Skip to content

Commit

Permalink
TA#68974 [FIX] Web_custom_modifier
Browse files Browse the repository at this point in the history
  • Loading branch information
rivo2302 committed Sep 17, 2024
1 parent 5f2093b commit e487f02
Showing 1 changed file with 9 additions and 5 deletions.
14 changes: 9 additions & 5 deletions web_custom_modifier/models/ir_ui_view.py
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
# Copyright 2023-today Numigi and all its contributors (https://bit.ly/numigiens)
# License LGPL-3.0 or later (http://www.gnu.org/licenses/lgpl).

from lxml import etree

Check warning on line 4 in web_custom_modifier/models/ir_ui_view.py

View check run for this annotation

Codacy Production / Codacy Static Code Analysis

web_custom_modifier/models/ir_ui_view.py#L4

Using etree to parse untrusted XML data is known to be vulnerable to XML attacks. Replace etree with the equivalent defusedxml package.
import json
from odoo import models
from .common import set_custom_modifiers_on_fields
Expand All @@ -17,12 +18,15 @@ class ViewWithCustomModifiers(models.Model):
_inherit = "ir.ui.view"

def postprocess_and_fields(self, node, model=None, **options):
modifiers = self.env["web.custom.modifier"].get(model)
node_with_custom_modifiers = _add_custom_modifiers_to_view_arch(modifiers, node)
self.clear_caches() # Clear the cache in order to recompute _get_active_rules
return super().postprocess_and_fields(
node_with_custom_modifiers, model, **options
# Clear the cache in order to recompute _get_active_rules
self.clear_caches()
arch, models = super().postprocess_and_fields(

Check warning on line 23 in web_custom_modifier/models/ir_ui_view.py

View check run for this annotation

Codacy Production / Codacy Static Code Analysis

web_custom_modifier/models/ir_ui_view.py#L23

Unused variable 'arch'
node, model, **options
)
modifiers = self.env["web.custom.modifier"].get(model)
_add_custom_modifiers_to_view_arch(modifiers, node)
res = etree.tostring(node, encoding="unicode").replace('\t', '')
return res, models

def _postprocess_view(
self, node, model_name, editable=True, parent_name_manager=None, **options
Expand Down

0 comments on commit e487f02

Please sign in to comment.