tryton-sao 6.0.65 → 6.0.67

package/CHANGELOG

@@ -1,4 +1,14 @@
 
+Version 6.0.67 - 2025-10-20
+---------------------------
+* Bug fixes (see mercurial logs for details)
+* Use sandboxed iframe to display document (issue14290)
+
+Version 6.0.66 - 2025-10-02
+---------------------------
+* Bug fixes (see mercurial logs for details)
+
+
 Version 6.0.65 - 2025-09-15
 ---------------------------
 * Bug fixes (see mercurial logs for details)

package/dist/tryton-sao.css

@@ -9922,19 +9922,31 @@ img.icon {
   width: 4em;
   height: 4em;
 }
-.form .form-document object {
+.form .form-document object,
+.form .form-document img {
   object-fit: scale-down;
   object-position: center top;
+}
+.form .form-document iframe {
+  border: 0;
+}
+.form .form-document object,
+.form .form-document iframe,
+.form .form-document img {
   width: 100%;
   height: 75vh;
 }
 @media screen and (max-width: 991px) {
-  .form .form-document object {
+  .form .form-document object,
+  .form .form-document iframe,
+  .form .form-document img {
     height: 50vh;
   }
 }
 @media screen and (max-width: 767px) {
-  .form .form-document object {
+  .form .form-document object,
+  .form .form-document iframe,
+  .form .form-document img {
     height: 25vh;
   }
 }

package/dist/tryton-sao.js

@@ -18434,15 +18434,42 @@ function eval_pyson(value){
                 'class': this.class_,
             });
 
-            this.object = jQuery('<object/>', {
+            this.content = this._create_content().appendTo(this.el);
+        },
+        _create_content: function(mimetype, url) {
+            let tag_name = 'iframe';
+            if (mimetype) {
+                if (mimetype.startsWith('image/')) {
+                    tag_name = 'img';
+                } else if (mimetype == 'application/pdf') {
+                    tag_name = 'object';
+                }
+            }
+            let content = jQuery(`<${tag_name}/>`, {
                 'class': 'center-block',
-            }).appendTo(this.el);
-            if (attributes.height) {
-                this.object.css('height', parseInt(attributes.height, 10));
+            });
+            if (tag_name == 'iframe') {
+                content.attr('sandbox', '');
+            }
+            if (this.attributes.height) {
+                content.css('height', parseInt(this.attributes.height, 10));
             }
-            if (attributes.width) {
-                this.object.css('width', parseInt(attributes.width, 10));
+            if (this.attributes.width) {
+                content.css('width', parseInt(this.attributes.width, 10));
+            }
+            if (url) {
+                // set onload before data/src to be always called
+                content.get().onload = function() {
+                    this.onload = null;
+                    window.URL.revokeObjectURL(url);
+                };
+                if (tag_name== 'object') {
+                    content.attr('data', url);
+                } else {
+                    content.attr('src', url);
+                }
             }
+            return content;
         },
         display: function() {
             Sao.View.Form.Document._super.display.call(this);
@@ -18458,31 +18485,29 @@ function eval_pyson(value){
                 filename = filename_field.get_client(record);
             }
             data.done(function(data) {
-                var url, blob;
                 if (record !== this.record) {
                     return;
                 }
+                let url = this.content.attr('data') ||
+                    this.content.attr('src');
+                window.URL.revokeObjectURL(url);
+                let mimetype;
                 if (!data) {
                     url = null;
                 } else {
-                    var mimetype = Sao.common.guess_mimetype(filename);
+                    mimetype = Sao.common.guess_mimetype(filename);
                     if (mimetype == 'application/octet-binary') {
                         mimetype = null;
                     }
-                    blob = new Blob([data], {
+                    let blob = new Blob([data], {
                         'type': mimetype,
                     });
                     url = window.URL.createObjectURL(blob);
                 }
                 // duplicate object to force refresh on buggy browsers
-                var object = this.object.clone();
-                object.attr('data', url);
-                object.get(0).onload = function() {
-                    window.URL.revokeObjectURL(url);
-                };
-                object.attr('data', url);
-                this.object.replaceWith(object);
-                this.object = object;
+                let content = this._create_content(mimetype, url);
+                this.content.replaceWith(content);
+                this.content = content;
             }.bind(this));
         },
     });
@@ -22531,20 +22556,15 @@ function eval_pyson(value){
                     }
                 };
             }
+            let keys = this._data_keys(data);
             var color = this.view.attributes.color || Sao.config.graph_color;
             var rgb = Sao.common.hex2rgb(
                 Sao.common.COLOR_SCHEMES[color] || color);
             var maxcolor = Math.max.apply(null, rgb);
-            var keys = [];
-            var i, yfield;
-            for (i = 0; i < this.yfields.length; i++) {
-                yfield = this.yfields[i];
-                keys.push(yfield.key || yfield.name);
-            }
             var colors = Sao.common.generateColorscheme(
                 color, keys, maxcolor / (keys.length || 1));
-            for (i = 0; i < this.yfields.length; i++) {
-                yfield = this.yfields[i];
+            for (let i = 0; i < this.yfields.length; i++) {
+                let yfield = this.yfields[i];
                 if (yfield.color) {
                     colors[yfield.key || yfield.name] = yfield.color;
                 }
@@ -22556,6 +22576,14 @@ function eval_pyson(value){
             };
             return c3_config;
         },
+        _data_keys: function(data) {
+            let keys = [];
+            for (let i = 0; i < this.yfields.length; i++) {
+                let yfield = this.yfields[i];
+                keys.push(yfield.key || yfield.name);
+            }
+            return keys;
+        },
         action: function(data, element) {
             var ids = this.ids[this._action_key(data)];
             var ctx = jQuery.extend({}, this.view.screen.group._context);
@@ -22654,8 +22682,16 @@ function eval_pyson(value){
 
             config.data.columns = pie_columns;
             config.data.names = pie_names;
+            config.data.order = null;
             return config;
         },
+        _data_keys: function(data) {
+            let keys = [];
+            for (let i = 0; i < data.columns[1].length - 1; i++) {
+                keys.push(i);
+            }
+            return keys;
+        },
         _add_id: function(key, id) {
             var type = this.xfield.type;
             if ((type == 'date') || (type == 'datetime')) {

package/dist/tryton-sao.min.css

@@ -9922,19 +9922,31 @@ img.icon {
   width: 4em;
   height: 4em;
 }
-.form .form-document object {
+.form .form-document object,
+.form .form-document img {
   object-fit: scale-down;
   object-position: center top;
+}
+.form .form-document iframe {
+  border: 0;
+}
+.form .form-document object,
+.form .form-document iframe,
+.form .form-document img {
   width: 100%;
   height: 75vh;
 }
 @media screen and (max-width: 991px) {
-  .form .form-document object {
+  .form .form-document object,
+  .form .form-document iframe,
+  .form .form-document img {
     height: 50vh;
   }
 }
 @media screen and (max-width: 767px) {
-  .form .form-document object {
+  .form .form-document object,
+  .form .form-document iframe,
+  .form .form-document img {
     height: 25vh;
   }
 }