Commit Graph
6562 Commits
Author SHA1 Message Date
Sébastien Theys c6716847aa [IMP] web, *: clean up notification API
task-2476867

closes odoo/odoo#67009

Related: odoo/enterprise#16760
Signed-off-by: Sébastien Theys (seb) <seb@odoo.com>
2021-05-27 13:47:23 +00:00
nie 3b5bef08ad [FIX] website: remove non-fictional number from templates
Steps:
- Go to Website
- Click "Go to Website"

Bug:
The default phone number on the website is not fictional and may cause
unwanted spam.

Explanation:
In North America, only 555-0100 through 555-0199 are specifically
reserved for fictional use.
> The industry also reserved a block of 100 numbers as fictitious,
> non-working numbers (555-0100 through 0199) for use by the
> entertainment and advertising industries.

Source: https://www.nationalnanpa.com/pdf/NRUF/ATIS-0300115.pdf

opw:2530388

closes odoo/odoo#71341

X-original-commit: 37be09d7d73bd4942396f06f5b5cfa22cca78f56
Signed-off-by: Nicolas Lempereur (nle) <nle@odoo.com>
Signed-off-by: backspac <backspac@users.noreply.github.com>
2021-05-27 13:25:20 +00:00
Younn Olivier 8be18ae0a0 [FIX] website: override footer company name in a separate template
The footer company name override from the website is done in a separate
template from website.layout in order to avoid duplicating it when
edited.

Related to https://github.com/odoo/odoo/pull/69943
task-2468472

closes odoo/odoo#71307

Signed-off-by: Quentin Smetz (qsm) <qsm@odoo.com>
2021-05-27 06:39:09 +00:00
Sébastien Mottet (oms) b8e336aaae [IMP] website, *: change configurator palette selection
*: web

This commit brings some functionnal changes to the palette selection
screen:

- The list of suggested palettes does not depend on the uploaded logo
anymore. It is now a fixed list of 20 palettes manually chosen among the
existing ones.

- The recommended palette is not chosen among the existing palettes
based on the logo's extracted colors anymore. The recommended palette is
now a fully custom palette generated based on the two main colors
extracted from the logo.

- The selected palette has a border to indicate it is the currently
selected palette.

task-2518565

closes odoo/odoo#71268

X-original-commit: 23dee47ed51d0dfa54f68ef4b328aba957589bb9
Signed-off-by: Quentin Smetz (qsm) <qsm@odoo.com>
2021-05-26 15:14:43 +00:00
Younn Olivier 507408e8e1 [FIX] web, website: display default company name on frontend layout
Before, the "Company name" placeholder was hardcoded in the frontend
layout template, and the user had to change it with his company name
from the website view, which was not user-friendly if the website module
was not installed.

Now, by default, the frontend layout template displays the user's
company name. If the website module is installed, it is editable.

task-2468472

closes odoo/odoo#71176

X-original-commit: 059804be90021559debee6f930462594a3ca8a97
Signed-off-by: Jérémy Kersten (jke) <jke@openerp.com>
Signed-off-by: Quentin Smetz (qsm) <qsm@odoo.com>
2021-05-21 16:56:11 +00:00
Younn Olivier 7287ce5355 [FIX] website: fix menu button edition
The content of the button was not changed after editing a menu button.

Part of https://github.com/odoo/odoo/pull/70150
task-2513588

closes odoo/odoo#71177

X-original-commit: 727c39db1a28c6539044f230ceb70d80ca05b8de
Signed-off-by: Jérémy Kersten (jke) <jke@openerp.com>
2021-05-21 18:09:38 +00:00
Younn Olivier bcd172d515 [FIX] website: fix MenuEntryDialog linkWidget dependencies
MenuEntryDialog linkWidget dependecies were overwritten instead of
extended.

Related to https://github.com/odoo/odoo/pull/69183
Part of https://github.com/odoo/odoo/pull/70150
task-2513588

X-original-commit: bd5b32f9064f9d3f32548fa9b421bbba070ed453
2021-05-21 18:09:36 +00:00
Sébastien Mottet (oms) 4900cee8a8 [FIX] website: launch action todo on website creation
When website is installed through CLI, the ir.actions.todo
'website_configurator_todo' is not launched and stays in
'open' state. In this case the FIRST time we create a new
website, this ir.action.todo is launched at the end of the
configurator wheter it fails or not.

- If configurator fails, the ir.actions.todo is returned
  by button_choose_theme when choosing a theme in the
  theme_view_kanban view. /website/configurator is called
  and since configurator_done was not correctly set to true
  on current website, the screen theme_view_kanban was
  rendered a second time.

- If configurator succeeds, the ir.actions.todo is returned
  by button_choose_theme in configurator_apply. The route
  /website/configurator is called a second time and since
  configurator_done is set to true the route redirect to the
  website homepage but not in edit mode.

