Benoit Socias
11572f0f20
*: website, website_mass_mailing, website_payment When an unsafe snippet is dropped into a sanitized HTML model field, its unsafe content gets removed on save. We need a way to mark snippets as being (in)compatible with sanitization. It cannot be automatic, as, for example, the snippet introduced at [1] contains an iframe but is compatible with sanitization. In 13.0, we will temporarily set up an automatic mechanism that marks existing snippets containing forms as being incompatible with sanitization. In 14.0 a distinction between full sanitization and form-tolerant sanitization introduced at [2] is added with this forward-ported commit. This commit prevents unsafe snippets from being dropped into sanitized HTML model fields. The "Form Builder", "Product Search" and "Product Search Input" blocks are now prevented from being dropped or moved into form-sanitized HTML fields. To do this, this commit introduces a new `t-forbid-sanitize` attribute on the `t-snippet` tag. It can have the value `true` to prevent it from being dropped into any sanitize fields, or `form` to specifically limit to form-sanitized fields. Steps to reproduce (in 13.0): - Go to a product page - Drop a "Product Search" snippet into the product-specific section of the product - Save => The form was removed. [1]: https://github.com/odoo/odoo/commit/c2e9bd0e60014b6a42931cf300e0f89f8cf7c225 [2]: https://github.com/odoo/odoo/commit/388c222c6c4bb7e2fe3e67009b248359ae0fd3db task-2829961 closes odoo/odoo#96812 X-original-commit: 9eaba23781766730b06e936dbd9c5d0c28c909c6 Signed-off-by: Quentin Smetz (qsm) <qsm@odoo.com>
18 lines
794 B
XML
18 lines
794 B
XML
<?xml version="1.0" encoding="utf-8"?>
|
|
<odoo>
|
|
|
|
<template id="remove_external_snippets" inherit_id="website.external_snippets">
|
|
<xpath expr="//t[@t-install='website_payment']" position="replace"/>
|
|
</template>
|
|
|
|
<template id="snippets" inherit_id="website.snippets" name="Snippet Donation">
|
|
<xpath expr="//t[@id='snippet_donation_hook']" position="replace">
|
|
<t t-snippet="website_payment.s_donation" t-thumbnail="/website/static/src/img/snippets_thumbs/s_donation.svg" t-forbid-sanitize="form"/>
|
|
</xpath>
|
|
<xpath expr="//t[@id='snippet_donation_button_hook']" position="replace">
|
|
<t t-snippet="website_payment.s_donation_button" t-thumbnail="/website/static/src/img/snippets_thumbs/s_donation_button.svg" t-forbid-sanitize="form"/>
|
|
</xpath>
|
|
</template>
|
|
|
|
</odoo>
|