Commit Graph
14110 Commits
Author SHA1 Message Date
Sébastien Theys c6716847aa [IMP] web, *: clean up notification API
task-2476867

closes odoo/odoo#67009

Related: odoo/enterprise#16760
Signed-off-by: Sébastien Theys (seb) <seb@odoo.com>
2021-05-27 13:47:23 +00:00
Mohammed Shekha dff8d83027 [IMP] web: tabbing out of an empty m2o should not set a value
Before this commit, when the use focused a many2one field and then
pressed tab, the first item of the autocomplete dropdown was selected.

This is not what we want if the user didn't write anything in the input,
and if he didn't use the up/down keys to highlight a specific item of
the dropdown.

This commit ensures that we only select the highlighted item when the
user presses tab if he previously wrote something in the input (which
hasn't been emptied meanwhile) or if he used the up/down keys to select
a specific item.

task-2455781

closes odoo/odoo#66443

Signed-off-by: Aaron Bohy (aab) <aab@odoo.com>
2021-05-27 07:01:25 +00:00
Sébastien Mottet (oms) b8e336aaae [IMP] website, *: change configurator palette selection
*: web

This commit brings some functionnal changes to the palette selection
screen:

- The list of suggested palettes does not depend on the uploaded logo
anymore. It is now a fixed list of 20 palettes manually chosen among the
existing ones.

- The recommended palette is not chosen among the existing palettes
based on the logo's extracted colors anymore. The recommended palette is
now a fully custom palette generated based on the two main colors
extracted from the logo.

- The selected palette has a border to indicate it is the currently
selected palette.

task-2518565

closes odoo/odoo#71268

X-original-commit: 23dee47ed51d0dfa54f68ef4b328aba957589bb9
Signed-off-by: Quentin Smetz (qsm) <qsm@odoo.com>
2021-05-26 15:14:43 +00:00
Younn Olivier 507408e8e1 [FIX] web, website: display default company name on frontend layout
Before, the "Company name" placeholder was hardcoded in the frontend
layout template, and the user had to change it with his company name
from the website view, which was not user-friendly if the website module
was not installed.

Now, by default, the frontend layout template displays the user's
company name. If the website module is installed, it is editable.

task-2468472

closes odoo/odoo#71176

X-original-commit: 059804be90021559debee6f930462594a3ca8a97
Signed-off-by: Jérémy Kersten (jke) <jke@openerp.com>
Signed-off-by: Quentin Smetz (qsm) <qsm@odoo.com>
2021-05-21 16:56:11 +00:00
Mohammed Shekha 8962edf492 [FIX] web: do not show cursor pointer on m2m badge without color
before this commit: when many2mnay_tags widget does not have color_field in
options still hovering over many2many_tags badge shows cursor pointer, while
it should display default cursor and if there is color field given in options
then cursor should be pointer.

after this commit: cursor pointer will be displayed only when color field is
given in options else shod cursor default.

task-2451204
2021-05-26 14:04:15 +00:00
Mohammed Shekha d25459e6cb [IMP] mail,web: add many2many_avatar_user widget to open chat
with this commit, we adds many2many_avatar_user widget to have same behaviour
as many2one_avatar_user where clicking on avatar image opens chat box, so to
have same feature on many2many_tags which is related to res.users we adds
many2many_avatar_user widget.

task-2451204
2021-05-26 14:04:15 +00:00
Anh Thao Pham (pta) cb500aba27 [FIX] web: fix crash on editable list view when moving over a RO field
This is a forward-port of commit https://github.com/odoo/odoo/commit/970387f91fea0cb47404612f7d519ffba2c9ad3b

In editable list view, moving to next cell using TAB key crash when the
following field is becoming read-only (i.e non-focusable) and an onchange()
event is triggered.

Consider an editable tree view like this:

<form>
   <field name="o2m" onchange="1">
       <tree>
          <field name="description"/>
          <field name="date" attrs="{'readonly': [('description', '!=', False)]}"/>
          <field name="type"/>
       </tree>
   </field>
</form>

1. Edit 'description'
2. Issue a TAB keypress before 'date' becomes read-only
It will crash while calling getSelectionRange() on an empty element.

opw-2523630

closes odoo/odoo#71163

X-original-commit: 2a880a8020b55b692505846e9626359fe019dbdb
Signed-off-by: Aaron Bohy (aab) <aab@odoo.com>
Signed-off-by: Anh Thao PHAM <kitan191@users.noreply.github.com>
2021-05-21 15:09:42 +00:00
Mohammed Shekha ccc56e28a3 [IMP] *: replace fa-spinner with fa-circle-o-notch
Slightly improve the overall UI of Odoo with a more modern feel by updating the
current 'loading' icons that look quite old school.

