[FIX] website: prevent crash on cors protect img used with animation

The image mouseover animation, introduced with [1], can crash through
legit UI flows:

- Visit your website on domain 1 (you will need to access the same
  website from another domain later):
  1. On local: use http://localhost:8069/ and http://127.0.0.1:8069/
  2. On runbot: use master-all and master in URL
  3. On odoo.com: use xyz.odoo.com and xyz.com
- Drag & drop "Text - Image" snippet
- Double click on the image to replace it
- Upload any image
- Click on the image and set its "Animation" option to "On Hover"
- Save
- Outside edit mode, mouseover the image to see the animation
- Behind the scene, the img src is changed from /web/image/xyz to a
  hardcoded base64 value to show the animation
- Now enter edit mode, the system will actually reset the src to the
  original src (to replace the b64) but it will replace it by an
  absolute link and not the initial relative link
- Edit the text below the image, BUT DON'T MOUSEOVER THE IMAGE
  (otherwise the absolute url would be turned into b64)
- Save, again DON'T MOUSEOVER THE IMAGE
- Now go on your second domain to access the same page

Bug: Mouseover the image, a `Uncaught Promise > Failed to fetch` error
will be raised because of a CORS error.

Indeed, on http://localhost:8069/, simply doing this in your debug tool:
```js
fetch('http://127.0.0.1:8069/website/static/src/img/snippets_demo/s_image_text.jpg')
```
will throw the same error.

Note: we can't just modify the CSP rule(s) to allow that domain because
we have no way to know which domains are safe and really domains from
the same database:
- When you are on xx.odoo.com, there is no way to know that xx.com is
  also your domain for the same website. At best it will be set in the
  website domain but it's not always the case (often not the case in
  mono website)
- When you are on xx.com, we have no way to know that xx.odoo.com is
  also your domain for the same website. At best it will be set in the
  ICP `web.base_url` but until that ICP is actually frozen, it will
  change every time the admin logs in the database.

[1]: https://github.com/odoo/odoo/commit/7f730f81ec541cc7791fc6b3fded17c838433f85

Part-of: odoo/odoo#146731
This commit is contained in:
Romain Derie
2023-12-21 16:07:46 +00:00
parent 657d5493f8
commit c51dc918fd
@@ -1744,7 +1744,10 @@ registry.ImageShapeHoverEffet = publicWidget.Widget.extend({
animateTransformEl.removeAttribute("begin");
});
this._setImgSrc(this.svgInEl, resolve);
});
}).catch(() => {
// Could be the case if somehow the `src` is an absolute
// URL from another domain.
});
} else {
this._setImgSrc(this.svgInEl, resolve);
}