From 6fa71518e483e2e1bb0574f7dac5240805cac049 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Corentin=20S=C3=A9chet?= <csechet@entrouvert.com>
Date: Wed, 21 Sep 2022 12:27:55 +0200
Subject: [PATCH] misc: avoid javascript in mini-rich-text widget template
 (#59585)

---
 tests/test_widgets.py                         |  7 ++++++
 wcs/qommon/form.py                            |  1 +
 wcs/qommon/http_response.py                   | 25 ++++++++++++++++---
 wcs/qommon/static/js/qommon.godo.js           |  7 ++++++
 .../qommon/forms/widgets/mini-rich-text.html  |  7 ++----
 5 files changed, 38 insertions(+), 9 deletions(-)
 create mode 100644 wcs/qommon/static/js/qommon.godo.js

diff --git a/tests/test_widgets.py b/tests/test_widgets.py
index f5e08d030..259a3db89 100644
--- a/tests/test_widgets.py
+++ b/tests/test_widgets.py
@@ -17,6 +17,7 @@ from wcs.qommon.form import (
     FileWithPreviewWidget,
     Form,
     MapWidget,
+    MiniRichTextWidget,
     OptGroup,
     PasswordEntryWidget,
     SingleSelectHintWidget,
@@ -515,6 +516,12 @@ def test_wysiwygwidget_img():
     assert widget.parse() == '<p><img src="/test/"></p>'
 
 
+def test_mini_rich_text_widget():
+    widget = MiniRichTextWidget('test')
+    form = MockHtmlForm(widget)
+    assert 'data-godo="basic"' in form.as_html
+
+
 def test_select_hint_widget():
     widget = SingleSelectHintWidget(
         'test', options=[('apple', 'Apple', 'apple'), ('pear', 'Pear', 'pear'), ('peach', 'Peach', 'peach')]
diff --git a/wcs/qommon/form.py b/wcs/qommon/form.py
index d3ef2b9e2..dd43b1a89 100644
--- a/wcs/qommon/form.py
+++ b/wcs/qommon/form.py
@@ -2438,6 +2438,7 @@ class MiniRichTextWidget(WysiwygTextWidget):
 
     def add_media(self):
         get_response().add_css_include('../xstatic/css/godo.css')
+        get_response().add_javascript_module('qommon.godo.js')
 
 
 class TableWidget(CompositeWidget):
diff --git a/wcs/qommon/http_response.py b/wcs/qommon/http_response.py
index 83ef36f18..66b9280ec 100644
--- a/wcs/qommon/http_response.py
+++ b/wcs/qommon/http_response.py
@@ -25,6 +25,7 @@ from .afterjobs import AfterJob
 
 class HTTPResponse(quixote.http_response.HTTPResponse):
     javascript_scripts = None
+    javascript_modules = None
     javascript_code_parts = None
     css_includes = None
     after_jobs = None
@@ -61,6 +62,7 @@ class HTTPResponse(quixote.http_response.HTTPResponse):
 
     def reset_includes(self):
         self.javascript_scripts = None
+        self.javascript_modules = None
         self.javascript_code_parts = None
         self.css_includes = None
 
@@ -138,6 +140,13 @@ class HTTPResponse(quixote.http_response.HTTPResponse):
                     self.add_javascript(['jquery.js', '../../i18n.js', 'qommon.forms.js', 'select2.js'])
                     self.add_css_include('select2.css')
 
+    def add_javascript_module(self, *modules):
+        if not self.javascript_modules:
+            self.javascript_modules = []
+        for module in modules:
+            if module not in self.javascript_modules:
+                self.javascript_modules.append(module)
+
     def add_javascript_code(self, code):
         if not self.javascript_code_parts:
             self.javascript_code_parts = []
@@ -146,11 +155,11 @@ class HTTPResponse(quixote.http_response.HTTPResponse):
 
     def get_javascript_for_header(self):
         s = ''
-        if self.javascript_scripts:
-            from .admin.menu import get_vc_version
+        from .admin.menu import get_vc_version
 
-            version_hash = hashlib.md5(force_bytes(get_vc_version())).hexdigest()
-            root_url = get_publisher().get_root_url() + get_publisher().qommon_static_dir
+        version_hash = hashlib.md5(force_bytes(get_vc_version())).hexdigest()
+        root_url = get_publisher().get_root_url() + get_publisher().qommon_static_dir
+        if self.javascript_scripts:
             s += '\n'.join(
                 [
                     '<script type="text/javascript" src="%sjs/%s?%s"></script>'
@@ -159,6 +168,14 @@ class HTTPResponse(quixote.http_response.HTTPResponse):
                 ]
             )
             s += '\n'
+        if self.javascript_modules:
+            s += '\n'.join(
+                [
+                    '<script type="module" src="%sjs/%s?%s"></script>' % (root_url, str(x), version_hash)
+                    for x in self.javascript_modules
+                ]
+            )
+            s += '\n'
         if self.javascript_code_parts:
             s += '<script type="text/javascript">'
             s += '\n'.join(self.javascript_code_parts)
diff --git a/wcs/qommon/static/js/qommon.godo.js b/wcs/qommon/static/js/qommon.godo.js
new file mode 100644
index 000000000..aee07053d
--- /dev/null
+++ b/wcs/qommon/static/js/qommon.godo.js
@@ -0,0 +1,7 @@
+import Godo from '../xstatic/js/godo.js';
+
+$(() => {
+  $('textarea[data-godo]').each(function() {
+    new Godo(this, {schema: this.getAttribute('data-godo')});
+  })
+});
diff --git a/wcs/qommon/templates/qommon/forms/widgets/mini-rich-text.html b/wcs/qommon/templates/qommon/forms/widgets/mini-rich-text.html
index 594af2630..60c865bd9 100644
--- a/wcs/qommon/templates/qommon/forms/widgets/mini-rich-text.html
+++ b/wcs/qommon/templates/qommon/forms/widgets/mini-rich-text.html
@@ -2,9 +2,6 @@
 {% block widget-control %}
 <textarea style="width: 100%" id="form_{{widget.get_name_for_id}}" name="{{widget.name}}"
     {% for attr in widget.attrs.items %}{{attr.0}}="{{attr.1}}" {% endfor %}
-    >{{widget.value|default:""}}</textarea>
-<script type="module">
-import Godo from "/static/xstatic/js/godo.js?{{version_hash}}";
-new Godo(document.getElementById('form_{{widget.get_name_for_id}}'), {schema: 'basic'});
-</script>
+    data-godo="basic">{{widget.value|default:""}}
+</textarea>
 {% endblock %}
-- 
2.35.1