When using the tab key on non text node range, it could fail in some
given case.
Also when removing the last element of the table row, a correction was done in
d33086c03f but if there was no element before the table (eg. the editor
is empty) an error could occur.
Tests for null range were not done in #8845, so in given case (where the
focus is not in the editor) we could get an issue.
The code for remembering the selection when clicking the editor
was made useful in d33086c03f, but there was an edge case when
the editor itself was in a modal: then the selection would be lost.
This commit change the code as following:
1) restore the selected range if:
- the current selected range is not in the editable of the active editor
- there is a corresponding saved selected range or we are in an embeded
editor (and not in air mode as when editing the website)
2) save the selected range if:
- we don't restore the selection,
- the current selected range is in the active editor editable area
On initialisation summernote call update method with oStyle.range is undefined.
The range can be undefined because the update is call before any selection and attach method from summernote call the update without range.
The method summernote_table_update try to use the range and raise an exception.
fix: Check if oStyle.range exits.
* add CSRF token as core.csrf_token
* add CSRF tokens to client-generated and/or JS-submitted forms
* remove broken "compatibility" mode of web.ajax.post
/cc @dmo-odoo I've no idea how that was supposed to work, from looking
things up all modern browsers seem to support FormData, and old IEs
which don't don't support fallbacks either and would require
submitting an actual form as fallback so...
* make CSRF protection the default on all non-SAFE methods
note: there currently is no way to call a CSRF-protected endpoint
without a form-encoded entity-body as that's the only place we get the
CSRF token from.
* simple CSRF token generation: just use the HMAC'd session id, no
generating a new random token per session then HMAC it
* use constant-time equal function to avoid timing attacks
* assert that a database secret is configured before hashing/validating
the CSRF token
* opt-out database manager from CSRF: The super-admin password serves
the purpose of a CSRF token in the database manager screens.
There is no request database to obtain the
secret and generate a CSRF token.
Office Outlook doesn't take into account the [style] attribute, and it
doesn't manage width/height in percent value.
This commit set width/heigth attribute in pixels and also always set the
width/height in style attribute (keeping them in the original unit and
setting them to auto if not present).
Before: if a user blur a editable area without editing, the editor is removed and all bind are remove.
The 'content_changed' bind are removed and the 'o_dirty' class is never apply.
If the iframe is destroyed, detached, hide (eg: click on a record, return into the list view and click on an other record), the render_value method try to resize the iframe but jQery raise an exception because contentWindow doesn't exist.
The css of a mail is inlined as best as possible for the mail sending.
Previously, if there was a selector like .ch[onclick="ga(this,event)"]
the simple splitting would split in the middle and get one erroneous
selector (which then would trigger an error).
With his commit, rules containing " or ' are ignored.
opw-643548
note: forward port of 6316bce
lxml.HTMLParser detect the content encoding by itself if not specified.
in the issue leading to this fix, content in a mail with u'\xa4'
( ) was transformed intto u'\xc2\xa4' (Â ) since HTMLParser
selected the wrong encoding (latin-1 instead of utf-8 for example).
this commit specify the known encoding and revert 3d00c210f which was
another attempt at this issue.
Clean for save was only called on o_dirty nodes but o_dirty is added only on o_editable nodes.
Could use a simple jQuery selector '.o_dirty, .o_dirty *' but need to improve speed for user experience.
Replace deprecate controllers like /web/binary/image, /web/binary/saveas...
Use ETag for all content with 'unique' option to cache the content if the content is never changed.
Nicolas Lempereur