# -*- coding: utf-8 -*-
# Part of Odoo. See LICENSE file for full copyright and licensing details.
import collections
import json
import os.path
import re
import markupsafe
from lxml import etree, html
from lxml.builder import E
from copy import deepcopy
from textwrap import dedent
from odoo.tests.common import TransactionCase
from odoo.addons.base.models.ir_qweb import QWebException, render
from odoo.tools import misc, mute_logger
from odoo.tools.json import scriptsafe as json_scriptsafe
from odoo.exceptions import UserError, ValidationError, MissingError
unsafe_eval = eval
class TestQWebTField(TransactionCase):
def setUp(self):
super(TestQWebTField, self).setUp()
self.env_branding = self.env(context={'inherit_branding': True})
self.engine = self.env_branding['ir.qweb']
def test_trivial(self):
field = etree.Element('span', {'t-field': 'company.name'})
company = self.env['res.company'].create({'name': "My Test Company"})
result = self.engine._render(field, {'company': company})
self.assertEqual(
etree.fromstring(result),
etree.fromstring('%s' % (
company.id,
"My Test Company",
)),
)
def test_i18n(self):
field = etree.Element('span', {'t-field': 'company.name'})
s = "Testing «ταБЬℓσ»: 1<2 & 4+1>3, now 20% off!"
company = self.env['res.company'].create({'name': s})
result = self.engine._render(field, {'company': company})
self.assertEqual(
etree.fromstring(result),
etree.fromstring('%s' % (
company.id,
misc.html_escape(s),
)),
)
def test_reject_crummy_tags(self):
field = etree.Element('td', {'t-field': 'company.name'})
with self.assertRaisesRegex(QWebException, r'QWeb widgets do not work correctly'):
self.engine._render(field, {'company': None})
def test_reject_t_tag(self):
field = etree.Element('t', {'t-field': 'company.name'})
with self.assertRaisesRegex(QWebException, r't-field can not be used on a t element'):
self.engine._render(field, {'company': None})
def test_render_t_options(self):
view1 = self.env['ir.ui.view'].create({
'name': "dummy",
'type': 'qweb',
'arch': """
"""
})
text = etree.fromstring(self.env['ir.qweb']._render(view1.id)).find('span').text
self.assertEqual(text, '5.0000')
def test_xss_breakout(self):
view = self.env['ir.ui.view'].create({
'name': 'dummy', 'type': 'qweb',
'arch': """
"""
})
rendered = self.env['ir.qweb']._render(view.id, {'malicious': '1