details: https://code.tryton.org/tryton/commit/7c72806c98c0
branch: default
user: Cédric Krier <[email protected]>
date: Fri Jul 24 10:49:42 2026 +0200
description:
Restrict protocols allowed for weasyprint to http(s)
Closes #14947
diffstat:
trytond/CHANGELOG | 1 +
trytond/pyproject.toml | 2 +-
trytond/trytond/report/report.py | 7 ++++++-
3 files changed, 8 insertions(+), 2 deletions(-)
diffs (37 lines):
diff -r eb5fcd8c8ed2 -r 7c72806c98c0 trytond/CHANGELOG
--- a/trytond/CHANGELOG Thu Jul 30 16:37:30 2026 +0200
+++ b/trytond/CHANGELOG Fri Jul 24 10:49:42 2026 +0200
@@ -1,3 +1,4 @@
+* Restrict protocols allowed for weasyprint to http(s) (issue14947)
* Add search attribute to XML record tag
* Enforce access right on the email template record (issue14907)
* Add ModelAccessProxy (issue14907)
diff -r eb5fcd8c8ed2 -r 7c72806c98c0 trytond/pyproject.toml
--- a/trytond/pyproject.toml Thu Jul 30 16:37:30 2026 +0200
+++ b/trytond/pyproject.toml Fri Jul 24 10:49:42 2026 +0200
@@ -58,7 +58,7 @@
'pillow',
'pydot',
]
-weasyprint = ['weasyprint']
+weasyprint = ['weasyprint >= 68.0']
[project.scripts]
trytond = 'trytond.cli:main'
diff -r eb5fcd8c8ed2 -r 7c72806c98c0 trytond/trytond/report/report.py
--- a/trytond/trytond/report/report.py Thu Jul 30 16:37:30 2026 +0200
+++ b/trytond/trytond/report/report.py Fri Jul 24 10:49:42 2026 +0200
@@ -413,7 +413,12 @@
if (input_format in {'html', 'xhtml'}
and output_format == 'pdf'):
if weasyprint := _lazy_import('weasyprint'):
- return output_format, weasyprint.HTML(string=data).write_pdf()
+ return output_format, weasyprint.HTML(
+ string=data,
+ url_fetcher=weasyprint.URLFetcher(
+ allowed_protocols={'http', 'https'},
+ ),
+ ).write_pdf()
if (input_format == 'xml'
and output_format == 'html'
