npm - tryton-sao - Versions diffs - 7.4.18 → 7.4.19 - Mend

tryton-sao 7.4.18 → 7.4.19

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (7) hide show

package/CHANGELOG CHANGED Viewed

@@ -1,4 +1,9 @@
+Version 7.4.19 - 2025-10-20
+---------------------------
+* Bug fixes (see mercurial logs for details)
+* Use sandboxed iframe to display document (issue14290)
 Version 7.4.18 - 2025-10-02
 ---------------------------
 * Bug fixes (see mercurial logs for details)

package/dist/tryton-sao.css CHANGED Viewed

@@ -10271,17 +10271,34 @@ img.icon {
   min-width: 120px;
 }
 .form .form-document object,
-.board .form-document object {
+.board .form-document object,
+.form .form-document img,
+.board .form-document img {
   object-fit: scale-down;
   object-position: center top;
+}
+.form .form-document iframe,
+.board .form-document iframe {
+  border: 0;
+}
+.form .form-document object,
+.board .form-document object,
+.form .form-document iframe,
+.board .form-document iframe,
+.form .form-document img,
+.board .form-document img {
   width: 100%;
   min-height: 50vh;
   height: 100%;
 }
 @media screen and (max-width: 767px) {
   .form .form-document object,
-  .board .form-document object {
-    min-height: 25vh;
+  .board .form-document object,
+  .form .form-document iframe,
+  .board .form-document iframe,
+  .form .form-document img,
+  .board .form-document img {
+    min-height: 50vh;
   }
 }
 .form label,

package/dist/tryton-sao.js CHANGED Viewed

@@ -3,7 +3,7 @@
 /* eslint-disable no-redeclare */
 var Sao = {
-    __version__: '7.4.18',
+    __version__: '7.4.19',
 };
 /* eslint-enable no-redeclare */
@@ -149,6 +149,16 @@ var Sao = {
         }
     }
+    if (!Array.prototype.toReversed) {
+        Object.defineProperty(Array.prototype, 'toReversed', {
+            value: function toReversed() {
+                return this.slice().reverse();
+            },
+            writable: true,
+            configurable: true,
+        });
+    }
     Sao.setdefault = function(object, key, value) {
         if (!Object.prototype.hasOwnProperty.call(object, key)) {
             object[key] = value;
@@ -19731,15 +19741,42 @@ function eval_pyson(value){
                 'class': this.class_,
             });
-            this.object = jQuery('<object/>', {
+            this.content = this._create_content().appendTo(this.el);
+        },
+        _create_content: function(mimetype, url) {
+            let tag_name = 'iframe';
+            if (mimetype) {
+                if (mimetype.startsWith('image/')) {
+                    tag_name = 'img';
+                } else if (mimetype == 'application/pdf') {
+                    tag_name = 'object';
+                }
+            }
+            let content = jQuery(`<${tag_name}/>`, {
                 'class': 'center-block',
-            }).appendTo(this.el);
-            if (attributes.height) {
-                this.object.css('height', parseInt(attributes.height, 10));
+            });
+            if (tag_name == 'iframe') {
+                content.attr('sandbox', '');
             }
-            if (attributes.width) {
-                this.object.css('width', parseInt(attributes.width, 10));
+            if (this.attributes.height) {
+                content.css('height', parseInt(this.attributes.height, 10));
             }
+            if (this.attributes.width) {
+                content.css('width', parseInt(this.attributes.width, 10));
+            }
+            if (url) {
+                // set onload before data/src to be always called
+                content.get().onload = function() {
+                    this.onload = null;
+                    window.URL.revokeObjectURL(url);
+                };
+                if (tag_name== 'object') {
+                    content.attr('data', url);
+                } else {
+                    content.attr('src', url);
+                }
+            }
+            return content;
         },
         display: function() {
             Sao.View.Form.Document._super.display.call(this);
@@ -19755,34 +19792,30 @@ function eval_pyson(value){
                 filename = filename_field.get_client(record);
             }
             data.done(data => {
-                var url, blob;
                 if (record !== this.record) {
                     return;
                 }
                 // in case onload was not yet triggered
-                window.URL.revokeObjectURL(this.object.attr('data'));
+                let url = this.content.attr('data') ||
+                    this.content.attr('src');
+                window.URL.revokeObjectURL(url);
+                let mimetype;
                 if (!data) {
                     url = null;
                 } else {
-                    var mimetype = Sao.common.guess_mimetype(filename);
+                    mimetype = Sao.common.guess_mimetype(filename);
                     if (mimetype == 'application/octet-binary') {
                         mimetype = null;
                     }
-                    blob = new Blob([data], {
+                    let blob = new Blob([data], {
                         'type': mimetype,
                     });
                     url = window.URL.createObjectURL(blob);
                 }
                 // duplicate object to force refresh on buggy browsers
-                const object = this.object.clone();
-                // set onload before data to be always called
-                object.get(0).onload = function() {
-                    this.onload = null;
-                    window.URL.revokeObjectURL(url);
-                };
-                object.attr('data', url);
-                this.object.replaceWith(object);
-                this.object = object;
+                let content = this._create_content(mimetype, url);
+                this.content.replaceWith(content);
+                this.content = content;
             });
         },
     });