Use fa-circle-o-notch instead of old style fa-spinner

task-2346142

closes odoo/odoo#59454

Related: odoo/enterprise#13908
Signed-off-by: Aaron Bohy (aab) <aab@odoo.com>
2021-05-21 11:48:32 +00:00
Mohammed Shekha 45b687ea4b [IMP] web: add icons to boolean_toggle widget
With this commit we improve boolean_toggle widget design, now widget will
display fa-check-circle icon if it is enabled i.e. it has true value, widget
will display fa-times-circle icon it is disabled i.e. it has false value.

task-2488999

closes odoo/odoo#68772

Signed-off-by: Aaron Bohy (aab) <aab@odoo.com>
2021-05-21 09:32:40 +00:00
Mohammed Shekha 5a0a1e76b3 [IMP] web: improve many2one_avatar widget for form edit mode
with this commit: we improve many2one_avatar widget for editable form view,
previously many2one avatar in edit mode was not displaying image, it was
displaying only many2one selection input, this commit adds image before
many2one input to have unify design with readonly form view.

This is especially motivated by the fact that we plan on getting rid of the
readonly formview to always be in edit mode.

task-2451340

closes odoo/odoo#67366

Signed-off-by: Aaron Bohy (aab) <aab@odoo.com>
2021-05-21 07:09:33 +00:00
Mohammed Shekha e6c2dfdf29 [IMP] web: allow user to select multiple company
Before this commit: when user selects company from company switcher, page is
reloaded, what if user wants to select multiple companies from dropdown, he
have to wait for page reload and need to do same process again.

After this commit: when user selects company from company switcher, page
will not reloaded as soon as user toggles checkbox, user will given time to
select another item or unselect other item from dropdown, so user can select
multiple companies or unselect multiple companies.

task-2467747

closes odoo/odoo#70799

Related: odoo/enterprise#18376
Signed-off-by: Aaron Bohy (aab) <aab@odoo.com>
2021-05-20 12:01:23 +00:00
Mohammed Shekha 28fa5bc806 [IMP] web: add basic search for binary field
With this commit: we are adding basic search feature for binary fields,
custom filter will have binary fields and selecting binary field will
display 'is set', 'is not set' operators.

with this user can at least filter records based on whether binary field
is set or not set.

task-2512226

closes odoo/odoo#70149

Signed-off-by: Aaron Bohy (aab) <aab@odoo.com>
2021-04-30 09:08:02 +00:00
Géry Debongnie dc0897ca29 [FIX] web: update owl from 1.2.5 to v1.2.6
This commit updates owl to the latest release. It only contains a small
fix to the router (route params handling)

Release on github: https://github.com/odoo/owl/releases/tag/v1.2.6

closes odoo/odoo#71039

X-original-commit: 65c1f4c0cb3659fe345ed1e63d3980835565a21a
Signed-off-by: Samuel Degueldre <sdegueldre@users.noreply.github.com>
Signed-off-by: Géry Debongnie (ged) <ged@openerp.com>
2021-05-19 13:49:33 +00:00
Mohammed Shekha ed77ecd87b [IMP] web: format float_time on field blur
Before this commit: when float_time field value changed and field is
blurred, it does not format value and it formats value only when saving
record, this looks awkward and buggy.

After this commit: when float_time field value changed and blurred, value
will be formatted.

task-2518730

closes odoo/odoo#70481

Signed-off-by: Aaron Bohy (aab) <aab@odoo.com>
2021-05-19 11:23:53 +00:00
Mohammed Shekha d9f2eafdf2 [FIX] web: disale autofill on input elements
with this commit we disables autofill of autocomplete by setting
autocomplete=off, this was previously done in commit: 64293fbdb0
but it was not working because we were setting autocomplete=none
it seems that none does not work all the time.

task-2462676

closes odoo/odoo#71016

X-original-commit: 9d6ef842902e9e192924fa0caba99514e1543352
Signed-off-by: Aaron Bohy (aab) <aab@odoo.com>
2021-05-19 08:31:15 +00:00
Hardik Prajapati 992de2223b [IMP] web: quicksearch on selection and boolean field
Currently, the selection field and boolean field values are displays
below the string 'search  for: '
like, Search status for: input value
      New
      Running
      Cancelled

so, this commit improves the quick search dropdown by displaying the
selection field and boolean field value and strings in the same line
like, Search Status: New
      Search Status: Running
      Search Status: Cancelled

TaskID-2462138

closes odoo/odoo#67575

Signed-off-by: Aaron Bohy (aab) <aab@odoo.com>
2021-03-10 09:59:32 +00:00
Géry Debongnie d403a13a29 [FIX] web: update owl from 1.2.4 to v1.2.5
This commit update owl to the latest release. It only contains a small
fix on the order of lookup for the t-component directive.

