From 79ce25d44a2d055a4f98c1b0cbf1d67140f0ba62 Mon Sep 17 00:00:00 2001 From: Pratik Vyas Date: Wed, 19 Nov 2014 15:29:28 +0530 Subject: [PATCH 1/7] Validate jinja2 syntax before saving print format --- frappe/core/doctype/print_format/print_format.py | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/frappe/core/doctype/print_format/print_format.py b/frappe/core/doctype/print_format/print_format.py index a770062147..4d414c50e5 100644 --- a/frappe/core/doctype/print_format/print_format.py +++ b/frappe/core/doctype/print_format/print_format.py @@ -4,6 +4,7 @@ from __future__ import unicode_literals import frappe import frappe.utils +from jinja2 import TemplateSyntaxError from frappe.model.document import Document @@ -16,6 +17,12 @@ class PrintFormat(Document): self.old_doc_type = frappe.db.get_value('Print Format', self.name, 'doc_type') + jenv = frappe.get_jenv() + try: + jenv.from_string(self.html) + except TemplateSyntaxError: + frappe.throw(frappe._("Syntax error in Jinja template")) + def on_update(self): if hasattr(self, 'old_doc_type') and self.old_doc_type: frappe.clear_cache(doctype=self.old_doc_type) From 3e07c1937e7eec8985d2f9feade7067f7e376cd3 Mon Sep 17 00:00:00 2001 From: Pratik Vyas Date: Wed, 19 Nov 2014 16:54:34 +0530 Subject: [PATCH 2/7] fix print format test case --- frappe/core/doctype/print_format/test_records.json | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/frappe/core/doctype/print_format/test_records.json b/frappe/core/doctype/print_format/test_records.json index aab3b96884..b0fac3c7ab 100644 --- a/frappe/core/doctype/print_format/test_records.json +++ b/frappe/core/doctype/print_format/test_records.json @@ -3,6 +3,7 @@ "doctype": "Print Format", "name": "_Test Print Format 1", "module": "core", - "doc_type": "User" + "doc_type": "User", + "html": "" } ] From cab28788a0304c6344e0f96873d705049bf538fa Mon Sep 17 00:00:00 2001 From: nikess Date: Sat, 22 Nov 2014 14:39:13 +0000 Subject: [PATCH 3/7] Fixed missing attribute closing inverted commas --- frappe/public/js/frappe/views/communication.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/frappe/public/js/frappe/views/communication.js b/frappe/public/js/frappe/views/communication.js index 79b0352b6e..97e0067a79 100644 --- a/frappe/public/js/frappe/views/communication.js +++ b/frappe/public/js/frappe/views/communication.js @@ -96,7 +96,7 @@ frappe.views.CommunicationList = Class.extend({ "SMS": "icon-mobile-phone", }[doc.communication_medium] || "icon-envelope"; doc.avatar = frappe.get_gravatar(doc._sender_id); - var comm = $(repl('
\
\ \
\ From 1f0690b05ddd8f9b639e3f2ad1fd01f81d48260f Mon Sep 17 00:00:00 2001 From: Rushabh Mehta Date: Mon, 24 Nov 2014 13:20:31 +0530 Subject: [PATCH 4/7] [security] [fix] stop client side queries in reportview.py --- frappe/model/db_query.py | 5 +++- frappe/public/js/frappe/views/listview.js | 28 ----------------------- frappe/widgets/reportview.py | 4 ++++ 3 files changed, 8 insertions(+), 29 deletions(-) diff --git a/frappe/model/db_query.py b/frappe/model/db_query.py index a5c2f7b723..79ef0e63d4 100644 --- a/frappe/model/db_query.py +++ b/frappe/model/db_query.py @@ -90,7 +90,10 @@ class DatabaseQuery(object): if isinstance(self.filters, basestring): self.filters = json.loads(self.filters) if isinstance(self.fields, basestring): - self.fields = json.loads(self.fields) + if self.fields == "*": + self.fields = ["*"] + else: + self.fields = json.loads(self.fields) if isinstance(self.filters, dict): fdict = self.filters self.filters = [] diff --git a/frappe/public/js/frappe/views/listview.js b/frappe/public/js/frappe/views/listview.js index e80ca5ab98..e9e958aa19 100644 --- a/frappe/public/js/frappe/views/listview.js +++ b/frappe/public/js/frappe/views/listview.js @@ -514,31 +514,3 @@ frappe.views.ListView = Class.extend({ $(parent).append(repl(icon_html, {icon_class: icon_class, label: __(label) || ''})); } }); - -// embeddable -frappe.provide('frappe.views.RecordListView'); -frappe.views.RecordListView = frappe.views.DocListView.extend({ - init: function(doctype, wrapper, ListView) { - this.doctype = doctype; - this.wrapper = wrapper; - this.listview = new ListView(this, doctype); - this.listview.parent = this; - this.setup(); - }, - - setup: function() { - var me = this; - me.page_length = 10; - $(me.wrapper).empty(); - me.init_list(); - }, - - get_args: function() { - var args = this._super(); - $.each((this.default_filters || []), function(i, f) { - args.filters.push(f); - }); - args.docstatus = args.docstatus.concat((this.default_docstatus || [])); - return args; - }, -}); diff --git a/frappe/widgets/reportview.py b/frappe/widgets/reportview.py index 304b874f21..7f339e03c7 100644 --- a/frappe/widgets/reportview.py +++ b/frappe/widgets/reportview.py @@ -20,6 +20,7 @@ def execute(doctype, query=None, filters=None, fields=None, or_filters=None, doc order_by, limit_start, limit_page_length, as_list, with_childnames, debug) def get_form_params(): + """Stringify GET request parameters.""" data = frappe._dict(frappe.local.form_dict) del data["cmd"] @@ -31,6 +32,9 @@ def get_form_params(): if isinstance(data.get("docstatus"), basestring): data["docstatus"] = json.loads(data["docstatus"]) + # queries must always be server side + data.query = None + return data def compress(data): From 5de44ed2b8ef19622b5fab14b3b598d9e9b76ba8 Mon Sep 17 00:00:00 2001 From: Nabin Hait Date: Mon, 24 Nov 2014 13:10:11 +0530 Subject: [PATCH 5/7] Validate naming series . missing --- frappe/model/naming.py | 2 ++ 1 file changed, 2 insertions(+) diff --git a/frappe/model/naming.py b/frappe/model/naming.py index 4f1f827758..804dcc368a 100644 --- a/frappe/model/naming.py +++ b/frappe/model/naming.py @@ -84,6 +84,8 @@ def make_autoname(key, doctype=''): if not "#" in key: key = key + ".#####" + elif not "." in key: + frappe.throw(_("Invalid naming series (. missing)") + (_(" for {0}").format(doctype) if doctype else "")) n = '' l = key.split('.') From 08efd4b412b46bf186d896bfefcd113585f75d1f Mon Sep 17 00:00:00 2001 From: Rushabh Mehta Date: Mon, 24 Nov 2014 16:28:25 +0530 Subject: [PATCH 6/7] [translations] updated via frappe.io/translator --- frappe/translate.py | 1 + frappe/translations/ar.csv | 6 +- frappe/translations/de.csv | 400 +++--- frappe/translations/el.csv | 18 +- frappe/translations/es.csv | 386 +++--- frappe/translations/fr.csv | 32 +- frappe/translations/hi.csv | 4 +- frappe/translations/hr.csv | 4 +- frappe/translations/id.csv | 24 +- frappe/translations/it.csv | 4 +- frappe/translations/ja.csv | 239 ++-- frappe/translations/kn.csv | 16 +- frappe/translations/ko.csv | 18 +- frappe/translations/nl.csv | 4 +- frappe/translations/pl.csv | 2336 ++++++++++++++++++------------------ frappe/translations/pt.csv | 48 +- frappe/translations/ro.csv | 24 +- frappe/translations/ru.csv | 16 +- frappe/translations/sr.csv | 4 +- frappe/translations/ta.csv | 4 +- frappe/translations/th.csv | 4 +- frappe/translations/tr.csv | 756 ++++++------ frappe/translations/vi.csv | 16 +- 23 files changed, 2182 insertions(+), 2182 deletions(-) diff --git a/frappe/translate.py b/frappe/translate.py index 1ac0a0ccb1..bfa34d92bd 100644 --- a/frappe/translate.py +++ b/frappe/translate.py @@ -298,6 +298,7 @@ def read_csv_file(path): from csv import reader with codecs.open(path, 'r', 'utf-8') as msgfile: data = msgfile.read() + data = data.replace(chr(28), "").replace(chr(29), "") data = reader([r.encode('utf-8') for r in data.splitlines()]) newdata = [[unicode(val, 'utf-8') for val in row] for row in data] return newdata diff --git a/frappe/translations/ar.csv b/frappe/translations/ar.csv index 87abadafa7..fbe83ea0b5 100644 --- a/frappe/translations/ar.csv +++ b/frappe/translations/ar.csv @@ -948,7 +948,7 @@ Select Type,حدد نوع Select User or DocType to start.,حدد العضو أو DOCTYPE للبدء. Select a Banner Image first.,تحديد صورة بانر الأول. Select an image of approx width 150px with a transparent background for best results.,اختر صورة من تقريبا عرض 150px مع خلفية شفافة للحصول على أفضل النتائج. -Select dates to create a new , +Select dates to create a