: use master-all and master in URL 3. On odoo.com: use xyz.odoo.com and xyz.com - Drag & drop "Text - Image" snippet - Double click on the image to replace it - Upload any image - Click on the image and set its "Animation" option to "On Hover" - Save - Outside edit mode, mouseover the image to see the animation - Behind the scene, the img src is changed from /web/image/xyz to a hardcoded base64 value to show the animation - Now enter edit mode, the system will actually reset the src to the original src (to replace the b64) but it will replace it by an absolute link and not the initial relative link - Edit the text below the image, BUT DON'T MOUSEOVER THE IMAGE (otherwise the absolute url would be turned into b64) - Save, again DON'T MOUSEOVER THE IMAGE - Now go on your second domain to access the same page Bug: Mouseover the image, a `Uncaught Promise > Failed to fetch` error will be raised because of a CORS error. Indeed, on http://localhost:8069/, simply doing this in your debug tool: ```js fetch('http://127.0.0.1:8069/website/static/src/img/snippets_demo/s_image_text.jpg') ``` will throw the same error. Note: we can't just modify the CSP rule(s) to allow that domain because we have no way to know which domains are safe and really domains from the same database: - When you are on xx.odoo.com, there is no way to know that xx.com is also your domain for the same website. At best it will be set in the website domain but it's not always the case (often not the case in mono website) - When you are on xx.com, we have no way to know that xx.odoo.com is also your domain for the same website. At best it will be set in the ICP `web.base_url` but until that ICP is actually frozen, it will change every time the admin logs in the database. [1]: https://github.com/odoo/odoo/commit/7f730f81ec541cc7791fc6b3fded17c838433f85 Part-of: odoo/odoo#146731
This commit is contained in:
@@ -1744,7 +1744,10 @@ registry.ImageShapeHoverEffet = publicWidget.Widget.extend({
|
||||
animateTransformEl.removeAttribute("begin");
|
||||
});
|
||||
this._setImgSrc(this.svgInEl, resolve);
|
||||
});
|
||||
}).catch(() => {
|
||||
// Could be the case if somehow the `src` is an absolute
|
||||
// URL from another domain.
|
||||
});
|
||||
} else {
|
||||
this._setImgSrc(this.svgInEl, resolve);
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user