* The compiled templates are cached per user, lang, inherit context values
* ir.ui.fields: attributes method return an dict, and record_to_html return only the content value of the field
* all rendered text use build_text and all attributes use build_attribute
* t-esc-options is removed and replace by format_value method
* AssetsBundle receive the list files and remains
This commit adds controller to list documents of customer, with pager and archive
widget to sort documents. Impacted documents are : quotations, sale order,
invoices, and issues.
Portal breadcrumd is improved too : add the home icon, and keep the query
params when using archive widget.
Some editable zones were added to templates, allowing people to customize
their frontend portal.
On website_quote, according to the translation, the label may become much larger than
the button width. By default the bootstrap btn class has the property 'white-space: nowrap'
Here the goal is to add a class which will be used for these kind of cases.
Commit 7636b51 modifies the route from JSON to HTTP by mistake. Indeed,
the route /quote/accept is called from an ajax.jsonRpc request, not from
the `method="POST" t-attf-action="/quote/accept` which can be found in
website_quotation.xml.
The t-attf-action is actually only used to recover the order_id and the
token in website_quotation.js.
opw-652874
Closes#9227Fixes#9226
Before this fix, it was possible to validate then cancel a quote (or the other way around) simply by using two tabs in your browser. From now on, we only validate/cancel a quote if it's the 'sent' state and advise the customer of the situation if he tries to abuse the process.
* make CSRF protection the default on all non-SAFE methods
note: there currently is no way to call a CSRF-protected endpoint
without a form-encoded entity-body as that's the only place we get the
CSRF token from.
* simple CSRF token generation: just use the HMAC'd session id, no
generating a new random token per session then HMAC it
* use constant-time equal function to avoid timing attacks
* assert that a database secret is configured before hashing/validating
the CSRF token
* opt-out database manager from CSRF: The super-admin password serves
the purpose of a CSRF token in the database manager screens.
There is no request database to obtain the
secret and generate a CSRF token.
Note: This is a custom version of the lib which allows to
enable/disable the signature area and which introduces the
compatibility with IE + bug fix of the official version.
Until now, you could only sign and confirm a sale order from the frontend.
From now on, you can also pay sale orders if the 'Immediate Payment'
option is checked on the sale order.
* add on_change_uom behaviour to quote templates lines
* fixes frontend layout issues
* use action_button_confirm instead of signal_workflow
when confirming the quote in the frontend to trigger
all events properly
* adapt prices using pricelist on onchange_template_id
on sale orders
When displaying a field, it is usually preferable to use the 't-field' qweb tag
to avoid access problems: the name_get is automatic so you don't need to access
the model sub-field (in this case, you don't need to access the res.partner name)
Christophe Matthieu