Release on github: https://github.com/odoo/owl/releases/tag/v1.2.5

closes odoo/odoo#70972

X-original-commit: 67e706b76fefa7eaff12722a4bda6fa4ce497eaf
Signed-off-by: Aaron Bohy (aab) <aab@odoo.com>
2021-05-18 11:57:01 +00:00
Aaron Bohy 2e030a37aa [FIX] web: domain: (=)(i)like operators
Before this commit, evaluating a domain containing a like/ilike
operator with an evaluation context in which the value was false
crashed.

Moreover, those operators were wrong w.r.t. the case sensitivity:
like was case insensitive, whereas ilike was case sensitive, and
both =like and =ilike were case insensitive.

This commit fixes thoses issues.

The first issue was spotted on our prod, as we tried to add an
invisible attrs in a form view, using the ilike operator (it thus
crashed in create mode).

The second issue was spotted while writting the test cases.

To the best of our knowledge, those operators aren't used in attrs
(for now), explaining why those issues haven't been found before.

closes odoo/odoo#70951

X-original-commit: 44e185dbd6ddeda7cdcd76882fa0bd231e9d3f37
Signed-off-by: Géry Debongnie (ged) <ged@openerp.com>
Signed-off-by: Aaron Bohy (aab) <aab@odoo.com>
2021-05-18 10:02:14 +00:00
Victor Feyens 0348b95aee [FIX] *: update documentation links
Following the recent reorganisation of the documentation in 12.0+,
the majority of the documents have been moved and their old links are no longer valid.
Some redirection rules will soon be deployed, but those rules might be dropped in some years
and we want the links to still work, which is why we still replace the links to the new ones.

FW-Port of odoo/odoo#70675 (13.0)

closes odoo/odoo#70920

X-original-commit: bc9c1eef538ba6095e74c19d5d9ed9e01625ec7c
Related: odoo/enterprise#18361
Signed-off-by: Victor Feyens (vfe) <vfe@odoo.com>
2021-05-17 19:26:27 +00:00
Adrien Widart dfbebbc09e [FIX] web: remove bottom border of first table raw
When using the boxed layout, if the business document has a table, its
first row (after the table head) will have a bottom border and the last
cell in the row has a white background.

To reproduce the error:
(Need timesheet_grid. Use demo data)
1. In Settings > General Settings, Change Document Template:
    - Select the second template
2. In Timesheets, select list view
3. Select several lines
4. Print > Timesheet Entries

Error: In PDF, the first timesheet line has a bottom line and its last
cell has a white background (instead of grey).

The bottom line should only be applied on row in table header. The
background color should also be applied on first row in table body.

OPW-2478311

closes odoo/odoo#70771

X-original-commit: 88a10bdd8f1d46a8b52be59fe3284cbe284a74f2
Signed-off-by: Adrien Widart <adwid@users.noreply.github.com>
2021-05-12 16:02:01 +00:00
Aaron Bohy 30f52f3f8c [FIX] web: check QUnit.only: wrong bundle name
closes odoo/odoo#70685

X-original-commit: d38b5f9a69b3503c5f220bceddc4a924bf8c7c69
Signed-off-by: Lucas Perais (lpe) <lpe@odoo.com>
Signed-off-by: Aaron Bohy (aab) <aab@odoo.com>
2021-05-11 14:22:22 +00:00
Martin Trigaux 41d8b8cf68 [I18N] *: export saas-14.3 source terms
closes odoo/odoo#70673

X-original-commit: bcb9ff784e44462384b0a43a0a23eed7a1111bc5
Related: odoo/enterprise#18269
Signed-off-by: Martin Trigaux (mat) <mat@odoo.com>
2021-05-11 12:28:28 +00:00
Achraf (abz) 19fd3ea238 [FIX] web: Allow user to add product Description with studio
What are the steps to reproduce your issue ?

    1. From the product form, go to the website version, edit it to add tabs
    2. Using studio, add the field "Description for website" to a tab of the notebook
    3. Save, click Edit, go to the tab that has the field

What is currently happening ?

    Traceback:
    form_renderer.js:258 Uncaught (in promise) TypeError: Cannot read property 'querySelector' of undefined
        at Class.setLocalState (form_renderer.js:258)
        at Class.setLocalState (form_editor.js:131)
        at Class.prototype.<computed> [as setLocalState] (class.js:90)
        at view_editor_manager.js:184

What are you expecting to happen ?

    Correctly add product description without tracebacks

Why is this happening ?

    Because the number of tab is not equal to the number of pages

How to fix the bug ?

