If there are too much users to show on the page and to avoid performance
issues, a pager is now applied on the all users page.
A new pager based on website_pager is added in order to ease the navigation
through the potential high number of pages. 'Go to first page' and 'Go to last
page' buttons have been added and the design of the pager have been adapted
to be more integrated into the new eLearning platform.
Also add the pager on the slide page if search category is applied. The pager
was already computed in the controller but not displayed.
Task ID : 1946160
PR #31697
This commit e84779749b factorize the check of
special access to post a message using a token mecanism, but it breaks the
case without token. Indeed, on some models, it is allow to post a message
on a document when having a certain access. This is handle with the
`_mail_post_access` attribute on model inheriting mail.thread.
Using this mecanism, a user that can read (or write) the document can also
post a message. This is used in the eShop to review product and in blog to
comment blogpost.
This commit restore posting a message without token. the normal access rights
will be applied by message post and raise if the user can not post message,
taking `_mail_post_access` into account.
The balance is now restored in the universe.
Task-1902304
Add a new widget for binary fields. It open a dialog box and the user can sign manually,
or an signature can be draw automatically or he can upload a picture of his signature.
Move fonts, controller, scss,templates about signature from portal to web to avoid redundance
closesodoo/odoo#30222
To post a comment with a signed token, we compare tokens with the pid.
The token is signed with the pid, which is an integer. When checking
access, we compare the token with a pid as char. Obviously, the comparison
failed, and posting the message is refused, as the 2 'pid' does not
share the same type.
This commit cast the recieved 'pid' into an integer before checking
special access.
closesodoo/odoo#30906
When a portal user post a message to review a channel, we
want to allow him to edit its own comment and rating.
This commit modifies the special check access method in
portal to extract the security check and reuse it to
allow user to update its comment on slide.channel only.
We decided to reuse existing widget (new rating popup
composer) to do the message modification.
Task-1902304
Before this commit, it was possible to post a message on a document
the user has no access, thanks to a token. In addition to this token,
if a hash (signed token with a partner id), the author_id of the message
was forced.
This commit change a little bit that logic by distinguish 2 cases:
1/ Token only: anyone with the token can post a message on the document. If
the user is not logged (public with token), the author_id will be the
customer of the document (or the public user). This case is moslty used
for business document, through the portal or with the "share link" for
instance.
2/ Signed token: user has no write access to the document, but can post a
message on it. The user have to be logged, as the token is signed with its
identifier. The goal here is to avoid leaking the access token's document
to all visitors. This case is mostly used for public content, such as blog
posts, slides, ...
The token case was already existing. The second is now working with this
commit. To do so, it was required to
- move `_sign_token` from the portal mixin to mail.thread.
- transfering 'pid' and 'hash' parameters from the controller to template
to js widgets.
This commit also change the `_message_post_helper` signature by making
the 3 first parameters required, as to post a message you need at lease
res_model, res_id and the message body. The optional argurments and kwargs
are here to check the bypassing access rights mecanism.
Task-1902304
Purpose
=======
The goal is to avoid duplicate code between portal and sign (enterprise), and
also to allow the user to use the signature mode 'auto' and 'load' in portal
(before this commit only 'draw' was available in portal).
The sales order signature (currently the only portal signature) has been changed
to use this new code.
This signature widget has been improved:
Improved style:
- better structure and use of BS classes
- removed most of custom CSS
- made it more responsive
Changed code to follow guidelines, added JSDoc.
Technically
===========
New widget NameAndSignature common to portal and sign (enterprise).
Reworked existing portal signature form to use new widget.
Related to enterprise PR https://github.com/odoo/enterprise/pull/3266
task-1894903
closesodoo/odoo#29453
When fetching messages from the portal controller, we might
give a domain to restrict the message selection. Typically,
the ecommerce allows users to submit messages with rating
of the product. Users are allowed to filter the messages
with a certain rating.
Passing a non-normalized domain to this controller could
give strange result, as the code was using `+=` to concat
domains; some result domain could have been correct, but
return some strange results.
This commit normalizes all domains used in the code
making a non-normalized domain (given as parameter) crashes,
instead of returning unexpected messages.
Closes#26939
The goal of this commit is to fix the various views and reports of sales and invoices.
