admin.suherdy/pos_lock_sent_product
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: sanitize POS order log messages using Markup to prevent XSS and clean up imports

Browse Source
This commit is contained in:
Suherdy Yacob 2026-06-15 23:37:22 +07:00
parent 70457207a8
commit 5c8edf2140
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
models/pos_order.py
View File

@ -1,5 +1,6 @@
import json import json
import logging import logging
from markupsafe import Markup
from odoo import api, fields, models from odoo import api, fields, models
_logger = logging.getLogger(__name__) _logger = logging.getLogger(__name__)
@ -46,7 +47,7 @@ class PosOrder(models.Model):
action_str = f"Reduced quantity by {cancel.get('cancelled_qty', 0)} (from {cancel.get('qty', 0)} to {float(cancel.get('qty', 0)) - float(cancel.get('cancelled_qty', 0))})" action_str = f"Reduced quantity by {cancel.get('cancelled_qty', 0)} (from {cancel.get('qty', 0)} to {float(cancel.get('qty', 0)) - float(cancel.get('cancelled_qty', 0))})"
body += f"<li><strong>{cancel.get('product_name')}</strong>: {action_str} by <strong>{cancel.get('employee_name', 'Unknown')}</strong></li>" body += f"<li><strong>{cancel.get('product_name')}</strong>: {action_str} by <strong>{cancel.get('employee_name', 'Unknown')}</strong></li>"
body += "</ul>" body += "</ul>"
self.message_post(body=body) self.message_post(body=Markup(body))
self.write({'x_logged_cancellations': json.dumps(logged_ids)}) self.write({'x_logged_cancellations': json.dumps(logged_ids)})
def action_pos_order_cancel(self): def action_pos_order_cancel(self):
@ -69,7 +70,7 @@ class PosOrder(models.Model):
res = super().action_pos_order_cancel() res = super().action_pos_order_cancel()
for order in self: for order in self:
order.message_post(body=f"<strong>Order Cancelled</strong> by <strong>{employee_name}</strong>") order.message_post(body=Markup("<strong>Order Cancelled</strong> by <strong>{}</strong>").format(employee_name))
# Log any frontend-tracked line deletions/reductions that happened # Log any frontend-tracked line deletions/reductions that happened
# before this cancellation. Use str(order.id) as the JS context key # before this cancellation. Use str(order.id) as the JS context key
@ -88,7 +89,6 @@ class PosOrder(models.Model):
if self.employee_id and hasattr(self.employee_id, 'pos_role') and self.employee_id.pos_role: if self.employee_id and hasattr(self.employee_id, 'pos_role') and self.employee_id.pos_role:
role_selection = dict(self.env['hr.employee']._fields['pos_role'].selection) role_selection = dict(self.env['hr.employee']._fields['pos_role'].selection)
role_name = role_selection.get(self.employee_id.pos_role, "Cashier") role_name = role_selection.get(self.employee_id.pos_role, "Cashier")
from markupsafe import Markup
return body + Markup("<br/>") + f"{role_name} {self.employee_id.name}" return body + Markup("<br/>") + f"{role_name} {self.employee_id.name}"
return super()._prepare_pos_log(body) return super()._prepare_pos_log(body)