    Before accessing the element, check if it exists

opw-2378743

closes odoo/odoo#70670

X-original-commit: 96564dd64bdbd426ae87444fd75a822074a37fc0
Signed-off-by: Nicolas Lempereur (nle) <nle@odoo.com>
Signed-off-by: Achraf <abz-odoo@users.noreply.github.com>
2021-05-11 12:10:06 +00:00
Lucas Perais (lpe) f576c96a88 [FIX] web: route /web/session/modules returns a list
Since the changing of assets (8cc066173d)
the /web/session/modules route returned a stringified set instead of a list

After this commit, the route returns a list

closes odoo/odoo#70545

X-original-commit: 54e4a48996826dd8ea16a84517b46a847d6daf3f
Signed-off-by: Lucas Perais (lpe) <lpe@odoo.com>
2021-05-07 14:31:02 +00:00
Romeo Fragomeli 8a755d5833 [REF] web,*: hide buttons that doesn't work in webviews
Some features of the PDF.js library doesn't work in the
webview of the mobile apps.

Initially 'window.print' is defined as an empty function in
webviews unlike browsers where it is already ready.
After that, PDF.js needs to monkey patch 'window.print' and
saves a reference to the original definition, which is not
yet fulfilled in by the mobile app (Java part).
So the print of PDF.js doesn't work in webviews and end
users will need to download the file before printing it.

Regarding the Download button, the 'download' attribute is
not supported by the webview as you can see in:
https://bugs.chromium.org/p/chromium/issues/detail?id=432414
As there's many ways to download a file in Odoo it's not
a big deal to simply hide it in PDF.js.

Because it's quite complicated to fix this, we decided
to hide the features that don't work (Download / Print)
or don't make sense (Open file).

Task-id: 2200168
2021-05-07 11:01:27 +00:00
Romeo Fragomeli c1c225eff2 [IMP] web: add the detection of iPadOS
Before this commit, the iPad with iPadOS was not detected as
'isMobileDevice'.

Now the detection is more accurate.
2021-05-05 10:20:06 +00:00
Romeo Fragomeli e7d6a68a56 [REV][FIX] web: pdfjs: hide buttons that doesn't work in webviews
The commit odoo/odoo@7a40d528 is reverted as the following commit
will do same behaviour without "Monkey Patching" the lib PDF.js
2021-05-05 10:20:06 +00:00
abd-msyukyu-odoo a03c882a56 [FIX] web: fix kanban view progressbars related to records in another group (groupby:week)
* IMPACTED VERSIONS

  12.0+

* HOW TO REPRODUCE

locale :  Locale is en_US (or other SUNDAY based)
view:     CRM - My Pipeline - Kanban view
groupBy:  date_deadline:week (Expected closing)
records:  one record with a planned activity, on date_deadline = 2021-05-02 (SUNDAY)
          one record with no planned activity, on date_deadline = 2021-05-09 (SUNDAY)
remark:   don't keep any other record in MAY for better visibility

* PROBLEM

The progressbar of the week containing 2021-05-09 displays information about the record
from the week containing 2021-05-02

* CAUSE

1. PostgreSQL `date_trunc` function follows ISO8601 which essentially means that
  the start of a WEEK is always MONDAY. There is no argument to change this.

2. _read_group_format_result
  https://github.com/odoo/odoo/blob/27da86a138089c1838e4b94f8a6976995b9c1fff/odoo/models.py#L2210-L2219

  - Computes a label for a group of records.
  - Follows the locale for the label of the week, based on a date which is
    always a MONDAY because of `date_trunc`.

3. read_progress_bar
  https://github.com/odoo/odoo/blob/88957afca09662af7eaa19df1e40b3699e45e79e/addons/web/models/models.py#L167-L175

  - Associates a group label to a record.
  - Follows the locale for the label of the week, based on the date of a record
    which can be any day of the week. If the record is related to a SUNDAY and
    SUNDAY is the first day of the week, it would have been in a group with a
    different label in (2.) than in (3.) prior to this change.

* FIX

In 3., before associating a label to a record, we truncate the date to the
ISO start of the period, so that the label is determined for a record in the
same conditions than in 2. The locale is still used to get language-dependent
outputs with babel, but the grouping will always follows ISO8601 (date_trunc).

* TEST

Added a test for this problem case

TASK-ID : 2517848

closes odoo/odoo#70498

X-original-commit: 4560925b26fa79740b9618fd9241d3517b64f43f
Signed-off-by: Raphael Collet (rco) <rco@openerp.com>
Signed-off-by: Thibault Delavallee (tde) <tde@openerp.com>
2021-05-06 17:56:20 +00:00
Xavier Morel 79a4d11e24 [FIX] *: bunch of mismarked translation specifiers
`_(xyz)` will wrap them in an underscore.js object, which when used in
a string context will just return the string. So it's basically a
no-op, but it certainly doesn't translate the terms.

