diff options
| author | fja-odoo <fja@odoo.com> | 2020-03-31 14:04:15 +0000 |
|---|---|---|
| committer | fja-odoo <fja@odoo.com> | 2020-03-31 14:22:43 +0000 |
| commit | 388c222c6c4bb7e2fe3e67009b248359ae0fd3db (patch) | |
| tree | 0759af6f5fcda3ebddee5a96ea73a9c666ebdf04 /odoo | |
| parent | 0d52f9c379e6b837bbcfc121cda40d1ecc3599e8 (diff) | |
[IMP] base, *: allow html fields not to sanitize forms
* = event, website_event_track, website_sale, website_hr_recruitment,
website_livechat, website_sale, website_slides
The option to sanitize or not the forms was not available, this will
allow better flexibility on whether forms should be sanitized or not on
an HTML field.
Also we use this new param to allow forms to be added on some already
existing html fields where forms where sanitized out.
task-2209554
closes odoo/odoo#47318
Signed-off-by: Jérémy Kersten (jke) <jke@openerp.com>
Diffstat (limited to 'odoo')
| -rw-r--r-- | odoo/fields.py | 3 | ||||
| -rw-r--r-- | odoo/tools/mail.py | 4 |
2 files changed, 5 insertions, 2 deletions
diff --git a/odoo/fields.py b/odoo/fields.py index 9a54022c986..38dd2b8d833 100644 --- a/odoo/fields.py +++ b/odoo/fields.py @@ -1627,6 +1627,7 @@ class Html(_String): 'sanitize_tags': True, # whether to sanitize tags (only a white list of attributes is accepted) 'sanitize_attributes': True, # whether to sanitize attributes (only a white list of attributes is accepted) 'sanitize_style': False, # whether to sanitize style attributes + 'sanitize_form': True, # whether to sanitize forms 'strip_style': False, # whether to strip style attributes (removed and therefore not sanitized) 'strip_classes': False, # whether to strip classes attributes } @@ -1662,6 +1663,7 @@ class Html(_String): sanitize_tags=self.sanitize_tags, sanitize_attributes=self.sanitize_attributes, sanitize_style=self.sanitize_style, + sanitize_form=self.sanitize_form, strip_style=self.strip_style, strip_classes=self.strip_classes) return value @@ -1675,6 +1677,7 @@ class Html(_String): sanitize_tags=self.sanitize_tags, sanitize_attributes=self.sanitize_attributes, sanitize_style=self.sanitize_style, + sanitize_form=self.sanitize_form, strip_style=self.strip_style, strip_classes=self.strip_classes) return value diff --git a/odoo/tools/mail.py b/odoo/tools/mail.py index d1bc961e8ff..8738f132f72 100644 --- a/odoo/tools/mail.py +++ b/odoo/tools/mail.py @@ -166,7 +166,7 @@ class _Cleaner(clean.Cleaner): return super(_Cleaner, self).allow_element(el) -def html_sanitize(src, silent=True, sanitize_tags=True, sanitize_attributes=False, sanitize_style=False, strip_style=False, strip_classes=False): +def html_sanitize(src, silent=True, sanitize_tags=True, sanitize_attributes=False, sanitize_style=False, sanitize_form=True, strip_style=False, strip_classes=False): if not src: return src src = ustr(src, errors='replace') @@ -184,7 +184,7 @@ def html_sanitize(src, silent=True, sanitize_tags=True, sanitize_attributes=Fals 'page_structure': True, 'style': strip_style, # True = remove style tags/attrs 'sanitize_style': sanitize_style, # True = sanitize styling - 'forms': True, # True = remove form tags + 'forms': sanitize_form, # True = remove form tags 'remove_unknown_tags': False, 'comments': False, 'processing_instructions': False |