The fix consits in correctly setting configurator_done in
configurator_skip and in launching the configurator through
the ir.actions.todo in create_and_redirect_configurator.

closes odoo/odoo#71148

X-original-commit: 1752548fabc9b184b5b67b659b505c4cfe8dc0c7
Signed-off-by: Jérémy Kersten (jke) <jke@openerp.com>
2021-05-21 13:45:26 +00:00
Mohammed Shekha ccc56e28a3 [IMP] *: replace fa-spinner with fa-circle-o-notch
Slightly improve the overall UI of Odoo with a more modern feel by updating the
current 'loading' icons that look quite old school.

Use fa-circle-o-notch instead of old style fa-spinner

task-2346142

closes odoo/odoo#59454

Related: odoo/enterprise#13908
Signed-off-by: Aaron Bohy (aab) <aab@odoo.com>
2021-05-21 11:48:32 +00:00
yograj tandel e893651cec [IMP] *: remove widget='selection' from many2one fields
Currently, across Odoo, there are around 40+ many2one fields defined with a
'selection' widget. Since the many2one widget has options to limit record
creation and opening, there is no reason to define a many2one field with a
selection widget. The selection widget does not allow for searching, and is
limited to 100 records.

PURPOSE
to update the definition of any many2one on which we applied a 'selection'
 widget, and instead use the standard many2one widget with disabled
opening/creation instead.

after this commit,
for each many2one field defined with widget="selection",  widget="selection" is
replaced with options="{'no_open': True, 'no_create': True}"

Task : 2476488

closes odoo/odoo#68387

Related: odoo/enterprise#17316
Signed-off-by: Aaron Bohy (aab) <aab@odoo.com>
2021-05-20 11:01:28 +00:00
Sébastien Mottet (oms) b909911e15 [FIX] website: correctly set accordion ids
data-parent fields were set on tab link and not on the tabpanel
div. It prevented the accordion of having the right behavior:
closing all the other tabs when a tab is clicked to be opened.

closes odoo/odoo#71001

X-original-commit: 51c868bd9bfcd9a7e81f386b0c889befa5dd6e20
Signed-off-by: Jérémy Kersten (jke) <jke@openerp.com>
Signed-off-by: Sébastien Mottet <smottet@users.noreply.github.com>
2021-05-18 16:59:04 +00:00
Sébastien Mottet (oms) 662b53f9b0 [FIX] website: ids in xml for accordion rendered by configurator
accordions in pages created by configurator have not been
added by a drag'n'drop. onBuilt is therefore not called and
attributes (data-parent and id for tabpanel and data-target
for tab) are not set. We set these attributes directly
in the xml to make accordions work also for configurator.

closes odoo/odoo#70974

X-original-commit: 887f6d539ebf4f3a6d95f44f2cdd4152b59d5910
Signed-off-by: Jérémy Kersten (jke) <jke@openerp.com>
2021-05-18 11:57:52 +00:00
Antoine Guenet 987fc1190a [FIX] website: prevent editing snippetless website and show message
When starting work on a blank website, it was possible to start writing
text in the blank page. However that was never the purpose and things
behaved improperly from there.

This commit addresses that problem by consistently applying
contenteditable=false to the #wrap element when it is empty, and true
when it isn't.

At the same time it fixes the fact that starting with a non-empty page
and making it empty failed to show the empty editor message.

closes odoo/odoo#70933

X-original-commit: c9ab6ae3e1e1859c36a4f6e68a7cae25cf92a7b3
Signed-off-by: David Monjoie (dmo) <dmo@odoo.com>
2021-05-18 08:11:47 +00:00
Antoine Guenet 3e76664d49 [FIX] web_editor, website: properly record history on col count change
When changing the number of columns of a snippet, the history was
recorded too many times and at wrong moments, resulting in a mess of
undos to trigger before restoring the original column state.
The issue was due a combination of dead code and the fact that
`_updateColumnCount` triggered `remove_snippet` for each of its columns
while `remove_snippet` in turn triggered a history step at every
execution.
This fixes it by removing the dead code, replacing it where necessary
with a call to the editor's `historyStep` method, and adding an option
to `remove_snippet` so its triggering of a history step can be bypassed.

closes odoo/odoo#70932

X-original-commit: 877e5c807087afed880aeba3eab79def3a7b583c
Signed-off-by: David Monjoie (dmo) <dmo@odoo.com>
2021-05-18 08:11:26 +00:00
Antoine Guenet 231871ef98 [FIX] website: prevent out-of-bounds url autocomplete in linktools
Since the link tools were moved from the modal to the sidebar, the url
autocomplete dropdown stretched out of the bounds of the window.
This fixes that problem while restyling the dropdown to look like the
url pickers we already have in the sidebar. In order to achieve that,
we apply to it the "o_website_ui_autocomplete", used by
UrlPickerUserValueWidget (to which we don't have access in the toolbar).

closes odoo/odoo#70931

X-original-commit: 704583aad98287adac9e13772cfb8ca0933b0a32
Signed-off-by: David Monjoie (dmo) <dmo@odoo.com>
2021-05-18 08:09:25 +00:00
Victor Feyens 0348b95aee [FIX] *: update documentation links
Following the recent reorganisation of the documentation in 12.0+,
the majority of the documents have been moved and their old links are no longer valid.
Some redirection rules will soon be deployed, but those rules might be dropped in some years
and we want the links to still work, which is why we still replace the links to the new ones.

