Friday, July 10, 2026
1 change · 17.0
Enhancements to existing features
Website forms can be customized using the website editor. These customized values are directly embedded in the form in a hidden input or injected via the data-for js mechanism. For website forms whose action is the route `/website/form/`, this commit ensures that input marked with `data-sign='true'` are not modified by the client. The signature is prepared during the compilation phase, and the signature is calculated at runtime (during rendering) to take into account values rendered dynami
Original PR description
Website forms can be customized using the website editor. These customized values are directly embedded in the form in a hidden input or injected via the data-for js mechanism. For website forms whose action is the route `/website/form/`, this commit ensures that input marked with `data-sign='true'` are not modified by the client. The signature is prepared during the compilation phase, and the signature is calculated at runtime (during rendering) to take into account values rendered dynamically. HTML fields do not pass through the QWeb engine. For this field the form signature is calculated statically. Passing embedded forms within HTML fields through the pre-compilation step allows their signatures to be determined since these forms are static. This mechanism is completely transparent to the end user. Task-6320608