details: https://code.tryton.org/tryton/commit/aba6d8d6ede9
branch: 7.8
user: Cédric Krier <[email protected]>
date: Fri Jul 24 10:49:42 2026 +0200
description:
Restrict protocols allowed for weasyprint to http(s)
Closes #14947
(grafted from 7c72806c98c07bb4ccb1f5f1b84954350541ec3a)
diffstat:
trytond/CHANGELOG | 1 +
trytond/setup.py | 2 +-
trytond/trytond/report/report.py | 7 ++++++-
3 files changed, 8 insertions(+), 2 deletions(-)
diffs (37 lines):
diff -r d4f1e36b3d41 -r aba6d8d6ede9 trytond/CHANGELOG
--- a/trytond/CHANGELOG Thu Jul 30 16:37:30 2026 +0200
+++ b/trytond/CHANGELOG Fri Jul 24 10:49:42 2026 +0200
@@ -1,3 +1,4 @@
+* Restrict protocols allowed for weasyprint to http(s) (issue14947)
Version 7.8.13 - 2026-07-15
---------------------------
diff -r d4f1e36b3d41 -r aba6d8d6ede9 trytond/setup.py
--- a/trytond/setup.py Thu Jul 30 16:37:30 2026 +0200
+++ b/trytond/setup.py Fri Jul 24 10:49:42 2026 +0200
@@ -153,7 +153,7 @@
'graphviz': ['pydot'],
'Levenshtein': ['python-Levenshtein'],
'html2text': ['html2text'],
- 'weasyprint': ['weasyprint'],
+ 'weasyprint': ['weasyprint >= 68.0'],
'coroutine': ['gevent>=1.1'],
'image': ['pillow'],
'barcode': ['python-barcode[images]'],
diff -r d4f1e36b3d41 -r aba6d8d6ede9 trytond/trytond/report/report.py
--- a/trytond/trytond/report/report.py Thu Jul 30 16:37:30 2026 +0200
+++ b/trytond/trytond/report/report.py Fri Jul 24 10:49:42 2026 +0200
@@ -412,7 +412,12 @@
if (weasyprint
and input_format in {'html', 'xhtml'}
and output_format == 'pdf'):
- return output_format, weasyprint.HTML(string=data).write_pdf()
+ return output_format, weasyprint.HTML(
+ string=data,
+ url_fetcher=weasyprint.URLFetcher(
+ allowed_protocols={'http', 'https'},
+ ),
+ ).write_pdf()
if input_format == output_format and output_format in MIMETYPES:
return output_format, data
