When printing the online quote, using the "Print" button
in the online proposal in the front-end, the user
used to print the report is the SUPERUSER.
If `doc` or `o` is not set within the QWeb values,
the headers printed are the ones from the user company,
instead of the record company.
As this was the case in the `website_quote` report,
the company headers printed were not the sale order company
headers, but the SUPERUSER company headers.
opw-666306
On website_quote, according to the translation, the label may become much larger than
the button width. By default the bootstrap btn class has the property 'white-space: nowrap'
Here the goal is to add a class which will be used for these kind of cases.
The old api on_change_product_id function in model 'sale.order.option'
doesn't receive the order_id to compute correctly the price unit for
suggested products. The new api _onchange_product_id function has exactly
the same logic as on_change_product_id and this function receives the order_id.
Then the new one can replace the old one. But to keep the compatibility with partners
who overwrite this old function, it is kept in the code.
This bug was introduced by 5047f4e, this commit defined the product_uom_change function
which called on_change_product_id. This commit was applied in saas-6.
The onchange calls in the views have be removed because all the new api onchange are called
even if they were still there.
opw:656494
Commit 7636b51 modifies the route from JSON to HTTP by mistake. Indeed,
the route /quote/accept is called from an ajax.jsonRpc request, not from
the `method="POST" t-attf-action="/quote/accept` which can be found in
website_quotation.xml.
The t-attf-action is actually only used to recover the order_id and the
token in website_quotation.js.
opw-652874
Closes#9227Fixes#9226
Before this fix, it was possible to validate then cancel a quote (or the other way around) simply by using two tabs in your browser. From now on, we only validate/cancel a quote if it's the 'sent' state and advise the customer of the situation if he tries to abuse the process.
* make CSRF protection the default on all non-SAFE methods
note: there currently is no way to call a CSRF-protected endpoint
without a form-encoded entity-body as that's the only place we get the
CSRF token from.
* simple CSRF token generation: just use the HMAC'd session id, no
generating a new random token per session then HMAC it
* use constant-time equal function to avoid timing attacks
* assert that a database secret is configured before hashing/validating
the CSRF token
* opt-out database manager from CSRF: The super-admin password serves
the purpose of a CSRF token in the database manager screens.
There is no request database to obtain the
secret and generate a CSRF token.
f26b94f had as goal to filter the taxes of the product
according to the company when the sale.order
was created/edited as SUPERUSER_ID
(Who ignores the record rules).
Unfortunetaly, to filter the taxes,
it used the company of the customer,
while it's actually the company of the order which
should be used.
Indeed, for instance,
partners can be shared among all companies.
It was way less simple to access the company
of the sale.order, this parameter being
not available in the on_change method signature.
This is the easiest way to solve this issue
without breaking the API / retro-compatibility.
opw-647819
Note: This is a custom version of the lib which allows to
enable/disable the signature area and which introduces the
compatibility with IE + bug fix of the official version.
In view inheritance, selecting an element based on the attribute `string` is
broken, since this attribute may be translated before the inheritance is
applied. This fixes existing views to avoid such selections.
Use the lang from the sale order's partner when updating suggested
product line. To achieve this, the onchange has been replaced by an
onchange of the new api which gives access to all the fields.
closes#7268
opw-643098
Until now, you could only sign and confirm a sale order from the frontend.
From now on, you can also pay sale orders if the 'Immediate Payment'
option is checked on the sale order.
Dhaval Panchal