tryton-sao 7.0.37 → 7.0.38

package/CHANGELOG

@@ -1,4 +1,9 @@
 
+Version 7.0.38 - 2025-10-20
+---------------------------
+* Bug fixes (see mercurial logs for details)
+* Use sandboxed iframe to display document (issue14290)
+
 Version 7.0.37 - 2025-10-02
 ---------------------------
 * Bug fixes (see mercurial logs for details)

package/dist/tryton-sao.css

@@ -10085,21 +10085,42 @@ img.icon {
   min-width: 120px;
 }
 .form .form-document object,
-.board .form-document object {
+.board .form-document object,
+.form .form-document img,
+.board .form-document img {
   object-fit: scale-down;
   object-position: center top;
+}
+.form .form-document iframe,
+.board .form-document iframe {
+  border: 0;
+}
+.form .form-document object,
+.board .form-document object,
+.form .form-document iframe,
+.board .form-document iframe,
+.form .form-document img,
+.board .form-document img {
   width: 100%;
   height: 75vh;
 }
 @media screen and (max-width: 991px) {
   .form .form-document object,
-  .board .form-document object {
+  .board .form-document object,
+  .form .form-document iframe,
+  .board .form-document iframe,
+  .form .form-document img,
+  .board .form-document img {
     height: 50vh;
   }
 }
 @media screen and (max-width: 767px) {
   .form .form-document object,
-  .board .form-document object {
+  .board .form-document object,
+  .form .form-document iframe,
+  .board .form-document iframe,
+  .form .form-document img,
+  .board .form-document img {
     height: 25vh;
   }
 }

package/dist/tryton-sao.js

@@ -3,7 +3,7 @@
 
 /* eslint-disable no-redeclare */
 var Sao = {
-    __version__: '7.0.37',
+    __version__: '7.0.38',
 };
 /* eslint-enable no-redeclare */
 
@@ -19259,15 +19259,42 @@ function eval_pyson(value){
                 'class': this.class_,
             });
 
-            this.object = jQuery('<object/>', {
+            this.content = this._create_content().appendTo(this.el);
+        },
+        _create_content: function(mimetype, url) {
+            let tag_name = 'iframe';
+            if (mimetype) {
+                if (mimetype.startsWith('image/')) {
+                    tag_name = 'img';
+                } else if (mimetype == 'application/pdf') {
+                    tag_name = 'object';
+                }
+            }
+            let content = jQuery(`<${tag_name}/>`, {
                 'class': 'center-block',
-            }).appendTo(this.el);
-            if (attributes.height) {
-                this.object.css('height', parseInt(attributes.height, 10));
+            });
+            if (tag_name == 'iframe') {
+                content.attr('sandbox', '');
             }
-            if (attributes.width) {
-                this.object.css('width', parseInt(attributes.width, 10));
+            if (this.attributes.height) {
+                content.css('height', parseInt(this.attributes.height, 10));
             }
+            if (this.attributes.width) {
+                content.css('width', parseInt(this.attributes.width, 10));
+            }
+            if (url) {
+                // set onload before data/src to be always called
+                content.get().onload = function() {
+                    this.onload = null;
+                    window.URL.revokeObjectURL(url);
+                };
+                if (tag_name== 'object') {
+                    content.attr('data', url);
+                } else {
+                    content.attr('src', url);
+                }
+            }
+            return content;
         },
         display: function() {
             Sao.View.Form.Document._super.display.call(this);
@@ -19283,34 +19310,30 @@ function eval_pyson(value){
                 filename = filename_field.get_client(record);
             }
             data.done(data => {
-                var url, blob;
                 if (record !== this.record) {
                     return;
                 }
                 // in case onload was not yet triggered
-                window.URL.revokeObjectURL(this.object.attr('data'));
+                let url = this.content.attr('data') ||
+                    this.content.attr('src');
+                window.URL.revokeObjectURL(url);
+                let mimetype;
                 if (!data) {
                     url = null;
                 } else {
-                    var mimetype = Sao.common.guess_mimetype(filename);
+                    mimetype = Sao.common.guess_mimetype(filename);
                     if (mimetype == 'application/octet-binary') {
                         mimetype = null;
                     }
-                    blob = new Blob([data], {
+                    let blob = new Blob([data], {
                         'type': mimetype,
                     });
                     url = window.URL.createObjectURL(blob);
                 }
                 // duplicate object to force refresh on buggy browsers
-                const object = this.object.clone();
-                // set onload before data to be always called
-                object.get(0).onload = function() {
-                    this.onload = null;
-                    window.URL.revokeObjectURL(url);
-                };
-                object.attr('data', url);
-                this.object.replaceWith(object);
-                this.object = object;
+                let content = this._create_content(mimetype, url);
+                this.content.replaceWith(content);
+                this.content = content;
             });
         },
     });

package/dist/tryton-sao.min.css

@@ -10085,21 +10085,42 @@ img.icon {
   min-width: 120px;
 }
 .form .form-document object,
-.board .form-document object {
+.board .form-document object,
+.form .form-document img,
+.board .form-document img {
   object-fit: scale-down;
   object-position: center top;
+}
+.form .form-document iframe,
+.board .form-document iframe {
+  border: 0;
+}
+.form .form-document object,
+.board .form-document object,
+.form .form-document iframe,
+.board .form-document iframe,
+.form .form-document img,
+.board .form-document img {
   width: 100%;
   height: 75vh;
 }
 @media screen and (max-width: 991px) {
   .form .form-document object,
-  .board .form-document object {
+  .board .form-document object,
+  .form .form-document iframe,
+  .board .form-document iframe,
+  .form .form-document img,
+  .board .form-document img {
     height: 50vh;
   }
 }
 @media screen and (max-width: 767px) {
   .form .form-document object,
-  .board .form-document object {
+  .board .form-document object,
+  .form .form-document iframe,
+  .board .form-document iframe,
+  .form .form-document img,
+  .board .form-document img {
     height: 25vh;
   }
 }