odoo
/
odoo
2
0
Fork 0
Code Pull Requests Releases Activity

[FIX] ir.qweb: ensure attributes are generated encoded 

closes #2856, closes #4182
This commit is contained in:
Xavier Morel 2015-02-27 14:45:48 +01:00
parent 3956210a8b
commit 603c03799d
1 changed files with 8 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
openerp/addons/base/ir/ir_qweb.py
View File

@ -61,6 +61,12 @@ def raise_qweb_exception(etype=None, **kw):
e.qweb['cause'] = original
raise
def _build_attribute(name, value):
value = escape(value)
if isinstance(name, unicode): name = name.encode('utf-8')
if isinstance(value, unicode): value = value.encode('utf-8')
return ' %s="%s"' % (name, value)
class QWebContext(dict):
def __init__(self, cr, uid, data, loader=None, templates=None, context=None):
self.cr = cr
@ -274,8 +280,6 @@ class QWeb(orm.AbstractModel):
self, element, attribute_name, attribute_value, qwebcontext)
for att, val in attrs:
if not val: continue
if not isinstance(val, str):
val = unicode(val).encode('utf-8')
generated_attributes += self.render_attribute(element, att, val, qwebcontext)
break
else:
@ -340,7 +344,7 @@ class QWeb(orm.AbstractModel):
return "<%s%s/>" % (name, generated_attributes)
def render_attribute(self, element, name, value, qwebcontext):
return ' %s="%s"' % (name, escape(value))
return _build_attribute(name, value)
# Attributes
def render_att_att(self, element, attribute_name, attribute_value, qwebcontext):
@ -606,7 +610,7 @@ class FieldConverter(osv.AbstractModel):
if inherit_branding:
# add branding attributes
g_att += ''.join(
' %s="%s"' % (name, escape(value))
_build_attribute(name, value)
for name, value in self.attributes(
cr, uid, field_name, record, options,
source_element, g_att, t_att, qweb_context)