tryton-sao 7.4.17 → 7.4.19

package/CHANGELOG

@@ -1,4 +1,14 @@
 
+Version 7.4.19 - 2025-10-20
+---------------------------
+* Bug fixes (see mercurial logs for details)
+* Use sandboxed iframe to display document (issue14290)
+
+Version 7.4.18 - 2025-10-02
+---------------------------
+* Bug fixes (see mercurial logs for details)
+
+
 Version 7.4.17 - 2025-09-15
 ---------------------------
 * Bug fixes (see mercurial logs for details)

package/dist/tryton-sao.css

@@ -10271,17 +10271,34 @@ img.icon {
   min-width: 120px;
 }
 .form .form-document object,
-.board .form-document object {
+.board .form-document object,
+.form .form-document img,
+.board .form-document img {
   object-fit: scale-down;
   object-position: center top;
+}
+.form .form-document iframe,
+.board .form-document iframe {
+  border: 0;
+}
+.form .form-document object,
+.board .form-document object,
+.form .form-document iframe,
+.board .form-document iframe,
+.form .form-document img,
+.board .form-document img {
   width: 100%;
   min-height: 50vh;
   height: 100%;
 }
 @media screen and (max-width: 767px) {
   .form .form-document object,
-  .board .form-document object {
-    min-height: 25vh;
+  .board .form-document object,
+  .form .form-document iframe,
+  .board .form-document iframe,
+  .form .form-document img,
+  .board .form-document img {
+    min-height: 50vh;
   }
 }
 .form label,

package/dist/tryton-sao.js

@@ -3,7 +3,7 @@
 
 /* eslint-disable no-redeclare */
 var Sao = {
-    __version__: '7.4.17',
+    __version__: '7.4.19',
 };
 /* eslint-enable no-redeclare */
 
@@ -149,6 +149,16 @@ var Sao = {
         }
     }
 
+    if (!Array.prototype.toReversed) {
+        Object.defineProperty(Array.prototype, 'toReversed', {
+            value: function toReversed() {
+                return this.slice().reverse();
+            },
+            writable: true,
+            configurable: true,
+        });
+    }
+
     Sao.setdefault = function(object, key, value) {
         if (!Object.prototype.hasOwnProperty.call(object, key)) {
             object[key] = value;
@@ -19731,15 +19741,42 @@ function eval_pyson(value){
                 'class': this.class_,
             });
 
