When using the tab key on non text node range, it could fail in some
given case.
Also when removing the last element of the table row, a correction was done in
d33086c03f but if there was no element before the table (eg. the editor
is empty) an error could occur.
Tests for null range were not done in #8845, so in given case (where the
focus is not in the editor) we could get an issue.
The code for remembering the selection when clicking the editor
was made useful in d33086c03f, but there was an edge case when
the editor itself was in a modal: then the selection would be lost.
This commit change the code as following:
1) restore the selected range if:
- the current selected range is not in the editable of the active editor
- there is a corresponding saved selected range or we are in an embeded
editor (and not in air mode as when editing the website)
2) save the selected range if:
- we don't restore the selection,
- the current selected range is in the active editor editable area
On initialisation summernote call update method with oStyle.range is undefined.
The range can be undefined because the update is call before any selection and attach method from summernote call the update without range.
The method summernote_table_update try to use the range and raise an exception.
fix: Check if oStyle.range exits.
* add CSRF token as core.csrf_token
* add CSRF tokens to client-generated and/or JS-submitted forms
* remove broken "compatibility" mode of web.ajax.post
/cc @dmo-odoo I've no idea how that was supposed to work, from looking
things up all modern browsers seem to support FormData, and old IEs
which don't don't support fallbacks either and would require
submitting an actual form as fallback so...
* make CSRF protection the default on all non-SAFE methods
note: there currently is no way to call a CSRF-protected endpoint
without a form-encoded entity-body as that's the only place we get the
CSRF token from.
* simple CSRF token generation: just use the HMAC'd session id, no
generating a new random token per session then HMAC it
* use constant-time equal function to avoid timing attacks
* assert that a database secret is configured before hashing/validating
the CSRF token
* opt-out database manager from CSRF: The super-admin password serves
the purpose of a CSRF token in the database manager screens.
There is no request database to obtain the
secret and generate a CSRF token.
Office Outlook doesn't take into account the [style] attribute, and it
doesn't manage width/height in percent value.
This commit set width/heigth attribute in pixels and also always set the
width/height in style attribute (keeping them in the original unit and
setting them to auto if not present).
The stdlib version of the json library is more recent than the 3.5.3
version we are pinning in `requirements.txt`
There is no reason to use it.
Closes#6940
The `unittest2` package is simply a backport of `unittest` from the
Standard Library of Python 2.7 to previous versions.
There is no reason to use it any longer.
Closes#6941
Before: if a user blur a editable area without editing, the editor is removed and all bind are remove.
The 'content_changed' bind are removed and the 'o_dirty' class is never apply.
Add "web_editor_inside_iframe" id in web_editor iframe template to apply css style only when the field is in html field.
Remove "content" css media query in iframe editor to remove scrollbar.
If the iframe is destroyed, detached, hide (eg: click on a record, return into the list view and click on an other record), the render_value method try to resize the iframe but jQery raise an exception because contentWindow doesn't exist.
The css of a mail is inlined as best as possible for the mail sending.
Previously, if there was a selector like .ch[onclick="ga(this,event)"]
the simple splitting would split in the middle and get one erroneous
selector (which then would trigger an error).
With his commit, rules containing " or ' are ignored.
opw-643548
note: forward port of 6316bce
Now that most refactoring has been merged
It is better to have red a great work of another culture in translation than never to have read it at all.
― Henry Gratton Doyle
lxml.HTMLParser detect the content encoding by itself if not specified.
in the issue leading to this fix, content in a mail with u'\xa4'
( ) was transformed intto u'\xc2\xa4' (Â ) since HTMLParser
selected the wrong encoding (latin-1 instead of utf-8 for example).
this commit specify the known encoding and revert 3d00c210f which was
another attempt at this issue.
Nicolas Lempereur