[FIX] web_editor: fix issues related to loading image info

In order to allow modifying background images, we need information on
the image, this is done by creating a placeholder img and calling the
loadImageInfo function on it. However this function did not account for
the case where an image had not src attribute, which causes an
unnecessary rpc. Other problems could arise from this as an attachment
that doesn't have the correct mimetype but has a matching src could be
returned, causing its image_src field to be false, which we would then
attempt to load as a valid image, causing crashes.

This commit fixes that by not trying to load image infos when the src of
an image is empty, only looking for attachments of the supported
mimetypes, and also checking that we actually did receive an image_src
before setting it as the original src of the image, which will prevent
accidentally trying to load a falsy src as an actual image.

closes odoo/odoo#60953

Signed-off-by: Quentin Smetz (qsm) <qsm@odoo.com>

3 files changed, 13 insertions, 5 deletions

diff --git a/addons/web_editor/controllers/main.py b/addons/web_editor/controllers/main.py
index e79751eeb79..87db5e7b377 100644
--- a/addons/web_editor/controllers/main.py
+++ b/addons/web_editor/controllers/main.py
@@ -17,6 +17,8 @@ from odoo.exceptions import UserError
 from odoo.modules.module import get_module_path, get_resource_path
 from odoo.tools.misc import file_open
 
+from ..models.ir_attachment import SUPPORTED_IMAGE_MIMETYPES
+
 logger = logging.getLogger(__name__)
 DEFAULT_LIBRARY_ENDPOINT = 'https://media-api.odoo.com'
 
@@ -224,7 +226,10 @@ class Web_Editor(http.Controller):
         else:
             # Find attachment by url. There can be multiple matches because of default
             # snippet images referencing the same image in /static/, so we limit to 1
-            attachment = request.env['ir.attachment'].search([('url', '=like', src)], limit=1)
+            attachment = request.env['ir.attachment'].search([
+                ('url', '=like', src),
+                ('mimetype', 'in', SUPPORTED_IMAGE_MIMETYPES),
+            ], limit=1)
         if not attachment:
             return {
                 'attachment': False,
diff --git a/addons/web_editor/models/ir_attachment.py b/addons/web_editor/models/ir_attachment.py
index b9a1986727a..791f919498e 100644
--- a/addons/web_editor/models/ir_attachment.py
+++ b/addons/web_editor/models/ir_attachment.py
@@ -5,6 +5,7 @@ from werkzeug.urls import url_quote
 
 from odoo import api, models, fields, tools
 
+SUPPORTED_IMAGE_MIMETYPES = ['image/gif', 'image/jpe', 'image/jpeg', 'image/jpg', 'image/gif', 'image/png', 'image/svg+xml']
 
 class IrAttachment(models.Model):
 
@@ -27,7 +28,7 @@ class IrAttachment(models.Model):
     def _compute_image_src(self):
         for attachment in self:
             # Only add a src for supported images
-            if attachment.mimetype not in ['image/gif', 'image/jpe', 'image/jpeg', 'image/jpg', 'image/gif', 'image/png', 'image/svg+xml']:
+            if attachment.mimetype not in SUPPORTED_IMAGE_MIMETYPES:
                 attachment.image_src = False
                 continue
 
diff --git a/addons/web_editor/static/src/js/editor/image_processing.js b/addons/web_editor/static/src/js/editor/image_processing.js
index 7a30b60346e..e3497634678 100644
--- a/addons/web_editor/static/src/js/editor/image_processing.js
+++ b/addons/web_editor/static/src/js/editor/image_processing.js
@@ -305,17 +305,19 @@ async function activateCropper(image, aspectRatio, dataset) {
  *   this would be passed as 'this._rpc.bind(this)' from widgets.
  */
 async function loadImageInfo(img, rpc) {
+    const src = img.getAttribute('src');
     // If there is a marked originalSrc, the data is already loaded.
-    if (img.dataset.originalSrc) {
+    if (img.dataset.originalSrc || !src) {
         return;
     }
 
     const {original} = await rpc({
         route: '/web_editor/get_image_info',
-        params: {src: img.getAttribute('src').split(/[?#]/)[0]},
+        params: {src: src.split(/[?#]/)[0]},
     });
     // Check that url is local.
-    if (original && new URL(original.image_src, window.location.origin).origin === window.location.origin) {
+    const isLocal = original && new URL(original.image_src, window.location.origin).origin === window.location.origin;
+    if (isLocal && original.image_src) {
         img.dataset.originalId = original.id;
         img.dataset.originalSrc = original.image_src;
         img.dataset.mimetype = original.mimetype;