FW-Port of odoo/odoo#70675 (13.0)

closes odoo/odoo#70920

X-original-commit: bc9c1eef538ba6095e74c19d5d9ed9e01625ec7c
Related: odoo/enterprise#18361
Signed-off-by: Victor Feyens (vfe) <vfe@odoo.com>
2021-05-17 19:26:27 +00:00
Florent de Labarre 1e764eb2b2 [FIX] website : prevent bad query
In database with front end, there are lot of bad query like this:
bad query: UPDATE "website_visitor" SET "timezone"='Europe/Paris',"write_uid"=116,"write_date"=(now() at time zone 'UTC') WHERE id IN (15414)

closes odoo/odoo#70709

Error: Could not serialize access due to concurrent update
X-original-commit: d0db984990679a63714ca62e6b605d94af7d5c28
Signed-off-by: Thibault Delavallee (tde) <tde@openerp.com>
2021-05-12 07:25:22 +00:00
Sébastien Mottet (oms)andStefano Rigano 5a2f7a46cf [FIX] website: remove outerText and fix design flaw in configurator
- outerText is a non-standard feature. It is not
  supported by firefox and should not be used. This
  commit replaced it by value.

- The design of the industry selection screen had
  a misalignment flaw on firefox. This commit fixed
  it.

- The industry selection used a <i/> element instead
  of an <input/>.

closes odoo/odoo#70694

X-original-commit: 2dbbb4e38d603cbb5956fa61040a9497f60c3349
Signed-off-by: Quentin Smetz (qsm) <qsm@odoo.com>
Co-authored-by: Stefano Rigano <sri@odoo.com>
2021-05-11 15:18:23 +00:00
Martin Trigaux 41d8b8cf68 [I18N] *: export saas-14.3 source terms
closes odoo/odoo#70673

X-original-commit: bcb9ff784e44462384b0a43a0a23eed7a1111bc5
Related: odoo/enterprise#18269
Signed-off-by: Martin Trigaux (mat) <mat@odoo.com>
2021-05-11 12:28:28 +00:00
Romain Derie 89abece02d [REM] website: remove leftover code of new editor changes
XML call to this JS part was removed with https://github.com/odoo/odoo/commit/740168ce8d27da3d6a7156d2d79655a898394923#diff-9f41c68ba854940dda3361dc32795e2d7e9fc5b83ef7f8afd35a455b493e9930L441
But the JS was not removed.

task-2502679

closes odoo/odoo#70600

X-original-commit: 31e192a441aa3eac0b2d023d4f7d036a1c3dfeec
Signed-off-by: Quentin Smetz (qsm) <qsm@odoo.com>
Signed-off-by: Romain Derie <rdeodoo@users.noreply.github.com>
2021-05-10 12:29:22 +00:00
dht-odoo 12469ef4d3 [IMP] various: improve the sequence of menu items
- Currently all menus are out of order in app switcher.
- For example, Sales app is 16 menu away from Accounting,
  Social Marketing app is 25 menu away from Email Marketing, etc.
  So, all menus should be reordered.

- This commit will reorder the menus of the app switcher in order to reduce
  the distance between correlated applications,
  and bring the most common apps upward.
- And in this commit we have left gap of 5 subsequent sequence for further new menus.

PR: #69984
TASK ID: 2513082

Related: odoo/enterprise#17989
Signed-off-by: Thibault Delavallee (tde) <tde@openerp.com>
2021-05-07 05:54:18 +00:00
Romain Derie 0381ca4c7f [FIX] website: fix race condition on link popover tour
Attempt to fix race condition:
> Tour edit_link_popover failed at step Change the URL
  (trigger: #o_link_dialog_url_input)

According to the runbot build screenshot from the error [1], when clicking on
the navbar `Home` menu, the previously deleted link on the `<p/>` is not really
deleted.

According to the runbot logs, some extra calls are done to `/`, probably coming
from extra preview calls.
It might be coming from the fact we click on the link itself to exit the right
panel URL edition.

This commit click on a non-link element to exit the right panel URL edition,
avoiding to show a popover for nothing.

[1] See the image on pull request

closes odoo/odoo#70487

Signed-off-by: Jérémy Kersten (jke) <jke@openerp.com>
2021-05-06 15:24:29 +00:00
Romain Derie 77b00d94d2 [FIX] website: don't show advanced tree hierarchy if not debug
The page manager shows an advanced structure if the user has multi website
enabled. It will show specific pages as a child of its generic one.
It is useful to directly understand and figure which pages are 'overiden'.