closes odoo/odoo#70476

X-original-commit: 92352ed2b5524c97b0aeeba3193c6a8d93ed82a1
Related: odoo/enterprise#18172
Signed-off-by: Xavier Morel (xmo) <xmo@odoo.com>
Signed-off-by: Martin Trigaux (mat) <mat@odoo.com>
2021-05-06 12:06:22 +00:00
Luis González fcfc83b66c [FIX] web: Aria attributes on buttons Export All & optional columns
Some aria attributes were missing or incorrectly set on these new
buttons:
- The button "Export All" was missing an `aria-label` attribute
- The button to show/hide optional columns was also missing an
  `aria-label` attribute, and its menu items (checkboxes to show/hide
  columns) were missing a proper role
- Ever since the debug manager was added in frontend on 73327db065,
  the `aria-label` attribute was not being rendered correctly on the
  button to open developer tools

closes odoo/odoo#70433

X-original-commit: ac3e0fcd32d66d6e0bacfabd2d224805d92dbfd1
Signed-off-by: Nicolas Lempereur (nle) <nle@odoo.com>
2021-05-05 16:37:04 +00:00
Jorge Pinna PuissantandSamuel Degueldre 9a76719893 [FIX] *: undeclared variables and restricted globals
closes odoo/odoo#69988

Related: odoo/enterprise#17991
Signed-off-by: Géry Debongnie (ged) <ged@openerp.com>
Co-authored-by: Samuel Degueldre <sad@odoo.com>
2021-05-04 13:32:49 +00:00
Jorge Pinna PuissantandSamuel Degueldre a8082fee7f [FIX] web, project: use the ES6 import
Remove the CommonJS require from the odoo-modules files and replace it
with the new ES6 imports.

Co-authored-by: Samuel Degueldre <sad@odoo.com>
2021-05-04 13:32:49 +00:00
Jorge Pinna PuissantandSamuel Degueldre f43a0814ae [IMP]*: configuration of ESLint for specific files
This commit will add the needed ESLint configurations on the JS files.
These configurations are added if the JS file uses a different
environment (serviceworker, node, etc) or if it uses a specific global
(google, ace, etc).

Co-authored-by: Samuel Degueldre <sad@odoo.com>
2021-05-04 13:32:49 +00:00
Philémon van HeldenandNicolas Lempereur 1d3c886b95 [FIX] web: no error on single active_ids state load
In eg. 13.0 when refreshing sales analysis action of a product, we would
get an error because we have a single active_ids which is not expected
by the code.

With this commit, we use .toString() on the jQuery BBQ parsed active_ids
as it was done before 32b8cec5 refactoring (january 2018).

The added test with the fix fails with an error:

  TypeError: state.active_ids.split is not a function
  at Class.loadState (/web/static/src/js/chrome/action_manager_act_window.js)

opw-2471982

closes odoo/odoo#70285

X-original-commit: bf9a985f4b62cc6f1eef4f9fcca2a8dfbd453004
Signed-off-by: Nicolas Lempereur (nle) <nle@odoo.com>
Signed-off-by: pvh-odoo <SwagSamaSempai@users.noreply.github.com>
Co-authored-by: Nicolas Lempereur <nle@odoo.com>
2021-05-03 18:01:10 +00:00
Chong Wang (cwg) be2981324c [FIX] Calendar: fix avatar preview on hover
delete redundant '}' added by accident

The redundant '}' might be added by accident.
It makes the the correct avatar image cannot be found and shown as a default camera image when the user
* Open calendar
* Hover on on of the responsibles listed in the right side panel of the calendar view

closes odoo/odoo#69139

Taskid: 2504659
Signed-off-by: Arnaud Joset <arj-odoo@users.noreply.github.com>
2021-04-16 09:14:24 +00:00
Samuel Degueldre 557a24e4f4 [IMP] web: allow lazy-loading asset bundles' templates
Previously, lazy-loading xml templates was only possible by fetching the
xml file directly, this meant that it was impossible to lazy-load an
entire bundle's templates with a single request. Additionally,
requesting the xml files directly meant that no inheritance was applied,
causing the need for a separate inheritance system using t-jquery on the
client-side.

This commit alters the /web/webclient/qweb route so that it now takes a
bundle id, meaning that it is now possible to lazy-load the xml from
arbitrary bundles.

task-2497943

closes odoo/odoo#70084

Signed-off-by: Géry Debongnie (ged) <ged@openerp.com>
2021-05-03 07:25:20 +00:00
Olivier Dony d08db821bc [IMP] web: simplify font loading code
Can be simplified a bit by using the newer features of
`tools.file_open()` and `tools.file_path()`.

Let's do it since the PR is touching these lines anyway
for the change of resource paths.

closes odoo/odoo#69614

Related: odoo/enterprise#17855
Signed-off-by: Géry Debongnie (ged) <ged@openerp.com>
2021-04-29 07:34:40 +00:00
Simon Genin (ges) ecfe85db84 [REF] web: static/src/(img|fonts) => static/(img|fonts) 2021-04-29 07:34:40 +00:00
Romeo Fragomeli 7a40d528e7 [FIX] web: pdfjs: hide buttons that doesn't work in webviews
Some features of the PDF.js library doesn't work in the
webview of the mobile apps.

