tryton-sao 7.6.8 → 7.6.10

package/CHANGELOG

@@ -1,4 +1,14 @@
 
+Version 7.6.10 - 2025-11-02
+---------------------------
+* Bug fixes (see mercurial logs for details)
+
+
+Version 7.6.9 - 2025-10-20
+--------------------------
+* Bug fixes (see mercurial logs for details)
+* Use sandboxed iframe to display document (issue14290)
+
 Version 7.6.8 - 2025-10-02
 --------------------------
 * Bug fixes (see mercurial logs for details)

package/dist/tryton-sao.css

@@ -9395,12 +9395,16 @@ html[theme="default"] .carousel-caption h6 {
   flex: 1;
   width: 100%;
 }
+#tabcontent > .tab-pane {
+  width: 100%;
+}
 #tabcontent > .tab-pane > .panel {
   display: flex;
   flex-direction: column;
   flex: 1;
   margin-bottom: 5px;
   padding-bottom: 0;
+  width: 100%;
 }
 #tabcontent > .tab-pane > .panel > .panel-body {
   display: flex;
@@ -9408,9 +9412,11 @@ html[theme="default"] .carousel-caption h6 {
   flex-direction: row;
   padding: 5px 0;
   min-height: 0;
+  width: 100%;
 }
 #tabcontent > .tab-pane > .panel > .panel-body > div {
   display: inline-flex;
+  width: 100%;
 }
 #tabcontent > .tab-pane > .panel > .panel-body > div:first-child {
   flex: 2;
@@ -9835,6 +9841,7 @@ img.icon {
   display: flex;
   flex-direction: column;
   flex: 1;
+  width: 100%;
 }
 .filter-box {
   margin: 5px 0;
@@ -10469,9 +10476,22 @@ img.icon {
   min-width: 120px;
 }
 .form .form-document object,
-.board .form-document object {
+.board .form-document object,
+.form .form-document img,
+.board .form-document img {
   object-fit: scale-down;
   object-position: center top;
+}
+.form .form-document iframe,
+.board .form-document iframe {
+  border: 0;
+}
+.form .form-document object,
+.board .form-document object,
+.form .form-document iframe,
+.board .form-document iframe,
+.form .form-document img,
+.board .form-document img {
   max-width: 100%;
   min-height: 50vh;
   height: 100%;
@@ -10479,8 +10499,12 @@ img.icon {
 }
 @media screen and (max-width: 767px) {
   .form .form-document object,
-  .board .form-document object {
-    min-height: 25vh;
+  .board .form-document object,
+  .form .form-document iframe,
+  .board .form-document iframe,
+  .form .form-document img,
+  .board .form-document img {
+    min-height: 50vh;
   }
 }
 .form label,

package/dist/tryton-sao.js

@@ -3,7 +3,7 @@
 
 /* eslint-disable no-redeclare */
 var Sao = {
-    __version__: '7.6.8',
+    __version__: '7.6.10',
 };
 /* eslint-enable no-redeclare */
 
@@ -149,6 +149,16 @@ var Sao = {
         }
     }
 
+    if (!Array.prototype.toReversed) {
+        Object.defineProperty(Array.prototype, 'toReversed', {
+            value: function toReversed() {
+                return this.slice().reverse();
+            },
+            writable: true,
+            configurable: true,
+        });
+    }
+
     Sao.setdefault = function(object, key, value) {
         if (!Object.prototype.hasOwnProperty.call(object, key)) {
             object[key] = value;
@@ -9107,7 +9117,7 @@ var Sao = {
                 if (field.description.readonly) {
                     continue;
                 }
-                if (fname == this.group.exclude_field) {
+                if ([this.group.exclude_field, this.group.parent_name].includes(fname)) {
                     continue;
                 }
                 if (!field.validate(this, softvalidation, pre_validate)) {
@@ -19931,15 +19941,42 @@ function eval_pyson(value){
                 'class': this.class_,
             });
 