But it doesn't really makes sense for an end user, which doesn't know there is
actually generic and/or specific pages.

It makes more sense to show that behavior only in debug and not in multi
websites, even more since pages are overiden even in mono website.

closes odoo/odoo#68902

Signed-off-by: Jérémy Kersten (jke) <jke@openerp.com>
2021-05-05 11:56:13 +00:00
Romain Derie 2c8c079c05 [FIX] http_routing, website: prevent crash when using fw in url
Before this commit, the routing map generated and used would be the one from
the website the request is performed, instead of the one from the `fw` website
ID which will be the one we redirect the user to.

This issue was introduced with the routing map by website, be8fc2296b and is
restricted to a single case: a publisher using the website switcher, and it
won't happen on next page naviguation/refresh as the `fw` website id will be
the same as the current website's ID. Thus there won't be any routing map
mismatch.

Step to reproduce:
  - Create a page on website 2, set it as homepage
  - Naviguate to website 1 on '/' url
  - Naviguate to website 2 on '/' url
This will raise a werkzeug error about `EndPoint not iterable`.

----- Technical analysis ------

This is the current flow:
1. `_dispatch()` is setting `website_routing` to `get_current_website()` -> 2
2. `_dispatch()` is calling `_match()`
3. `_match()` is calling `routing_map()` with key = `website_routing`, which
   was set to 2 in step 1.
4. `routing_map()` is calling `_generate_routing_rules()` which generate the
   rules based on `website_routing`, which was set to 2 in step 1.
5. `_dispatch()` authenticate the user by calling `_authenticate()`
6. `_dispatch()` is calling `_add_dispatch_parameter()`, where URL param `fw`
   is forced in session, so `get_current_website()` now return the correct
   `website_id` -> 1

The issue: in order to handle the `fw` URL parameter (step 6.), we need to
check the rights to ensure we can allow the website switch.
To check rights, user need to be authenticated (step 5.), which is done after
generating the routing map (2. & 3. & 4.).
The routing map is generated based on the current website (step 1.)

Step 6 depends of steps 5 which depends of steps 2/3/4 which depend of step 1,
but step 1 should depend of step 6, which is an impossible cycle.

closes odoo/odoo#70397

X-original-commit: 4eb26497a774e934d7e1a6be9f505400fd9e2cdb
Signed-off-by: Jérémy Kersten (jke) <jke@openerp.com>
Signed-off-by: Romain Derie <rdeodoo@users.noreply.github.com>
2021-05-05 11:01:15 +00:00
Jorge Pinna PuissantandSamuel Degueldre f43a0814ae [IMP]*: configuration of ESLint for specific files
This commit will add the needed ESLint configurations on the JS files.
These configurations are added if the JS file uses a different
environment (serviceworker, node, etc) or if it uses a specific global
(google, ace, etc).

Co-authored-by: Samuel Degueldre <sad@odoo.com>
2021-05-04 13:32:49 +00:00
Arthur Detroux (ard) a7ee7f7cb4 [FIX] website: hide cookie bar when entering edit mode
Previously :
Once a user enabled the cookie bar, it prevented him from dropping
snippets in the main area of the page because the focus was on
the cookie bar. Dropping snippets there has a confusing behavior and
might make the user think the editor is broken.

Reason :
The cookie bar has an oe_structure class and takes over the body
if it's not hidden or dismissed. The oe_structure allows to drop
snippets.

Fix :
Hiding the cookie bar when user enters edit mode to avoid dropping
snippets in it by mistake.

task-2477430

closes odoo/odoo#70258

X-original-commit: 8c672662c80d0dfaeb06eedfc7136a68734fbdb3
Signed-off-by: Quentin Smetz (qsm) <qsm@odoo.com>
2021-05-03 12:43:09 +00:00
qsm-odoo 215ae8cadb [FIX] web_editor, *: remove some post new editor dead code
*: website, website_event

Remove some dead code introduced by the new editor merge at [1].

[1]: https://github.com/odoo/odoo/commit/499e8860f194a7eb09a2e224b713a362923d77ac

closes odoo/odoo#70257

X-original-commit: 0a890a353dd89a60fd156f4280d069596b199cc7
Signed-off-by: Quentin Smetz (qsm) <qsm@odoo.com>
2021-05-03 12:36:35 +00:00
Raphael Collet 960cd72774 [REF] core: add method get_currency_field() on Monetary to retrieve it
This replaces the setup of the attribute 'currency_field', which depends
on the presence of other fields on the model, and may therefore vary
from one registry to another.  This is necessary to make monetary fields
shareable across registries.
2021-05-03 12:33:29 +00:00
Raphael Collet 34d6f87d54 [REF] core: put field.depends on registry and make field.recursive explicit
The attributes field.depends and field.depends_context are problematic
for sharing fields across registries, because they depend on the model's
registry class, which may vary from one registry to another.  In order
to make computed fields shareable, we have to move those values away
from fields.