Initially 'window.print' is defined as an empty function in
webviews unlike browsers where it is already ready.
After that, PDF.js needs to monkey patch 'window.print' and
saves a reference to the original definition, which is not
yet fulfilled in by the mobile app (Java part).
So the print of PDF.js doesn't work in webviews and end
users will need to download the file before printing it.

Regarding the Download button, the 'download' attribute is
not supported by the webview as you can see in:
https://bugs.chromium.org/p/chromium/issues/detail?id=432414
As there's many ways to download a file in Odoo it's not
a big deal to simply hide it in PDF.js.

Because it's quite complicated to fix this, we decided
to hide the features that don't work (Download / Print)
or don't make sense (Open file).

Note that a refactoring is already in progress in order to
avoid to patch this library in master.

closes odoo/odoo#70110

Task-id: 2200168
X-original-commit: 39225827035efe11cdc90b2a7f1ae1f24a54b136
Signed-off-by: Adrien Dieudonné (adr) <adr@odoo.com>
Signed-off-by: rfr-odoo <rfr-odoo@users.noreply.github.com>
2021-04-29 14:27:31 +00:00
Xavier Morel a671b744b8 [FIX] *: raw -> out of mail values 2021-04-29 05:34:20 +00:00
Xavier Morel c6f744d7c3 [FIX] web: raw -> out of footer thing
Done this way so `_message` can be overridden with custom
markup. Should now work properly ootb: `final_message` should be a
`Markup` from qweb rendering, if `_message` also is such, the merge
should happen without further escaping of either value.

Note: needed to convert the str.__mod__ call to a concatenation as
otherwise the markupness information is lost. That's probably a
recurring issue.
2021-04-29 05:34:20 +00:00
Xavier Morel 9fadd925cb [FIX] reporting: fix rendering during PDF printing
The process of making HTML reports palatable to wkhtmltopdf is a bit
involved, including various renderings intersperded with
processing. This means bits of HTML are created, which are
processed (via lxml) before being fed into further templates.

On step 3, the previously processed bits need to be marked as Markup
lest they be escaped again and lead to... odd results.

Also explicitly provide encoding for one case where it's not entirely
necessary but can't hurt.

Also un-escape <base> in report templates, it seems completely
unnecessary. And try to move it to the correct location to the extent
that that's possible: per-spec, it should be in the head, not outside
the document entirely.
2021-04-29 05:34:20 +00:00
Xavier Morel 996cb85c27 [FIX] *: mass replace known t-raws by t-out
* QWeb bodies should be markup-safe so `0` should always be
  markup-safe.
* `head` is qweb-rendered so the same.
* The `json` pseudo-module in qweb templates is `json.scriptsafe`,
  which should be markup-safe.
2021-04-29 05:34:20 +00:00
Xavier Morel 3786e1dcb0 [FIX] core, mail: mark HTML manipulation results as markup-safe.
* The result of `plaintext2html` is fully controlled and
  markup-safe (the first thing we do is escape the input).
* For `append_content_to_html`, we assume the inputs are HTML and the
  output is thus always properly HTML.

  Alternatively, we may want to `Markup("%s%s") % ...` and require the
  inputs to be properly marked? That seems like a good idea.
* In `_replace_local_links`, applying re.sub will strip out the markup
  mark, so store it and reapply it on output if necessary.

  That one is a big gnarly, because if the input to ustr is
  markup-safe bytes (e.g. qweb rendering output) then the output is a
  Markup object, but if the input is str then the output is str, so we
  need to check before and after unless... we update ustr to check for
  subclasses instead of exact type?
* In `_prepend_preview` the issue is similar to that of
  `append_content_to_html`, though in this case we should *not* trust
  the input, so we can flag the "parent document" as Markup and format
  the preview bit in.
* And since we're marking mail's jinja output as safe, do the same for
  web and iot.

  Sadly there doesn't seem to be any hook for doing that at the
  environment level of jinja, so every `Template.render` site has to
  be marked.
2021-04-29 05:34:20 +00:00
Xavier Morel 01875541b1 [CHG] core, web: deprecate t-raw
Add a big fat warning when the qweb compiler finds a `t-raw`.

`t-esc` should now be used everywhere, the use-case for `t-raw` should
be handled by converting the corresponding values to `Markup`
objects. Even though it's convenient, this constructor *should never
be made available in the qweb rendering context* (maybe that should be
checked for explicitely?).

Replace `werkzeug.escape` by `markupsafe.escape` in
`odoo.tools.html_escape`, this means the output of `html_escape` is
markup-safe.

Updated qweb to work correctly with escaping and `Markup`, amongst
other things QWeb bodies should be markup-safe internally (so that a
`t-set` value can be fed into a `t-esc`). See at the bottom for the
attributes handling as it's a bit complicated.