new ,Select dates to create a new "Select modules to be shown (based on permission). If hidden, they will be hidden for all users.",حدد وحدات ليتم عرضها (على أساس إذن ) . إذا مخفي ، وسوف تكون مخفية لجميع المستخدمين. Select or drag across time slots to create a new event.,حدد أو اسحب عبر فتحات الوقت لإنشاء حدث جديد. "Select target = ""_blank"" to open in a new page.","حدد الهدف = "" _blank "" لفتح صفحة جديدة في ." @@ -1070,7 +1070,7 @@ Table,جدول Table {0} cannot be empty,الجدول {0} لا يمكن أن تكون فارغة Tag,بطاقة Tag Name,علامة الاسم -Tags,به +Tags,علامات Tahoma,تاهوما Target,الهدف Tasks,المهام @@ -1169,7 +1169,7 @@ User Permissions Manager,مدير ضوابط المستخدم User Roles,أدوار المستخدم User Tags,الكلمات المستخدم User Type,نوع المستخدم -"User Type ""System User"" can access Desktop. ""Website User"" can only be logged into the website and portal pages. ", +"User Type ""System User"" can access Desktop. ""Website User"" can only be logged into the website and portal pages. ","User Type ""System User"" can access Desktop. ""Website User"" can only be logged into the website and portal pages. " User Vote,تصويت المستخدم User not allowed to delete {0}: {1},المستخدم لا يسمح لحذف {0}: {1} User permissions should not apply for this Link,لا ينبغي تطبيق أذونات المستخدم لهذا الرابط diff --git a/frappe/translations/de.csv b/frappe/translations/de.csv index 0dad89ed68..26081a12b9 100644 --- a/frappe/translations/de.csv +++ b/frappe/translations/de.csv @@ -8,16 +8,16 @@ "000 is black, fff is white","000 ist schwarz, fff ist weiß" 2 days ago,vor 2 Tagen "[?]"," [?] " -"\
  • field:[fieldname] - By Field\
  • naming_series: - By Naming Series (field called naming_series must be present\
  • Prompt - Prompt user for a name\
  • [series] - Series by prefix (separated by a dot); for example PRE.#####\')"">Naming Options", +"\
  • field:[fieldname] - By Field\
  • naming_series: - By Naming Series (field called naming_series must be present\
  • Prompt - Prompt user for a name\
  • [series] - Series by prefix (separated by a dot); for example PRE.#####\')"">Naming Options","\
  • field:[fieldname] - By Field\
  • naming_series: - By Naming Series (field called naming_series must be present\
  • Prompt - Prompt user for a name\
  • [series] - Series by prefix (separated by a dot); for example PRE.#####\')"">Naming Options" new type of document, neue Art von Dokument "document type..., e.g. customer"," Dokumententyp ... , z. B. Kunden " e.g. (55 + 434) / 4 or =Math.sin(Math.PI/2)..., zB (55 + 434) / 4 oder = Math.sin (Math.PI / 2) ... module name..., Modulnamen ... text in document type, Text in Dokumenttyp A user can be permitted to multiple records of the same DocType.,Ein Benutzer kann die Genehmigung für mehrere Datensätze des gleichen DocType haben. -About,Info -About Us Settings,Über uns Einstellungen -About Us Team Member,Über uns Teammitglied +About,Information +About Us Settings,"""Über uns"" Einstellungen" +About Us Team Member,"""Über uns"" Teammitglied" Action,Aktion "Actions for workflow (e.g. Approve, Cancel).","Aktionen für Workflows (z. B. genehmigen , Abbruch) ." Add,Hinzufügen @@ -27,45 +27,45 @@ Add Attachments,Anhänge hinzufügen Add Bookmark,Lesezeichen hinzufügen Add CSS,CSS hinzufügen Add Column,Spalte hinzufügen -Add Filter, +Add Filter,Filter hinzufügen Add Google Analytics ID: eg. UA-89XXX57-1. Please search help on Google Analytics for more information.,Google Analytics-ID hinzufügen: z. B. UA-89XXX57-1. Weitere Informationen finden Sie bei Google Analytics. Add Message,Nachricht hinzufügen Add New Permission Rule,Neue Berechtigungsregel hinzufügen Add Reply,Antwort hinzufügen -Add Tag, -Add Total Row,Gesamtzeile hinzufügen +Add Tag,Stichwort hinzufügen +Add Total Row,Summenzeile hinzufügen Add a New Role,Neue Rolle hinzufügen Add a banner to the site. (small banners are usually good),Der Website ein Werbebanner hinzufügen. (kleine Banner sind in der Regel gut) Add all roles,Alle Rollen hinzufügen Add attachment,Anhang hinzufügen -Add code as <script>,Code als