Replace Wkhtmltopdf

[vvro]

Impacted versions:
All
Current behavior:
Using Wkhtmltopdf
Expected behavior:
Use a different tool

Wkhtmltopdf should be replaced. It's a security risk, it runs a "forked Qt 4.8 with wkhtmltopdf-specific patches" what could go wrong here? And running WebKit on QT 4.8 server side?
We're talking about an ERP that manages billions of operations every year.

Maybe https://github.com/Kozea/WeasyPrint.git

[PauMAVA]

Additionally to it being a security risk, wkhtmltopdf is no longer maintained as stated in the official repo.

I agree that a new alternative should be provided in Odoo for report generation. I also understand that entirely replacing wkhtmltopdf would generate backward compatibility issues as it uses an old deprecated version of WebKit which could break current reports in the new reporting engine. Maybe it could be added the possibility to use multiple reporing engines like WeasyPrint and the legacy wkhtmltopdf and let the administrator choose the one to be used.

[jon-willdooit]

As an end-user and part-time HML/Script hacker I think what we really need is a proper banded report writer like I used to use in my Delphi days, like Rave Reports etc. HTML to PDF engines will always be for the devs of the world and therefore not a consultants or implementors tool.

[morgs]

See this discussion on Twitter: https://twitter.com/bouvyd/status/1631574855198941184

[vvro]

Add some filtering for what can be put on the templates, because of CVE-2022-35583

[vvro]

This seems a good solution https://github.com/acsone/kwkhtmltopdf

[theangryangel]

This seems a good solution https://github.com/acsone/kwkhtmltopdf

This still uses wkhtmltopdf under the hood, it’s not an alternative.

[v3ss0n]

The solution is to build an PDF Render lib , using Chromium based engine instead of webkit.
If there is multiple interest on it , I am willing to work on it.
my plans :

• build a python lib that generate PDF using chrome based rendering engine
• keep same api so all needed is import crhtml2pdf as wkhtmltopdf

If anyone interested to fund me on the effort let me know.

[joshuarestivo]

As of Jan 2, 2023, the wkhtmltopdf github repo has been archived. No new packages are being published. This means that if you have any desire for things like header text and logos to appear in invoices and similar documents, you cannot use a current OS image like Debian 12. Is there any serious discussion going on anywhere on this issue? It's pretty thorny and only going to continue to degrade.

[v3ss0n]

I am willing to work on it , if someone going to fund me for development and maintenance of it.
my plan is to develop a replacement renderer based on chromium or playwright .
This is serious bug and it have problem with overall Stability of the Odoo , including several security flaws related to it , rendering Odoo totally uselss for enterprise setting. Now it is possible to hack any Odoo Installation with that existing flaws and gain full system access to it.

[tmotyl]

having an unsupported dependency with known security issues is a major risk from GDPR point of view

[Captivea-BEL]

Support for needing a better solution. I cant really seem to find a good workaround in all cases for problems similar to this with overlapping headers or rows with an extraordinary amount of line breaks

wkhtmltopdf/wkhtmltopdf#1524

Fixing one problem creates a new one.