`to_text` needed updating: `markupsafe.Markup` is a subclass of `str`,
but `str` is not a passthrough for strings. So `Markup` instances
going through would be converted to normal `str`, losing their safety
flag. Since qweb internally uses `to_text` on pretty much
everything (in order to handle None / False), this would then cause
almost every `Markup` to get mistakenly double-escaped.

Also mark a bunch of APIs as markup-safe by default

* html_sanitize output.
* HTML fields content, sanitization is applied on intake (so stripped
  by the trip through the database) and if the field is unsanitised
  the injection is very much intentional, probably. Note: this
  includes automatically decoding bytes as a number of default values
  & computes yield bytes, which Markup will happily accept... by
  repr-ing them which is useless. This is hard to notice without `-b`.
* Script-safe json, it's rather the point (though it uses a
  non-standard escaping scheme).
* Note that `nl2br`, kinda: it should work correctly whether or not
  the input is markup-safe, this means we should not need to escape
  values fed to `nl2br`, but it doesn't hurt either.

Update some qweb field serialisations to mark their output as
markup-safe when necessary (e.g. monetary, barcode,
contact). Otherwise either using proper escaping internally or doing
nothing should do the trick.

Also update qweb to return markup-safe bytes: we want qweb to return
markup-safe contents as a common use-case is to render something with
one template, and inject its content in an other one (with Python code
inbetween, as `t-call` works a bit differently and does not go through
the external rendering interface).

However qweb returns `bytes` while `Markup` extends `str`. After a
quick experiment with changing qweb rendering to return `str` (rather
unmitigated failure I fear), it looks like the safest tack is to add a
somewhat similar bytes-based type, which decodes to a `Markup` but
keeps to bytes semantics.

For debugging and convenience reasons, MarkupSafeBytes does *not*
stringify and raises an error instead (`__repr__` works fine). This is
to avoid implicit stringifications which do the wrong thing (namely
create a string `"b'foo'"`).

Also add some configuration around BytesWarning (which still has to be
enabled at the interpreter level via `-b`, there's no way to enable it
programmatically smh), and monkeypatch `showwarning` to show warning
tracebacks, as it's common for warnings to be triggered in the bowels
of the application, and hard to relate to business logic without the
complete traceback.

`t-out`
=======

`t-esc` is a bit confusing for the new behaviour of "maybe escape
maybe not", so add a `t-out` alias with the same behaviour.

Unlike `t-raw`, `t-esc` is only soft-deprecated for now: there are
thousands of instances, so editing all the templates is not
great. Eventually we'll add a `ci/style` to prevent addition of new
ones, and eventually we might do a bulk-replace and hard-deprecate.

Attributes handling
===================

There are a few issues with respect to attributes. The first issue is
that markup-safe content is not necessarily attributes-safe
e.g. markup-safe content can contain unescaped `<` or double-quotes
while attributes can not. So we must forcefully escape the input, even
if it's supposedly markup-safe already.

This causes a problem for script-safe JSON: it's markup-safe but
really does its own thing. So instead of escaping it up-front and
wrapping it in Markup, make script-safe JSON its own type which
applies JSON-escaping *during the `__html__` call.

This way if a script-safe JSON object goes through `markupsafe.escape`
we'll apply script-safe escaping, otherwise it'll be treated as a
regular strings and eventually escaped the normal way.

A second issue was the processing of format-valued
attributes (`t-attf`): literal segments should always be markup-safe,
while non-literal may or may not be. This turns out to be an issue if
the non-literal segment *is* markup-safe: in that case when the
literal and non-literal segments get concatenated the literal segments
will get escaped, then attributes serialization will escape
them *again* leading to doubly-escaped content in attributes.

The most visible instance of this was the `snippet_options` template,
specifically:

    <t t-set="so_content_addition_selector" t-translation="off">blockquote, ...</t>
    <div id="so_content_addition"
        t-att-data-selector="so_content_addition_selector"
        t-attf-data-drop-near="p, h1, h2, h3, .row > div > img, #{so_content_addition_selector}"
        data-drop-in=".content, nav"/>

Here `so_content_addition_selector` is a qweb body therefore
markup-safe, When concatenated with the literal part of
`t-atff-data-drop-near` it would cause the HTML-escaping of that
yielding a new Markup object. Normal attributes processing would then
strip the markup flag (using `str()`) and escape it again, leading to
doubly-escaped literals.

The original hack around was to unescape() `Markup` content before
stringifying it and escaping it again, in the attribute serialization
method (`_append_attributes`).

That's pretty disgusting, after some more consideration & testing it
looks like a much better and safer fix is to ensure the
expression (non-literal) segments of format strings always result in
`str`, never `Markup`, which is easy enough: just all `str()` on the
output of strexpr. We could also have concatenated all the bits using
`''.join` instead of repeated concatenation (`+`).