-            this.object = jQuery('<object/>', {
+            this.content = this._create_content().appendTo(this.el);
+        },
+        _create_content: function(mimetype, url) {
+            let tag_name = 'iframe';
+            if (mimetype) {
+                if (mimetype.startsWith('image/')) {
+                    tag_name = 'img';
+                } else if (mimetype == 'application/pdf') {
+                    tag_name = 'object';
+                }
+            }
+            let content = jQuery(`<${tag_name}/>`, {
                 'class': 'center-block',
-            }).appendTo(this.el);
-            if (attributes.height) {
-                this.object.css('height', parseInt(attributes.height, 10));
+            });
+            if (tag_name == 'iframe') {
+                content.attr('sandbox', '');
+            }
+            if (this.attributes.height) {
+                content.css('height', parseInt(this.attributes.height, 10));
             }
-            if (attributes.width) {
-                this.object.css('width', parseInt(attributes.width, 10));
+            if (this.attributes.width) {
+                content.css('width', parseInt(this.attributes.width, 10));
             }
+            if (url) {
+                // set onload before data/src to be always called
+                content.get().onload = function() {
+                    this.onload = null;
+                    window.URL.revokeObjectURL(url);
+                };
+                if (tag_name== 'object') {
+                    content.attr('data', url);
+                } else {
+                    content.attr('src', url);
+                }
+            }
+            return content;
         },
         display: function() {
             Sao.View.Form.Document._super.display.call(this);
@@ -19955,34 +19992,30 @@ function eval_pyson(value){
                 filename = filename_field.get_client(record);
             }
             data.done(data => {
-                var url, blob;
                 if (record !== this.record) {
                     return;
                 }
                 // in case onload was not yet triggered
-                window.URL.revokeObjectURL(this.object.attr('data'));
+                let url = this.content.attr('data') ||
+                    this.content.attr('src');
+                window.URL.revokeObjectURL(url);
+                let mimetype;
                 if (!data) {
                     url = null;
                 } else {
-                    var mimetype = Sao.common.guess_mimetype(filename);
+                    mimetype = Sao.common.guess_mimetype(filename);
                     if (mimetype == 'application/octet-binary') {
                         mimetype = null;
                     }
-                    blob = new Blob([data], {
+                    let blob = new Blob([data], {
                         'type': mimetype,
                     });
                     url = window.URL.createObjectURL(blob);
                 }
                 // duplicate object to force refresh on buggy browsers
-                const object = this.object.clone();
-                // set onload before data to be always called
-                object.get(0).onload = function() {
-                    this.onload = null;
-                    window.URL.revokeObjectURL(url);
-                };
-                object.attr('data', url);
-                this.object.replaceWith(object);
-                this.object = object;
+                let content = this._create_content(mimetype, url);
+                this.content.replaceWith(content);
+                this.content = content;
             });
         },
     });
@@ -20407,7 +20440,7 @@ function eval_pyson(value){
 
             var value = field.get_client(record);
             var new_key_names = Object.keys(value).filter(
-                e => !this.fields[e]);
+                e => !this.field.keys[e]);
 
             var prm;
             if (!jQuery.isEmptyObject(new_key_names)) {
@@ -21881,7 +21914,7 @@ function eval_pyson(value){
                     this.display_size = Sao.config.display_size;
                 }
             }
-            if (!this.display_size &
+            if (!this.display_size &&
                 (!jQuery.isEmptyObject(selected) ||
                     !jQuery.isEmptyObject(expanded))) {
                 this.display_size = Sao.config.display_size;

package/package.json

@@ -2,7 +2,7 @@
   "name": "tryton-sao",
   "title": "sao",
   "description": "Tryton webclient",
-  "version": "7.6.8",
+  "version": "7.6.10",
   "homepage": "https://www.tryton.org/",
   "author": {
     "name": "Tryton"

package/src/model.js

@@ -1334,7 +1334,7 @@
                 if (field.description.readonly) {
                     continue;
                 }
-                if (fname == this.group.exclude_field) {
+                if ([this.group.exclude_field, this.group.parent_name].includes(fname)) {
                     continue;
                 }
                 if (!field.validate(this, softvalidation, pre_validate)) {

package/src/sao.js

@@ -3,7 +3,7 @@
 
 /* eslint-disable no-redeclare */
 var Sao = {
-    __version__: '7.6.8',
+    __version__: '7.6.10',
 };
 /* eslint-enable no-redeclare */
 
@@ -149,6 +149,16 @@ var Sao = {
         }
     }
 
+    if (!Array.prototype.toReversed) {
+        Object.defineProperty(Array.prototype, 'toReversed', {
+            value: function toReversed() {
+                return this.slice().reverse();
+            },
+            writable: true,
+            configurable: true,
+        });
+    }
+
     Sao.setdefault = function(object, key, value) {
         if (!Object.prototype.hasOwnProperty.call(object, key)) {
             object[key] = value;

package/src/sao.less

@@ -289,25 +289,32 @@ html[theme="default"] {
     flex: 1;
     width: 100%;
 
-    > .tab-pane > .panel {
-        display: flex;
-        flex-direction: column;
-        flex: 1;
-        margin-bottom: 5px;
-        padding-bottom: 0;
+    > .tab-pane {
+        width: 100%;
 
-        > .panel-body {
+        > .panel {
             display: flex;
+            flex-direction: column;
             flex: 1;
-            flex-direction: row;
-            padding: 5px 0;
-            min-height: 0;
+            margin-bottom: 5px;
+            padding-bottom: 0;
+            width: 100%;
+
+            > .panel-body {
+                display: flex;
+                flex: 1;
+                flex-direction: row;
+                padding: 5px 0;
+                min-height: 0;
+                width: 100%;
 