For the same reason, field.recursive should not be inferred, because its
value may depend on the registry, although it is generally not the case.
Moreover, the flag recursive=True is set on a field when field triggers
are determined (on the registry).  A compute method may be called before
the flag is set (if no update has been done yet), and that can lead to
incorrect computations.

This happened in test TestUsers2.test_reified_groups in module 'base'.
The user groups view was apparently determined without the flag being
set, and the view depends on the recursive field 'trans_implied_ids',
which was not correctly computed.

We thus force developers to be explicit about recursive computed fields.
The code now logs a warning when the flag is not set up properly.
2021-05-03 12:33:29 +00:00
Sébastien Mottet (oms) 094c94fcd3 [IMP] website: change some wordings in configurator features screen
Some feature descriptions and titles have been reworded.
A sentence has been added below the title to indicate
that choices made on this screen are not definitive.

Task ID: 2451965

closes odoo/odoo#70252

X-original-commit: 63195ba03ccc1bf40b4682fc7c9aa4a1a55f1e43
Signed-off-by: Jérémy Kersten (jke) <jke@openerp.com>
Signed-off-by: Sébastien Mottet <smottet@users.noreply.github.com>
2021-05-03 11:40:09 +00:00
Samuel DegueldreandTom De Caluwé 2cfb8658bf [FIX] web_editor: fix default shapes not reacting to palette changes
Previously, when toggling on background shapes, they always had the
default colours. In [1] we made it so that when you toggle on a shape on
a section, it would automatically reuse the colors of the surrounding
shapes if any.

Unfortunately, when the "implicit" colors were also the default colors,
they were still marked on the shape, and it got an explicit background
image that would no longer react to changes in the palette.

This was caused by the fact that the call to _getDefaultColors returns
an empty object when the section doesn't already have a shape-container,
this was not a problem before since we were not passing in any colors
when creating the initial shape previously, the the aforementioned
change made it so that we did.

This commit fixes the issue by creating the shape-container before
calling the method that will set the colors on the shape, this way
getDefaultColors works as expected, and the colors are not marked on the
section when they are the default ones, restoring the ability of the
shape colors to adapt to the palette

[1]: https://github.com/odoo/odoo/commit/875aca63f7dab287c61485ebe999b3b8dd89d91c

task-2500607

closes odoo/odoo#70054

X-original-commit: 63acc2b0d1957dedd40af2033722f9ea4ef2e597
Signed-off-by: Quentin Smetz (qsm) <qsm@odoo.com>
Co-authored-by: Tom De Caluwé <tdc@odoo.com>
2021-05-03 09:27:44 +00:00
Nicolas Lempereur 1f14a6b8ed [FIX] website{,_livechat}: 'Website Visitor' translated
Make translation works for "Website Visitor" that was appearing when a
logged-out user open a livechat session.

note: list comprehension has to be removed since translation only search
language in direct calling method closure.

opw-2504461

closes odoo/odoo#70146

X-original-commit: 7d28f32d9be1590764883f4621df04e04c4e1f12
Signed-off-by: Nicolas Lempereur (nle) <nle@odoo.com>
2021-04-30 08:45:00 +00:00
Simon Genin (ges) ecfe85db84 [REF] web: static/src/(img|fonts) => static/(img|fonts) 2021-04-29 07:34:40 +00:00
Xavier Morel db02f776cb [FIX] website: de-raw-ify
Convert `custom_code_*` to `Html` with no sanitization, such that qweb
considers them markup-safe.

`base_popup_options` value comes from a rendered XML body so should
already be safe

raw -> out in the extended website info template, not sure why this
was even raw

Also mark robots_txt as an unsanitized Html field, that's
not *actually* true but it is true enough for our purposes, especially
since the field gets edited through a text-mode wizard.
2021-04-29 05:34:20 +00:00
Xavier Morel 7c54acaebe [FIX] website: remove t-raw from main layout
One was always there, the other was apparently added due to a double
escaping issue.

Seems unnecessary either way:

- Additional_title should always be set via markup, meaning it's
  marked as safe (if necessary).
- The other one is less clear but neither website.name nor
  company.name should contain markup so...

  Trying to repro the issue reported at 1725212, still seems to work
  fine.
2021-04-29 05:34:20 +00:00
Xavier Morel 996cb85c27 [FIX] *: mass replace known t-raws by t-out
* QWeb bodies should be markup-safe so `0` should always be
  markup-safe.
* `head` is qweb-rendered so the same.
* The `json` pseudo-module in qweb templates is `json.scriptsafe`,
  which should be markup-safe.
2021-04-29 05:34:20 +00:00
Xavier Morel e166077cb3 [FIX] base, website: fix entities in tests
`markupsafe.escape` always escapes single and double quotes, and
escapes them to their numeric values rather than symbolic

According to pallets/jinja@f35e28154f,
this is for compatibility with HTML 3.2: the only named entities in
the HTML 3.2 DTD are `amp`, `gt`, and `lt`.

