From 4af96310721237d3640bbd162ff9ea84e627028d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=A9rome=20Maes?= <jem@openerp.com>
Date: Mon, 1 Jun 2015 16:37:07 +0200
Subject: [MOV] mail, im_chat : move files and code from im_chat to mail and
 bus

- im_chat.session will be replaced by mail.channel
- im_chat.shortode is renamed into mail.shortcode
- im_chat.presence is moved to bus module
- js and controller code is moved from im_chat to mail module

This commit only move files, and modify manifests, bundles, ... The code will be adapt in the next commits.
---
 addons/mail/models/mail_shortcode.py | 48 ++++++++++++++++++++++++++++++++++++
 1 file changed, 48 insertions(+)
 create mode 100644 addons/mail/models/mail_shortcode.py

(limited to 'addons/mail/models/mail_shortcode.py')

diff --git a/addons/mail/models/mail_shortcode.py b/addons/mail/models/mail_shortcode.py
new file mode 100644
index 00000000000..42627e5abe5
--- /dev/null
+++ b/addons/mail/models/mail_shortcode.py
@@ -0,0 +1,48 @@
+# -*- coding: utf-8 -*-
+import cgi
+import re
+
+from openerp import api, fields, models
+
+
+class ImChatShortcode(models.Model):
+    """ Shortcode
+        Canned Responses, allowing the user to defined shortcuts in its chat message.
+        These shortcode are globals and are available for every user. Smiley use this mecanism.
+    """
+
+    _name = 'im_chat.shortcode'
+    _description = 'Canned Response / Shortcode'
+
+    source = fields.Char('Shortcut', required=True, index=True, help="The shortcut which must be replace in the Chat Messages")
+    substitution = fields.Char('Substitution', required=True, index=True, help="The excaped html code replacing the shortcut")
+    description = fields.Char('Description')
+
+    @api.model
+    def create(self, values):
+        if values.get('substitution'):
+            values['substitution'] = self._sanitize_shorcode(values['substitution'])
+        return super(ImChatShortcode, self).create(values)
+
+    @api.multi
+    def write(self, values):
+        if values.get('substitution'):
+            values['substitution'] = self._sanitize_shorcode(values['substitution'])
+        return super(ImChatShortcode, self).write(values)
+
+    def _sanitize_shorcode(self, substitution):
+        """ Sanitize the shortcode substitution :
+                 - HTML substitution : only allow the img tag (smiley)
+                 - escape other substitutions to avoid XSS
+        """
+        is_img_tag = re.match(r'''^<img\s+src=('|")([^'"]*)\1\s*/?>$''', substitution, re.M|re.I)
+        if is_img_tag:
+            return substitution
+        return cgi.escape(substitution)
+
+    @api.model
+    def replace_shortcode(self, message):
+        for shortcode in self.search([]):
+            regex = '(?:^|\s)(%s)(?:\s|$)' % re.escape(shortcode.source)
+            message = re.sub(regex, " " + shortcode.substitution + " ", message)
+        return message
-- 
cgit v1.2.3