odoo/odoo#70004

Created by Framework (ORM), Xavier Morel (xmo)

label

odoo-dev:master-markupsafe-js-xmo

head

11da0fd967676141adaf653d2c64783316f69b1c

merged

4 years ago by Framework (ORM), Xavier Morel (xmo)

	odoo/odoo	odoo/enterprise
master	#70004	#18005

[MERGE] *: deprecate and replace non-owl t-raw

non-owl JS-side of #68072:

• deprecates t-raw
• adds a t-out which t-esc aliases and which "does the right thing"
• introduces a Markup function / object which is considered markup-safe by t-out (thus left unescaped)
• unlike the python version, most of the override hooks (e.g. concatenation, formatting, ...) are not available in JS, we might eventually want to override some of the action methods (e.g. replace) but so far the needs seemed pretty limited
• and javascript pretty strongly differentiates between a string (primitive) and a String (object), the latter being what Markup gets
• so various constructs which can return a Markup in Python can't really afford to in JS: I tried with QWeb and e.g. jquery really does not deal well with non-primitive strings, as a result _.escape is shimmed to understand Markup objects but will not return markup objects when escaping strings
• sprintf (the one from web.utils) was updated for Markup-awareness for convenience though
• and Markup can be used as a template tag, in which case it will automatically escape the substitutions
• removed messageIsHtml from the non-owl notifications, replaced by the message being a markup object
• updated Dialog to work the same way (it did not even have a flag), removed explicit escaping from most of the callsites (only found one where we actually leveraged dialog titles being markup)
• modified the kanban view so HTML non-raw values automatically get wrapped in Markup

Also moved some formatting from the server to the client, either removing the need to inject markup entirely or making the use of Markup much cleaner than just "mark whatever the server returned as safe".

There are a few things I'm not entirely sure about e.g. whether even using markup is necessary for formatMonetary, doesn't the "unicode" NBSP work fine in HTML? Though we may need to keep forceString to ensure something like ascii-compatibility.