* when getting the src of an uploaded attachment we have to use src which
is by default url,
* in a MediaDialog the pager is shared between the document and image
dialog, but when changing page, it was done for both (even if not
displayed),
* select the image after uploading it in the ImageDialog.
closes#9284
opw-653061
opw-653167
In IE11, when adding a range to a selection that can fail if this range
is not displayed (display non on itself or an ancestor) or is not already
inserted in the dom.
e.g: IE fails in the following situation: http://jsfiddle.net/7cmf2tt9/7/
The feature causing this situation is minimal : it only set the cursor
at the end of a FieldTextHtmlSimple widget (the default widget for
fields.Html). This commit thus only ignore that error.
note: this is not an issue on IE Edge.
closes#9216
opw-652347
Difficulty for the user to understand how to change the images.
Some options summernote being in the bar and the other in the snippets editor.
Need to merge this options.
On Firefox, the website page is not completely reloaded after saving or
cancelling. Because of this behavior, the Edit button is kept disabled,
forcing the user to completely refresh the page in order to activate the
Edit button.
When we initialize the web editor, the font size in the toolbar is
initialized to NaN.
What is done:
- Initialize the Summernote editor in initialize_content
- Render the content of the node in render_value
- Append the node to the DOM
Since the Summernote editor is initialized in initialize_content, the
node is still hidden. Since the node is hidden, Summernote won't be able
to determine the style info of the text (see method fromNode from
Style.js). Indeed, when jQueryCss is called, $node.is(':hidden') is true
which will lead to styleInfo['font-size'] = NaN.
To avoid patching Summernote, we take advantage of an existing trigger
which reloads the button content upon mouseup. This is also safer than
initializing Summernote after appending the node to the DOM.
opw-652041
When using the tab key on non text node range, it could fail in some
given case.
Also when removing the last element of the table row, a correction was done in
d33086c03f but if there was no element before the table (eg. the editor
is empty) an error could occur.
Tests for null range were not done in #8845, so in given case (where the
focus is not in the editor) we could get an issue.
The code for remembering the selection when clicking the editor
was made useful in d33086c03f, but there was an edge case when
the editor itself was in a modal: then the selection would be lost.
This commit change the code as following:
1) restore the selected range if:
- the current selected range is not in the editable of the active editor
- there is a corresponding saved selected range or we are in an embeded
editor (and not in air mode as when editing the website)
2) save the selected range if:
- we don't restore the selection,
- the current selected range is in the active editor editable area
On initialisation summernote call update method with oStyle.range is undefined.
The range can be undefined because the update is call before any selection and attach method from summernote call the update without range.
The method summernote_table_update try to use the range and raise an exception.
fix: Check if oStyle.range exits.
* add CSRF token as core.csrf_token
* add CSRF tokens to client-generated and/or JS-submitted forms
* remove broken "compatibility" mode of web.ajax.post
/cc @dmo-odoo I've no idea how that was supposed to work, from looking
things up all modern browsers seem to support FormData, and old IEs
which don't don't support fallbacks either and would require
submitting an actual form as fallback so...
* make CSRF protection the default on all non-SAFE methods
note: there currently is no way to call a CSRF-protected endpoint
without a form-encoded entity-body as that's the only place we get the
CSRF token from.
* simple CSRF token generation: just use the HMAC'd session id, no
generating a new random token per session then HMAC it
* use constant-time equal function to avoid timing attacks
* assert that a database secret is configured before hashing/validating
the CSRF token
* opt-out database manager from CSRF: The super-admin password serves
the purpose of a CSRF token in the database manager screens.
There is no request database to obtain the
secret and generate a CSRF token.
Office Outlook doesn't take into account the [style] attribute, and it
doesn't manage width/height in percent value.
This commit set width/heigth attribute in pixels and also always set the
width/height in style attribute (keeping them in the original unit and
setting them to auto if not present).
Before: if a user blur a editable area without editing, the editor is removed and all bind are remove.
The 'content_changed' bind are removed and the 'o_dirty' class is never apply.
If the iframe is destroyed, detached, hide (eg: click on a record, return into the list view and click on an other record), the render_value method try to resize the iframe but jQery raise an exception because contentWindow doesn't exist.
The css of a mail is inlined as best as possible for the mail sending.
Previously, if there was a selector like .ch[onclick="ga(this,event)"]
the simple splitting would split in the middle and get one erroneous
selector (which then would trigger an error).
With his commit, rules containing " or ' are ignored.
opw-643548
note: forward port of 6316bce
Christophe Matthieu