-            this.object = jQuery('<object/>', {
+            this.content = this._create_content().appendTo(this.el);
+        },
+        _create_content: function(mimetype, url) {
+            let tag_name = 'iframe';
+            if (mimetype) {
+                if (mimetype.startsWith('image/')) {
+                    tag_name = 'img';
+                } else if (mimetype == 'application/pdf') {
+                    tag_name = 'object';
+                }
+            }
+            let content = jQuery(`<${tag_name}/>`, {
                 'class': 'center-block',
-            }).appendTo(this.el);
-            if (attributes.height) {
-                this.object.css('height', parseInt(attributes.height, 10));
+            });
+            if (tag_name == 'iframe') {
+                content.attr('sandbox', '');
+            }
+            if (this.attributes.height) {
+                content.css('height', parseInt(this.attributes.height, 10));
             }
-            if (attributes.width) {
-                this.object.css('width', parseInt(attributes.width, 10));
+            if (this.attributes.width) {
+                content.css('width', parseInt(this.attributes.width, 10));
+            }
+            if (url) {
+                // set onload before data/src to be always called
+                content.get().onload = function() {
+                    this.onload = null;
+                    window.URL.revokeObjectURL(url);
+                };
+                if (tag_name== 'object') {
+                    content.attr('data', url);
+                } else {
+                    content.attr('src', url);
+                }
             }
+            return content;
         },
         display: function() {
             Sao.View.Form.Document._super.display.call(this);
@@ -19755,34 +19792,30 @@ function eval_pyson(value){
                 filename = filename_field.get_client(record);
             }
             data.done(data => {
-                var url, blob;
                 if (record !== this.record) {
                     return;
                 }
                 // in case onload was not yet triggered
-                window.URL.revokeObjectURL(this.object.attr('data'));
+                let url = this.content.attr('data') ||
+                    this.content.attr('src');
+                window.URL.revokeObjectURL(url);
+                let mimetype;
                 if (!data) {
                     url = null;
                 } else {
-                    var mimetype = Sao.common.guess_mimetype(filename);
+                    mimetype = Sao.common.guess_mimetype(filename);
                     if (mimetype == 'application/octet-binary') {
                         mimetype = null;
                     }
-                    blob = new Blob([data], {
+                    let blob = new Blob([data], {
                         'type': mimetype,
                     });
                     url = window.URL.createObjectURL(blob);
                 }
                 // duplicate object to force refresh on buggy browsers
-                const object = this.object.clone();
-                // set onload before data to be always called
-                object.get(0).onload = function() {
-                    this.onload = null;
-                    window.URL.revokeObjectURL(url);
-                };
-                object.attr('data', url);
-                this.object.replaceWith(object);
-                this.object = object;
+                let content = this._create_content(mimetype, url);
+                this.content.replaceWith(content);
+                this.content = content;
             });
         },
     });
@@ -24220,20 +24253,15 @@ function eval_pyson(value){
                     }
                 };
             }
+            let keys = this._data_keys(data);
             var color = this.view.attributes.color || Sao.config.graph_color;
             var rgb = Sao.common.hex2rgb(
                 Sao.common.COLOR_SCHEMES[color] || color);
             var maxcolor = Math.max.apply(null, rgb);
-            var keys = [];
-            var i, yfield;
-            for (i = 0; i < this.yfields.length; i++) {
-                yfield = this.yfields[i];
-                keys.push(yfield.key || yfield.name);
-            }
             var colors = Sao.common.generateColorscheme(
                 color, keys, maxcolor / (keys.length || 1));
-            for (i = 0; i < this.yfields.length; i++) {
-                yfield = this.yfields[i];
+            for (let i = 0; i < this.yfields.length; i++) {
+                let yfield = this.yfields[i];
                 if (yfield.color) {
                     colors[yfield.key || yfield.name] = yfield.color;
                 }
@@ -24245,6 +24273,14 @@ function eval_pyson(value){
             };
             return c3_config;
         },
+        _data_keys: function(data) {
+            let keys = [];
+            for (let i = 0; i < this.yfields.length; i++) {
+                let yfield = this.yfields[i];
+                keys.push(yfield.key || yfield.name);
+            }
+            return keys;
+        },
         action: function(data, element) {
             var ids = this.ids[this._action_key(data)];
             var ctx = jQuery.extend({}, this.view.screen.group._context);
@@ -24343,8 +24379,16 @@ function eval_pyson(value){
 
             config.data.columns = pie_columns;
             config.data.names = pie_names;
+            config.data.order = null;
             return config;
         },
+        _data_keys: function(data) {
+            let keys = [];
+            for (let i = 0; i < data.columns[1].length - 1; i++) {
+                keys.push(i);
+            };
+            return keys;
+        },
         _add_id: function(key, id) {
             var type = this.xfield.type;
             if ((type == 'date') || (type == 'datetime')) {

package/package.json

@@ -2,7 +2,7 @@
   "name": "tryton-sao",
   "title": "sao",
   "description": "Tryton webclient",
-  "version": "7.4.17",
+  "version": "7.4.19",
   "homepage": "https://www.tryton.org/",
   "author": {
     "name": "Tryton"

package/src/sao.js

@@ -3,7 +3,7 @@
 
 /* eslint-disable no-redeclare */
 var Sao = {
-    __version__: '7.4.17',
+    __version__: '7.4.19',
 };
 /* eslint-enable no-redeclare */
 
@@ -149,6 +149,16 @@ var Sao = {
         }
     }
 
+    if (!Array.prototype.toReversed) {
+        Object.defineProperty(Array.prototype, 'toReversed', {
+            value: function toReversed() {
+                return this.slice().reverse();
+            },
+            writable: true,
+            configurable: true,
+        });
+    }
+
     Sao.setdefault = function(object, key, value) {
         if (!Object.prototype.hasOwnProperty.call(object, key)) {
             object[key] = value;

package/src/sao.less

@@ -980,14 +980,19 @@ img.icon {
         }
     }
     .form-document {
-        object {
+        object, img {
             object-fit: scale-down;
             object-position: center top;
+        }
+        iframe {
+            border: 0;
+        }
+        object, iframe, img {
             width: 100%;
             min-height: 50vh;
             height: 100%;
             @media screen and (max-width: @screen-xs-max) {
-                min-height: 25vh;
+                min-height: 50vh;
             }
         }
     }

package/src/view/form.js

@@ -4783,15 +4783,42 @@ function eval_pyson(value){
                 'class': this.class_,
             });
 