package/package.json CHANGED Viewed

@@ -2,7 +2,7 @@
   "name": "tryton-sao",
   "title": "sao",
   "description": "Tryton webclient",
-  "version": "7.4.18",
+  "version": "7.4.19",
   "homepage": "https://www.tryton.org/",
   "author": {
     "name": "Tryton"

package/src/sao.js CHANGED Viewed

@@ -3,7 +3,7 @@
 /* eslint-disable no-redeclare */
 var Sao = {
-    __version__: '7.4.18',
+    __version__: '7.4.19',
 };
 /* eslint-enable no-redeclare */
@@ -149,6 +149,16 @@ var Sao = {
         }
     }
+    if (!Array.prototype.toReversed) {
+        Object.defineProperty(Array.prototype, 'toReversed', {
+            value: function toReversed() {
+                return this.slice().reverse();
+            },
+            writable: true,
+            configurable: true,
+        });
+    }
     Sao.setdefault = function(object, key, value) {
         if (!Object.prototype.hasOwnProperty.call(object, key)) {
             object[key] = value;

package/src/sao.less CHANGED Viewed

@@ -980,14 +980,19 @@ img.icon {
         }
     }
     .form-document {
-        object {
+        object, img {
             object-fit: scale-down;
             object-position: center top;
+        }
+        iframe {
+            border: 0;
+        }
+        object, iframe, img {
             width: 100%;
             min-height: 50vh;
             height: 100%;
             @media screen and (max-width: @screen-xs-max) {
-                min-height: 25vh;
+                min-height: 50vh;
             }
         }
     }

package/src/view/form.js CHANGED Viewed

@@ -4783,15 +4783,42 @@ function eval_pyson(value){
                 'class': this.class_,
             });
-            this.object = jQuery('<object/>', {
+            this.content = this._create_content().appendTo(this.el);
+        },
+        _create_content: function(mimetype, url) {
+            let tag_name = 'iframe';
+            if (mimetype) {
+                if (mimetype.startsWith('image/')) {
+                    tag_name = 'img';
+                } else if (mimetype == 'application/pdf') {
+                    tag_name = 'object';
+                }
+            }
+            let content = jQuery(`<${tag_name}/>`, {
                 'class': 'center-block',
-            }).appendTo(this.el);
-            if (attributes.height) {
-                this.object.css('height', parseInt(attributes.height, 10));
+            });
+            if (tag_name == 'iframe') {
+                content.attr('sandbox', '');
+            }
+            if (this.attributes.height) {
+                content.css('height', parseInt(this.attributes.height, 10));
             }
-            if (attributes.width) {
-                this.object.css('width', parseInt(attributes.width, 10));
+            if (this.attributes.width) {
+                content.css('width', parseInt(this.attributes.width, 10));
             }
+            if (url) {
+                // set onload before data/src to be always called
+                content.get().onload = function() {
+                    this.onload = null;
+                    window.URL.revokeObjectURL(url);
+                };
+                if (tag_name== 'object') {
+                    content.attr('data', url);
+                } else {
+                    content.attr('src', url);
+                }
+            }
+            return content;
         },
         display: function() {
             Sao.View.Form.Document._super.display.call(this);
@@ -4807,34 +4834,30 @@ function eval_pyson(value){
                 filename = filename_field.get_client(record);
             }
             data.done(data => {
-                var url, blob;
                 if (record !== this.record) {
                     return;
                 }
                 // in case onload was not yet triggered
-                window.URL.revokeObjectURL(this.object.attr('data'));
+                let url = this.content.attr('data') ||
+                    this.content.attr('src');
+                window.URL.revokeObjectURL(url);
+                let mimetype;
                 if (!data) {
                     url = null;
                 } else {
-                    var mimetype = Sao.common.guess_mimetype(filename);
+                    mimetype = Sao.common.guess_mimetype(filename);
                     if (mimetype == 'application/octet-binary') {
                         mimetype = null;
                     }
-                    blob = new Blob([data], {
+                    let blob = new Blob([data], {
                         'type': mimetype,
                     });
                     url = window.URL.createObjectURL(blob);
                 }
                 // duplicate object to force refresh on buggy browsers
-                const object = this.object.clone();
-                // set onload before data to be always called
-                object.get(0).onload = function() {
-                    this.onload = null;
-                    window.URL.revokeObjectURL(url);
-                };
-                object.attr('data', url);
-                this.object.replaceWith(object);
-                this.object = object;
+                let content = this._create_content(mimetype, url);
+                this.content.replaceWith(content);
+                this.content = content;
             });
         },
     });