From d8784e1af47d9f4ab2ab070ce52fc265974ef773 Mon Sep 17 00:00:00 2001 From: Jaysinh Shukla Date: Mon, 16 Mar 2015 14:08:05 +0530 Subject: [PATCH] [IMP] tools, forum: allow to strip classes from sanitized html. This behavior is not the default behavior to remain consistent with the previous behavior of the sanitizer. website_forum: when converting a post into a comment the html is now completely sanitized instead of parsed into plaintext. Inded comment are mail.message, thus holding html content. Styling and classes are removed to ensure only the basic html pattern is kept. --- addons/website_forum/models/forum.py | 2 +- openerp/tools/mail.py | 8 ++++++-- 2 files changed, 7 insertions(+), 3 deletions(-) diff --git a/addons/website_forum/models/forum.py b/addons/website_forum/models/forum.py index 1efb7cade15..94df769a88d 100644 --- a/addons/website_forum/models/forum.py +++ b/addons/website_forum/models/forum.py @@ -533,7 +533,7 @@ class Post(models.Model): question = self.parent_id values = { 'author_id': self.sudo().create_uid.partner_id.id, # use sudo here because of access to res.users model - 'body': tools.html2plaintext(self.content), + 'body': tools.html_sanitize(self.content, strict=True, strip_style=True, strip_classes=True), 'type': 'comment', 'subtype': 'mail.mt_comment', 'date': self.create_date, diff --git a/openerp/tools/mail.py b/openerp/tools/mail.py index b1f5768a320..46443481acf 100644 --- a/openerp/tools/mail.py +++ b/openerp/tools/mail.py @@ -53,7 +53,7 @@ safe_attrs = clean.defs.safe_attrs | frozenset( ]) -def html_sanitize(src, silent=True, strict=False, strip_style=False): +def html_sanitize(src, silent=True, strict=False, strip_style=False, strip_classes=False): if not src: return src src = ustr(src, errors='replace') @@ -88,9 +88,13 @@ def html_sanitize(src, silent=True, strict=False, strip_style=False): if strict: if etree.LXML_VERSION >= (3, 1, 0): # lxml < 3.1.0 does not allow to specify safe_attrs. We keep all attributes in order to keep "style" + if strip_classes: + current_safe_attrs = safe_attrs - frozenset(['class']) + else: + current_safe_attrs = safe_attrs kwargs.update({ 'safe_attrs_only': True, - 'safe_attrs': safe_attrs, + 'safe_attrs': current_safe_attrs, }) else: kwargs['safe_attrs_only'] = False # keep oe-data attributes + style