-            this.object = jQuery('<object/>', {
+            this.content = this._create_content().appendTo(this.el);
+        },
+        _create_content: function(mimetype, url) {
+            let tag_name = 'iframe';
+            if (mimetype) {
+                if (mimetype.startsWith('image/')) {
+                    tag_name = 'img';
+                } else if (mimetype == 'application/pdf') {
+                    tag_name = 'object';
+                }
+            }
+            let content = jQuery(`<${tag_name}/>`, {
                 'class': 'center-block',
-            }).appendTo(this.el);
-            if (attributes.height) {
-                this.object.css('height', parseInt(attributes.height, 10));
+            });
+            if (tag_name == 'iframe') {
+                content.attr('sandbox', '');
+            }
+            if (this.attributes.height) {
+                content.css('height', parseInt(this.attributes.height, 10));
             }
-            if (attributes.width) {
-                this.object.css('width', parseInt(attributes.width, 10));
+            if (this.attributes.width) {
+                content.css('width', parseInt(this.attributes.width, 10));
             }
+            if (url) {
+                // set onload before data/src to be always called
+                content.get().onload = function() {
+                    this.onload = null;
+                    window.URL.revokeObjectURL(url);
+                };
+                if (tag_name== 'object') {
+                    content.attr('data', url);
+                } else {
+                    content.attr('src', url);
+                }
+            }
+            return content;
         },
         display: function() {
             Sao.View.Form.Document._super.display.call(this);
@@ -4807,34 +4834,30 @@ function eval_pyson(value){
                 filename = filename_field.get_client(record);
             }
             data.done(data => {
-                var url, blob;
                 if (record !== this.record) {
                     return;
                 }
                 // in case onload was not yet triggered
-                window.URL.revokeObjectURL(this.object.attr('data'));
+                let url = this.content.attr('data') ||
+                    this.content.attr('src');
+                window.URL.revokeObjectURL(url);
+                let mimetype;
                 if (!data) {
                     url = null;
                 } else {
-                    var mimetype = Sao.common.guess_mimetype(filename);
+                    mimetype = Sao.common.guess_mimetype(filename);
                     if (mimetype == 'application/octet-binary') {
                         mimetype = null;
                     }
-                    blob = new Blob([data], {
+                    let blob = new Blob([data], {
                         'type': mimetype,
                     });
                     url = window.URL.createObjectURL(blob);
                 }
                 // duplicate object to force refresh on buggy browsers
-                const object = this.object.clone();
-                // set onload before data to be always called
-                object.get(0).onload = function() {
-                    this.onload = null;
-                    window.URL.revokeObjectURL(url);
-                };
-                object.attr('data', url);
-                this.object.replaceWith(object);
-                this.object = object;
+                let content = this._create_content(mimetype, url);
+                this.content.replaceWith(content);
+                this.content = content;
             });
         },
     });

package/src/view/graph.js

@@ -211,20 +211,15 @@
                     }
                 };
             }
+            let keys = this._data_keys(data);
             var color = this.view.attributes.color || Sao.config.graph_color;
             var rgb = Sao.common.hex2rgb(
                 Sao.common.COLOR_SCHEMES[color] || color);
             var maxcolor = Math.max.apply(null, rgb);
-            var keys = [];
-            var i, yfield;
-            for (i = 0; i < this.yfields.length; i++) {
-                yfield = this.yfields[i];
-                keys.push(yfield.key || yfield.name);
-            }
             var colors = Sao.common.generateColorscheme(
                 color, keys, maxcolor / (keys.length || 1));
-            for (i = 0; i < this.yfields.length; i++) {
-                yfield = this.yfields[i];
+            for (let i = 0; i < this.yfields.length; i++) {
+                let yfield = this.yfields[i];
                 if (yfield.color) {
                     colors[yfield.key || yfield.name] = yfield.color;
                 }
@@ -236,6 +231,14 @@
             };
             return c3_config;
         },
+        _data_keys: function(data) {
+            let keys = [];
+            for (let i = 0; i < this.yfields.length; i++) {
+                let yfield = this.yfields[i];
+                keys.push(yfield.key || yfield.name);
+            }
+            return keys;
+        },
         action: function(data, element) {
             var ids = this.ids[this._action_key(data)];
             var ctx = jQuery.extend({}, this.view.screen.group._context);
@@ -334,8 +337,16 @@
 
             config.data.columns = pie_columns;
             config.data.names = pie_names;
+            config.data.order = null;
             return config;
         },
+        _data_keys: function(data) {
+            let keys = [];
+            for (let i = 0; i < data.columns[1].length - 1; i++) {
+                keys.push(i);
+            };
+            return keys;
+        },
         _add_id: function(key, id) {
             var type = this.xfield.type;
             if ((type == 'date') || (type == 'datetime')) {