Update tests to match.
2021-04-29 05:34:19 +00:00
Xavier Morel 01875541b1 [CHG] core, web: deprecate t-raw
Add a big fat warning when the qweb compiler finds a `t-raw`.

`t-esc` should now be used everywhere, the use-case for `t-raw` should
be handled by converting the corresponding values to `Markup`
objects. Even though it's convenient, this constructor *should never
be made available in the qweb rendering context* (maybe that should be
checked for explicitely?).

Replace `werkzeug.escape` by `markupsafe.escape` in
`odoo.tools.html_escape`, this means the output of `html_escape` is
markup-safe.

Updated qweb to work correctly with escaping and `Markup`, amongst
other things QWeb bodies should be markup-safe internally (so that a
`t-set` value can be fed into a `t-esc`). See at the bottom for the
attributes handling as it's a bit complicated.

`to_text` needed updating: `markupsafe.Markup` is a subclass of `str`,
but `str` is not a passthrough for strings. So `Markup` instances
going through would be converted to normal `str`, losing their safety
flag. Since qweb internally uses `to_text` on pretty much
everything (in order to handle None / False), this would then cause
almost every `Markup` to get mistakenly double-escaped.

Also mark a bunch of APIs as markup-safe by default

* html_sanitize output.
* HTML fields content, sanitization is applied on intake (so stripped
  by the trip through the database) and if the field is unsanitised
  the injection is very much intentional, probably. Note: this
  includes automatically decoding bytes as a number of default values
  & computes yield bytes, which Markup will happily accept... by
  repr-ing them which is useless. This is hard to notice without `-b`.
* Script-safe json, it's rather the point (though it uses a
  non-standard escaping scheme).
* Note that `nl2br`, kinda: it should work correctly whether or not
  the input is markup-safe, this means we should not need to escape
  values fed to `nl2br`, but it doesn't hurt either.

Update some qweb field serialisations to mark their output as
markup-safe when necessary (e.g. monetary, barcode,
contact). Otherwise either using proper escaping internally or doing
nothing should do the trick.

Also update qweb to return markup-safe bytes: we want qweb to return
markup-safe contents as a common use-case is to render something with
one template, and inject its content in an other one (with Python code
inbetween, as `t-call` works a bit differently and does not go through
the external rendering interface).

However qweb returns `bytes` while `Markup` extends `str`. After a
quick experiment with changing qweb rendering to return `str` (rather
unmitigated failure I fear), it looks like the safest tack is to add a
somewhat similar bytes-based type, which decodes to a `Markup` but
keeps to bytes semantics.

For debugging and convenience reasons, MarkupSafeBytes does *not*
stringify and raises an error instead (`__repr__` works fine). This is
to avoid implicit stringifications which do the wrong thing (namely
create a string `"b'foo'"`).

Also add some configuration around BytesWarning (which still has to be
enabled at the interpreter level via `-b`, there's no way to enable it
programmatically smh), and monkeypatch `showwarning` to show warning
tracebacks, as it's common for warnings to be triggered in the bowels
of the application, and hard to relate to business logic without the
complete traceback.

`t-out`
=======

`t-esc` is a bit confusing for the new behaviour of "maybe escape
maybe not", so add a `t-out` alias with the same behaviour.

Unlike `t-raw`, `t-esc` is only soft-deprecated for now: there are
thousands of instances, so editing all the templates is not
great. Eventually we'll add a `ci/style` to prevent addition of new
ones, and eventually we might do a bulk-replace and hard-deprecate.

Attributes handling
===================

There are a few issues with respect to attributes. The first issue is
that markup-safe content is not necessarily attributes-safe
e.g. markup-safe content can contain unescaped `<` or double-quotes
while attributes can not. So we must forcefully escape the input, even
if it's supposedly markup-safe already.

This causes a problem for script-safe JSON: it's markup-safe but
really does its own thing. So instead of escaping it up-front and
wrapping it in Markup, make script-safe JSON its own type which
applies JSON-escaping *during the `__html__` call.

This way if a script-safe JSON object goes through `markupsafe.escape`
we'll apply script-safe escaping, otherwise it'll be treated as a
regular strings and eventually escaped the normal way.

A second issue was the processing of format-valued
attributes (`t-attf`): literal segments should always be markup-safe,
while non-literal may or may not be. This turns out to be an issue if
the non-literal segment *is* markup-safe: in that case when the
literal and non-literal segments get concatenated the literal segments
will get escaped, then attributes serialization will escape
them *again* leading to doubly-escaped content in attributes.

