Xavier Morel
e2f1af78c4
cgi.escape is unsafe (quote=False by default) and deprecated in Python 3. We already have an openerp.tools.misc.html_escape version which forwards to the (modern and safe) werkzeug.utils.escape, just use that everywhere, and convert extant uses of werkzeug.utils.escape to utils.html_escape as well so that we do the same thing everywhere.
24 lines
694 B
Python
24 lines
694 B
Python
# -*- coding: utf-8 -*-
|
|
# Part of Odoo. See LICENSE file for full copyright and licensing details.
|
|
|
|
import json
|
|
|
|
from odoo import http
|
|
from odoo.http import request
|
|
from odoo.tools import misc
|
|
|
|
|
|
class ImportController(http.Controller):
|
|
|
|
@http.route('/base_import/set_file', methods=['POST'])
|
|
def set_file(self, file, import_id, jsonp='callback'):
|
|
import_id = int(import_id)
|
|
|
|
written = request.env['base_import.import'].browse(import_id).write({
|
|
'file': file.read(),
|
|
'file_name': file.filename,
|
|
'file_type': file.content_type,
|
|
})
|
|
|
|
return 'window.top.%s(%s)' % (misc.html_escape(jsonp), json.dumps({'result': written}))
|