[IMP] html_editor, web_unsplash, website: AI Website Builder tweaks by Dj0ulo · Pull Request #258133 · odoo/odoo

Dj0ulo · 2026-04-08T14:18:14Z

Few tweaks for the AI Website Builder assistant enterprise PR: odoo/enterprise#106196

[IMP] web_unsplash: take Unsplash request out of the controller

In ai_website, we need to make an Unsplash request from inside an
agent tool. However we can't call a controller method from a model.

Fix

Extract _fetch_unsplash_images into ir.attachment to make it
callable from other models.
Make the requests.get call safer by adding a timeout, filtering the
payload keys and putting the access key in Authorization header.
Replace the useless request variable uses with self
Add some constant for the Unsplash ICP keys

[IMP] website: make `defineMailModels` optional in `defineWebsiteModels`

In some case, we need to use defineWebsiteModels without defining the
mail models at the same time.

For example, in ai_website we call defineAIModels which is
defining the mail model DiscussChannel differently.

Fix
A new parameter (i.e.includeMailModels) is added to be able to prevent
the call to defineMailModels when needed.

[IMP] html_editor, *: make `attachment_create` usable in models

*: web_unsplash

Before commit
_attachment_create was a private method in the HTML_Editor
controller that can only be called within a controller context as it
uses the request variable.

After commit
Make attachment_create a standalone function that can be imported and
used from a model such as AI tools in ai_website.

robodoo · 2026-04-08T14:18:17Z

In `ai_website`, we need to make an Unsplash request from inside an agent tool. However we can't call a controller method from a model. __Fix__ - Extract `_fetch_unsplash_images` into `ir.attachment` to make it callable from other models. - Make the `requests.get` call safer by adding a timeout, filtering the payload keys and putting the access key in `Authorization` header. - Replace the useless `request` variable uses with `self` - Add some constant for the Unsplash ICP keys

In some case, we need to use `defineWebsiteModels` without defining the mail models at the same time. For example, in `ai_website` we call `defineAIModels` which is defining the mail model `DiscussChannel` differently. __Fix__ A new parameter (i.e.`includeMailModels`) is added to be able to prevent the call to `defineMailModels` when needed.

*: web_unsplash __Before commit__ `_attachment_create` was a private method in the `HTML_Editor` controller that can only be called within a controller context as it uses the `request` variable. __After commit__ Make `attachment_create` a standalone function that can be imported and used from a model such as AI tools in `ai_website`.

dmo-odoo

LGTM for the function move in html_editor, thanks!

In AI modules, the agent may take a long time to use the tools and generate content. We therefore need to increase the typing timeout to make the user understand that the AI is still working. This commit makes the typing timeout duration patchable in order to do that.

beledouxdenis · 2026-04-17T12:34:44Z

addons/web_unsplash/models/ir_attachment.py:47
PY006 🔗:
requests.get(
'https://api.unsplash.com/search/photos/',
params=payload,
headers=headers,
timeout=10,
)

This one is safe: hard-coded URL set, timeout set.

addons/html_editor/controllers/main.py:124
PY006 🔗: requests.head(url, timeout=10)

This one is not ideal: the URL can be arbitrarily set by a portal users, through the route
@route(['/web_editor/attachment/add_url', '/html_editor/attachment/add_url']
which means an SSRF attack is possible.

Indeed, it was already there before.

We had a discussion to let the PR go through, and a change will be done / is planned to do something about that requests.head with an arbitrary URL.

robodoo override=co/security

robodoo · 2026-04-17T12:34:47Z

@beledouxdenis you are not allowed to override 'co/security'.

beledouxdenis · 2026-04-17T12:35:01Z

robodoo override=ci/security

pkyriakou · 2026-04-17T15:22:09Z

@robodoo r+

robodoo · 2026-04-17T15:22:12Z

@Dj0ulo @pkyriakou because this PR has multiple commits, I need to know how to merge it:

merge to merge directly, using the PR as merge commit message
rebase-merge to rebase and merge, using the PR as merge commit message
rebase-ff to rebase and fast-forward

robodoo · 2026-04-17T15:27:10Z

@Dj0ulo @pkyriakou unable to stage: missing merge method

pkyriakou · 2026-04-17T15:27:59Z

@robodoo rebase-ff

robodoo · 2026-04-17T15:28:01Z

Merge method set to rebase and fast-forward.

pkyriakou · 2026-04-17T15:28:22Z

@robodoo retry

In `ai_website`, we need to make an Unsplash request from inside an agent tool. However we can't call a controller method from a model. __Fix__ - Extract `_fetch_unsplash_images` into `ir.attachment` to make it callable from other models. - Make the `requests.get` call safer by adding a timeout, filtering the payload keys and putting the access key in `Authorization` header. - Replace the useless `request` variable uses with `self` - Add some constant for the Unsplash ICP keys Part-of: #258133 Related: odoo/enterprise#106196 Signed-off-by: Panagiotis Kyriakou (paky) <paky@odoo.com>

In some case, we need to use `defineWebsiteModels` without defining the mail models at the same time. For example, in `ai_website` we call `defineAIModels` which is defining the mail model `DiscussChannel` differently. __Fix__ A new parameter (i.e.`includeMailModels`) is added to be able to prevent the call to `defineMailModels` when needed. Part-of: #258133 Related: odoo/enterprise#106196 Signed-off-by: Panagiotis Kyriakou (paky) <paky@odoo.com>

*: web_unsplash __Before commit__ `_attachment_create` was a private method in the `HTML_Editor` controller that can only be called within a controller context as it uses the `request` variable. __After commit__ Make `attachment_create` a standalone function that can be imported and used from a model such as AI tools in `ai_website`. Part-of: #258133 Related: odoo/enterprise#106196 Signed-off-by: Panagiotis Kyriakou (paky) <paky@odoo.com>

In AI modules, the agent may take a long time to use the tools and generate content. We therefore need to increase the typing timeout to make the user understand that the AI is still working. This commit makes the typing timeout duration patchable in order to do that. closes #258133 Related: odoo/enterprise#106196 Signed-off-by: Panagiotis Kyriakou (paky) <paky@odoo.com>