-            > div {
-                display: inline-flex;
+                > div {
+                    display: inline-flex;
+                    width: 100%;
 
-                &:first-child {
-                    flex: 2;
+                    &:first-child {
+                        flex: 2;
+                    }
                 }
             }
         }
@@ -691,6 +698,7 @@ img.icon {
     display: flex;
     flex-direction: column;
     flex: 1;
+    width: 100%;
 }
 
 .filter-box {
@@ -1177,15 +1185,20 @@ img.icon {
         }
     }
     .form-document {
-        object {
+        object, img {
             object-fit: scale-down;
             object-position: center top;
+        }
+        iframe {
+            border: 0;
+        }
+        object, iframe, img {
             max-width: 100%;
             min-height: 50vh;
             height: 100%;
             width: 100%;
             @media screen and (max-width: @screen-xs-max) {
-                min-height: 25vh;
+                min-height: 50vh;
             }
         }
     }

package/src/view/form.js

@@ -4833,15 +4833,42 @@ function eval_pyson(value){
                 'class': this.class_,
             });
 
-            this.object = jQuery('<object/>', {
+            this.content = this._create_content().appendTo(this.el);
+        },
+        _create_content: function(mimetype, url) {
+            let tag_name = 'iframe';
+            if (mimetype) {
+                if (mimetype.startsWith('image/')) {
+                    tag_name = 'img';
+                } else if (mimetype == 'application/pdf') {
+                    tag_name = 'object';
+                }
+            }
+            let content = jQuery(`<${tag_name}/>`, {
                 'class': 'center-block',
-            }).appendTo(this.el);
-            if (attributes.height) {
-                this.object.css('height', parseInt(attributes.height, 10));
+            });
+            if (tag_name == 'iframe') {
+                content.attr('sandbox', '');
+            }
+            if (this.attributes.height) {
+                content.css('height', parseInt(this.attributes.height, 10));
             }
-            if (attributes.width) {
-                this.object.css('width', parseInt(attributes.width, 10));
+            if (this.attributes.width) {
+                content.css('width', parseInt(this.attributes.width, 10));
             }
+            if (url) {
+                // set onload before data/src to be always called
+                content.get().onload = function() {
+                    this.onload = null;
+                    window.URL.revokeObjectURL(url);
+                };
+                if (tag_name== 'object') {
+                    content.attr('data', url);
+                } else {
+                    content.attr('src', url);
+                }
+            }
+            return content;
         },
         display: function() {
             Sao.View.Form.Document._super.display.call(this);
@@ -4857,34 +4884,30 @@ function eval_pyson(value){
                 filename = filename_field.get_client(record);
             }
             data.done(data => {
-                var url, blob;
                 if (record !== this.record) {
                     return;
                 }
                 // in case onload was not yet triggered
-                window.URL.revokeObjectURL(this.object.attr('data'));
+                let url = this.content.attr('data') ||
+                    this.content.attr('src');
+                window.URL.revokeObjectURL(url);
+                let mimetype;
                 if (!data) {
                     url = null;
                 } else {
-                    var mimetype = Sao.common.guess_mimetype(filename);
+                    mimetype = Sao.common.guess_mimetype(filename);
                     if (mimetype == 'application/octet-binary') {
                         mimetype = null;
                     }
-                    blob = new Blob([data], {
+                    let blob = new Blob([data], {
                         'type': mimetype,
                     });
                     url = window.URL.createObjectURL(blob);
                 }
                 // duplicate object to force refresh on buggy browsers
-                const object = this.object.clone();
-                // set onload before data to be always called
-                object.get(0).onload = function() {
-                    this.onload = null;
-                    window.URL.revokeObjectURL(url);
-                };
-                object.attr('data', url);
-                this.object.replaceWith(object);
-                this.object = object;
+                let content = this._create_content(mimetype, url);
+                this.content.replaceWith(content);
+                this.content = content;
             });
         },
     });
@@ -5309,7 +5332,7 @@ function eval_pyson(value){
 
             var value = field.get_client(record);
             var new_key_names = Object.keys(value).filter(
-                e => !this.fields[e]);
+                e => !this.field.keys[e]);
 
             var prm;
             if (!jQuery.isEmptyObject(new_key_names)) {

package/src/view/tree.js

@@ -889,7 +889,7 @@
                     this.display_size = Sao.config.display_size;
                 }
             }
-            if (!this.display_size &
+            if (!this.display_size &&
                 (!jQuery.isEmptyObject(selected) ||
                     !jQuery.isEmptyObject(expanded))) {
                 this.display_size = Sao.config.display_size;