The most visible instance of this was the `snippet_options` template,
specifically:

    <t t-set="so_content_addition_selector" t-translation="off">blockquote, ...</t>
    <div id="so_content_addition"
        t-att-data-selector="so_content_addition_selector"
        t-attf-data-drop-near="p, h1, h2, h3, .row > div > img, #{so_content_addition_selector}"
        data-drop-in=".content, nav"/>

Here `so_content_addition_selector` is a qweb body therefore
markup-safe, When concatenated with the literal part of
`t-atff-data-drop-near` it would cause the HTML-escaping of that
yielding a new Markup object. Normal attributes processing would then
strip the markup flag (using `str()`) and escape it again, leading to
doubly-escaped literals.

The original hack around was to unescape() `Markup` content before
stringifying it and escaping it again, in the attribute serialization
method (`_append_attributes`).

That's pretty disgusting, after some more consideration & testing it
looks like a much better and safer fix is to ensure the
expression (non-literal) segments of format strings always result in
`str`, never `Markup`, which is easy enough: just all `str()` on the
output of strexpr. We could also have concatenated all the bits using
`''.join` instead of repeated concatenation (`+`).

Also add a check on the type of the format string for safety, I think
it should always be a proper str and the bytes thing is only when
running in py2 (where lxml uses bytestrings as a space optimization
for ascii-only values) but it should not hurt too much to perform a
single typecheck assertion on the value... instead of performing one
per literal segment.

Note: we may need to implement unescape anyway, because it's still
possible to get double-escaping with the current scheme: given an
explicitly escape-ed `foo` and `t-att-foo="foo"`, `foo` will be
re-escaped.

fixup! [CHG] core, web: deprecate t-raw
2021-04-29 05:34:19 +00:00
Romain Derie 7ea3a73c18 [FIX] website: use correct url code to get canonical url
Before this commit, we would compare a lang `code` (used in context) and a lang
`url_code`. For languages where those 2 are differents, the `if` condition
would always be falsy, making the canonical URL impossible to be reached.

Technically, this condition is used to get the translated name of records to
later construct the canonical URL.

Since the canonical URL will be incorrect and unreachable, the whole system to
tell search engine/crawler about translation won't work since no
`alternate/hreflang`[1] will be set in the DOM.

[1] see https://developers.google.com/search/docs/advanced/crawling/localized-versions

--------

Technical explanation:
- italian language `code` = `it_IT`, `url_code` = `it`
- belgian french language `code` = `fr_BE`, `url_code` = `fr_BE`
Install those languages on website as secondary languages.
Translate blog `Travel` to `Voyager` in french and `Viaggi` in italian.
Visiting `/fr_BE/blog/travel-1/post/post-1` will redirect to
`/fr_BE/blog/voyager-1/post/post-1` as it should, and the canonical URL will be
set to that same URL.
Visiting `/it/blog/travel-1/post/post-1` will redirect to
`/it/blog/voyager-1/post/post-1` as it should, but the canonical URL will be
set to `/it/blog/travel-1/post/post-1`.

opw-2486918

closes odoo/odoo#69918

X-original-commit: 733411fe03b924832d6b10cadf93c8fc09cc5802
Signed-off-by: Romain Derie <rdeodoo@users.noreply.github.com>
2021-04-27 12:14:38 +00:00
Sébastien Mottet (oms) f89f17c168 [IMP] website: add data-snippet attribute on rendered snippets
Add the 'data-snippet' attribute on each snippet rendered
by the configurator when building website pages.

closes odoo/odoo#69706

X-original-commit: 7c203eda4210eec7db476aa5ac056150b795b921
Signed-off-by: Quentin Smetz (qsm) <qsm@odoo.com>
Signed-off-by: Sébastien Mottet <smottet@users.noreply.github.com>
2021-04-22 15:02:29 +00:00
Sébastien Mottet (oms) fb5506cad0 [FIX] website: handle configurator images download timeout
The timeout for images download from unsplash is set to
3s. The exception raised when this limit is reached was
not correctly handled.

closes odoo/odoo#69758

X-original-commit: abca5f73c9e2b992f2638341e81bcb01d86872a6
Signed-off-by: Jérémy Kersten (jke) <jke@openerp.com>
2021-04-23 12:13:23 +00:00
Antoine Guenet db420f14e9 [FIX] web_editor, website: ensure editor toolbar doesn't hide dropdowns
A colorpicker in an option positioned above the toolbar in a snippets
menu would be hidden by the toolbar because of the toolbar's z-index.

That z-index is only needed when the editor is in a modal.

The bug this commit fixes only arises when the toolbar is in a snippets
menu.