Also add a check on the type of the format string for safety, I think
it should always be a proper str and the bytes thing is only when
running in py2 (where lxml uses bytestrings as a space optimization
for ascii-only values) but it should not hurt too much to perform a
single typecheck assertion on the value... instead of performing one
per literal segment.

Note: we may need to implement unescape anyway, because it's still
possible to get double-escaping with the current scheme: given an
explicitly escape-ed `foo` and `t-att-foo="foo"`, `foo` will be
re-escaped.

fixup! [CHG] core, web: deprecate t-raw
2021-04-29 05:34:19 +00:00
Xavier Morel 4bcbf47cfa [FIX] web: web client boot when user has not apps available
This mostly an issue when trying to run just the tests of `web` (aka
`-iweb`) with only community modules available,
`TestMenusDemoLight.test_01_click_apps_menus_as_demo`, wait for the
ready code times out:

    AssertionError: False is not true : The ready "odoo.isReady === true" code was always falsy

and the test suite fails.

The ready code simply checks that `odoo.isReady` is set. The web
client sets `isReady` when `webclient_started` is
triggered (specifically in `_onWebClientStarted`, which is the handler
for that event).

[The community web client only triggers `webclient_started` at the end
of `doAction`][0] meaning the community client is considered ready
until after the first action has executed.

[The first action is executed by `show_application`][1] whose process
is the following:

1. load and initialize the menus
2. if an action is specified in the URL, run that
3. otherwise if the user has a home action, run that
4. otherwise run the first menu's action

When installing only `web`, the only menus which could be available
are Apps and Settings, and the demo user has access to neither. This
means the demo user has no applications, and opening the first app is
a no-op ([`openFirstApp` has a case just for that situation to ensure
it does nothing][2]). As a result, `webclient_started` is never
triggered, `_onWebClientStarted` is never called, `odoo.isReady` is
never set, and the tour never runs.

Fix by updating `openFirstApp` to return *whether* it opened an
application, and in `show_application` the last fallback if even
opening the first application failed is to just declare the web client
ready.

While at it, rewrite `show_application` using ES6 facilities and
flatten and linearize it using guards. This means the code pretty much
tracks the process described above, with one step added:

5. otherwise complete the webclient's startup

[0]: https://github.com/odoo/odoo/blob/1eb474243b55f1b9e10c70d199bbe022e68b51d0/addons/web/static/src/js/chrome/action_manager.js#L174

[1]: https://github.com/odoo/odoo/blob/d1c56ec7c435c5baba8604feccc6116e4c25ca96/addons/web/static/src/js/chrome/web_client.js#L77-L107

[2]: https://github.com/odoo/odoo/blob/e24ab17d38fb049404f04112990e8b2fe1dd7727/addons/web/static/src/js/chrome/apps_menu.js#L44-L46

closes odoo/odoo#70039

X-original-commit: a5b2146404da9ea0cd4752a21dcd230140822c86
Signed-off-by: Xavier Morel (xmo) <xmo@odoo.com>
2021-04-28 14:52:56 +00:00
Aaron Bohy b592d119e5 [FIX] web: make test pass on chrome 90
The changed test uses the drag&drop helper, and an operation does
not work as expected with the given params on chrome 90. The runbot
currently uses chrome 80, so it is not an issue, but if your chrome
is up-to-date, and you try to run the test suite, this test would
fail.

closes odoo/odoo#70032

X-original-commit: 43994da9980e4133274984f720bb58f3546ea0f9
Signed-off-by: Géry Debongnie (ged) <ged@openerp.com>
Signed-off-by: Aaron Bohy (aab) <aab@odoo.com>
2021-04-28 14:35:07 +00:00
Nicolas Bayet 9c2197a896 [IMP] web: add trigger in FormViewDialog 2021-04-28 07:34:43 +00:00
Antoine Guenet 639e19ff64 [FIX] web: limit mouse events on colorpicker to its own document context
When the colorpicker is in an iframe, listening to mouse events on the
global document can have unexpected effects. Namely clicking in the
colorpicker, then moving the mouse outside the iframe made it move the
color cursor.
This fixes that by binding it to the parent widget's document, with a
fallback on the global document in case it's missing.

closes odoo/odoo#69877

X-original-commit: 4fb33f7f8d6955a44fbb7c94c7d204e9baa09707
Signed-off-by: David Monjoie (dmo) <dmo@odoo.com>
2021-04-27 07:14:15 +00:00
Sébastien Theys 6855cc3d2c [FIX] web: prevent test_menus loading DiscussWidget if no mail module
Follow up on bd67479316

This test file is not respecting Odoo module dependencies.

If the module is not defined, calling `[Symbol.for("default")]` will crash.

Old require system didn't have this syntax, the similar guard was done just
before using the class.

closes odoo/odoo#69845

Signed-off-by: Xavier Dollé (xdo) <xdo@odoo.com>
2021-04-26 13:37:05 +00:00