Now having
* sanitize: run the sanitizer to clean the html (removing javascripts,
unwanted tags, ...)
* sanitize_tags: only a subset of tags is allowed in html content.
Unwelcomed tags are remove dand their content stripped.
* sanitize_attributes: only a subset of attributes is allowed.
* sanitize_style: only a subset of style attributes is allowed. Style
attributes are parsed to keep only a white list.
* strip_style: all style is removed. It bypasses sanitize_style as there
is no need to sanitize something that is removed.
* strip_classes: remove class attributes
Fields parameters have also been updated to match the sanitize options. Html
fields by default are sanitized with sanitize_tags activated but without any
further options. All addons have been updated to match the new options
according to their previous behavior.
better patch for rev e9b649b555
* also fixes website_event which present the same issue (depends
on a function that slugs)
* raise an exception when slug is called with wrong arguments
instead of returning None (which was unclear)
* before calling slug in a function where we got a depends, check
that the record is actually created
When you execute the slug method on a virtual record (not yet
saved, virtualid/newid) the slugs obviously fails as it needs
an id and a display_name.
This issue happens when there's a depends on a function field
using the slug method: just after the create and during the
onchanges, they'll raise.
This patch makes the slug method returns None in these case,
anyway the depends are re-triggered after the write and at
this time they have an id and everything is working fine.
Since saas-3, website controllers use `request.website.render`
to render the template of a web page. This was kept for retro
compatibility. It's time to stop using deprecated stuff.
Same for `_render` method on website.
'json' route don't use `request.render` since
`JsonRequest` has no `render` method.
Commit c21568e14f deactivated the sanitization of frontend html fields so
that their modification through the editor worked again. However,
this broke the possibility to display their traduction and to modify
them.
The problem is that the translate option of html fields should not
equal "True" but instead be the html_translate function defined in
openerp.tool.translate. The translate=True option is automatically
change in html_translate though but there is a condition: the field
should be sanitized, which is why this broke since the sanitization
is disabled.
This commit sets the translate option of non-sanitized html fields
to html_translate. Maybe we should investigate for this to be automatic
for non-sanitized html fields as well.
Thanks to @rco-odoo.
Steps:
-Go into Slides (into Website Admin main menu)
-Find the Slide "Odoo Explained"
-Change the channel to "Employee Channel"
-Disconnect or open a private session
-Go to the menu "Presentations" on website
-Click on "Public channel"
Bug:
Error 403
Fix:
When changing the channel_id of a slide, the custom_slide_id of all
the channels using this slide as "Slide to Promote" has to change
in False to avoid access rights errors.
opw:682063
Since commit c9e38cae9f in saas-10, the html fields are sanitized in
strict mode by default. This breaks all html fields behaviour when it
is editable in the website editor.
This commit deactivate the sanitization for such HTML fields (like it
was already the case for blogs contents or products descriptions for
example). A more specific sanitization will be implemented in future
versions.
To be displayed correctly on odoo app (In a given category and not only in all or hidden)
the module category in the __openerp__.py file should be one of these:
"Accounting",
"Discuss",
"Document Management",
"eCommerce",
"Human Resources",
"Industries",
"Localization",
"Manufacturing",
"Marketing",
"Point of Sale",
"Productivity",
"Project",
"Purchases",
"Sales",
"Warehouse",
"Website",
"Extra Tools",
'Accounting & Finance' will not work, as 'Project Management', ...
Thibault Delavallée