This applies the z-index only when there is a snippets menu in the page.
To accomplish that we need the "editor_has_snippets" class that the
website module applied to the body. For the sake of harmony within Odoo,
that class is now applied by snippets.editor so that no matter the
module, if there is a snippets bar, the class is on the body of its
document.

closes odoo/odoo#69680

X-original-commit: b1aa9c6093cea918337d5600ff9b16b7dd80de23
Signed-off-by: David Monjoie (dmo) <dmo@odoo.com>
2021-04-22 12:02:31 +00:00
Gorash aa47eda087 [IMP] web: add mode qweb in ace
Add a new parser in the ace for the qweb highlight. This makes it possible
to visualize the qweb tags and the part of code.
Used in the website and in xml fields.

closes odoo/odoo#69609

Signed-off-by: Géry Debongnie (ged) <ged@openerp.com>
2021-04-21 12:15:01 +00:00
Nicolas Lempereur 67f9ce9f51 [FIX] website: allow "Search..." translation
Strings in python expression in 't-att-placeholder' are not translated
automatically.

opw-2467404

closes odoo/odoo#69559

X-original-commit: 8f8d55ee4e773884ab35e11bfd0573d7997f3ad3
Signed-off-by: Nicolas Lempereur (nle) <nle@odoo.com>
2021-04-20 15:17:11 +00:00
Benjamin Vray 079b9556c6 [FIX] website: fix top position of modal
Before this commit, the top position of a modal in website was always
the height of the main menu navbar. Even if the main menu navbar was
not displayed when the user is not logged.

That bug was introduced in 6ef622772f

After this commit, the top position of a modal is the height of the
main menu navbar but only if that navbar is displayed.

task-2507949

closes odoo/odoo#69391

X-original-commit: 00ab01d05b3876c5d926e16b9a5d65ace4df7360
Signed-off-by: Quentin Smetz (qsm) <qsm@odoo.com>
2021-04-19 13:01:46 +00:00
Sébastien Mottet (oms) 61aa892686 [FIX] website: make configurator IAP call failures silent
On initialization, the website configurator makes a
call to an external service (api_website) hosted on
iap-services.odoo.com to retrieve a list of industries.
This call might fail if the external service is done.
This potential failure is now correctly handled:

On '/api/website/1/configurator/industries' call
failure, the configurator is silently skipped and the
user is redirected to the view website.theme_view_kanban

closes odoo/odoo#69465

X-original-commit: 35311608197ec77bafed82505639314ca693fb19
Signed-off-by: Jérémy Kersten (jke) <jke@openerp.com>
2021-04-19 11:30:49 +00:00
Antoine Guenet 138c0ce67e [FIX] website: properly focus an editable zone with a placeholder
closes odoo/odoo#69330

X-original-commit: f355f0ea276a39674842700bc5f22b2a7cbe5790
Signed-off-by: David Monjoie (dmo) <dmo@odoo.com>
2021-04-15 14:57:00 +00:00
Matthieu Stockbauer 69b24e4de1 [IMP] website : review theme kanban descriptions
task-2451868

closes odoo/odoo#68985

Related: odoo/design-themes#461
Signed-off-by: Jérémy Kersten (jke) <jke@openerp.com>
2021-04-19 08:01:28 +00:00
Romain Derie 86cf231bf1 [FIX] web_editor, website: restore link popover behaviors
This commit fixes multiple bugs related to the new link popover edition [1].
Those bugs mostly comes from new editor integration [2] conflicts, as those
where merged almost at the same time and needed a quick fix of rebase
conflicts.

- The navbar & footer link would not load the popover link edition anymore,
  as it was only targetting `#wrap`.
- Double click on links was re-introduced but it was supposed to be gone.
- Tooltip from Edit and Unlink inside the popover remained open after popover
  was closed.
- Some leftover code that were not related to popover but kept during the
  rebase.

[1] Commit 8fcf930a6b
[2] Commit 740168ce8d

closes odoo/odoo#69389

X-original-commit: e13966cc8e04111a9e18a344132546c6baa79fea
Signed-off-by: Quentin Smetz (qsm) <qsm@odoo.com>
Signed-off-by: Romain Derie <rdeodoo@users.noreply.github.com>
2021-04-16 11:28:52 +00:00
Sébastien Mottet (oms) f4eed6547a [IMP] website: configurator changes and adaptations to iap module
The following two points are necessary adaptations for
the correct functioning of the configurator with the
module deployed on iap-services.

- The routes of the api_website module deployed on
iap-services.odoo.com use model converters to retrieve
the industry selected by the user. The configurator
has been updated accordingly. We now use industry id
instead of industry name. Using id instead of name make
record retrieval faster and model converters handle
exception if the record doesn't exist.

- 'homepage' is now added to the requested pages by
the client. Previously, this page was added by the iap
module to the requested pages.

The following two points are changes to the configurator
route handling:

- multilang=False has been added to the route rendering
the configurator in order to avoid having the lang in
the url.

- If no step is specified in the url, the implicit step
is 1. Therefore /website/configurator/1 has been changed
to /website/configurator.

closes odoo/odoo#69370

X-original-commit: b6efa4caf6514484c254869cb2f1965d207e7c65
Signed-off-by: Jérémy Kersten (jke) <jke@openerp.com>
Signed-off-by: Sébastien Mottet <smottet@users.noreply.github.com>
2021-04-16 09:02:09 +00:00