======
Portal
======
Fix breadcrumbs
Fix BS4 issues, alignment of various elements
Better auto resize of the invoice iframe
Fix invoice list for draft invoices
Fix previous/next document pagers
Remove unnecessary monetary widgets (not needed when using t-field if the field is Monetary)
Standardize invoice and sale routes:
- especially when related to displaying: html, pdf (print and download), text
- by using the get_portal_url() also for invoices
Add the total on the left column of sales order
================
Section and note
================
Improve general style:
- notes in italics
- sections: less padding, darker background, no borders
=========
Demo Data
=========
Fix sales order demo data to appear for the admin (instead of system)
PR: #25997
task-1869469
Before this commit, the method _document_check_access would succeed if it was called with a non-existing id.
Now it will raise a MissingError.
PR: none
Task: none
Purpose
=======
- Quickly share the url to someone else (a client, a colleague,...)
- Ensure that the recipient can access at least
the portal view of the shared record.
- Typically used when a client cannot retrieve the mail to access his order.
The share link can be used in this case.
Specifications
==============
For any object inheriting form portal.mixin:
- Add a button SHARE (not visible in edit mode)
- When clicking on this button, a popup opens with :
- A warning message for tasks and projects only (see below)
- the link (like in gmail) that can be copied
- Recipients
- mail composer (with preselected template) ==> see below
- button [Send Link] [Copy Link] Discard
- After sharing document, put internal note like
"Document shared to xyz,...." with template message
- Anyone with the link, even anonymous user (not logged in) can have access
to the document with the access token provided in the url.
Impacted models:
- account.invoice (Community)
- project.project (Community)
- project.task (Community)
- purchase.order (Community)
- sale.order (Community)
- helpdesk.ticket (Enterprise)
Warning messages and access rules:
Allowed :
- SO canceled or draft will be accessible with the link
with access_token
- If the customer account is B2B (signup not enabled), the recipient
will anyway see the document as the user specifically wants the
recipient to see the document.
Restrictions :
- For Project and Task, if the privacy is not public, then, there is a
contradiction between the access_token mechanism
and the privacy of the document.
- A warning message will be displayed in the share wizard to inform the
user if the document cannot be visible by the recipients and to
ask him to set the privacy to 'Visible by following customer'.
The send button will, in that case, be hidden.
- To avoid to block the share for a new project, default privacy value
is now set to 'Visible by followong customer'
Technical implementation
========================
- Move the access_token mechanism (field + methods + mail controller)
to the portal.mixin to be able to use it in a generic way for each object
inheriting the portal.mixin
- Generalise a part of the _*model*_get_page_view_values method
into a single one in portal
- Generalize the _*model*_check_access into the portal controller of the
portal module
- Remove the init_column + default value for the access_token
> old records have an access_token,
> new one won't but it will be generated on demand via the get_access_token
Done for performance reasons
- Add share button into action menu separately. + kanban view context menu
(except for task and project where button not in action menu but 'simple'
button for task and project because other modules already provide action
to send documents by email, which is not the case for project and task.)
- Add a sign_token used to authentify the recipient in the portal view chatter,
if any. The message will be posted as if the user was logged in.
- Set the _get_share_url as private for security reason
- Add a redirect parameter to _get_share_url to get
If false : The direct portal view url
If True : The redirect url (mail/view/?)
- Cleaning up unnecessary code
- Bug fix :
- Before, if user was not logged and record had partner_id,
if partner id was null, post message was done as admin.
Now, the post message is done as public user.
- If the user had an uid but had no access_token, he could be able
to gain the access token of the record.
check_access_rights was missing in the get_access_action.
Task ID : 30985
Closes#25629
Have the main company (A) with the public user
Have an invoice in company B
Make a brand new browser access the invoice with the token
Before this commit: the token link ended up asking the customer to login,
eventhough it wouldn't if the invoice were in company A
After this commit: the whole payment with access token flow works as expected.
OPW 1879999
closes#26744
In bd4f09f there was a typo in the domain portal message fetch (two `&`
instead of one), luckily this did not cause an error in 11.0
But in master expression.AND normalizes the domain, thus we got an error.
opw-1819702
closes#25131
web (tagged with `openerp-web`) translations are loaded in the backend, in
`odoo.addons.web.controllers.main.WebClient.translation(mods=None, lang=None)`
method (through `/web/webclient/translations` controller).
In website, the controller `/website/translations` is called used, fetching
the translations from modules with the (fragile) clause `name ilike 'website'`
This commit fixes two bugs:
1. Install `website_sale`, activate discussion on products
-> the chatter is not translated as the portal translations not loaded in the
`/website/translations` controller
2. Install `helpdesk` but not `website`, go to portal view of a ticket
-> the heldesk chatter is not translated as the `/website/translations`
controller is not called (only provided by the website module)
This patch implements a modular approach to translate the web resources of the
right modules only.
The controller /website/translation is moved to http_routing and each module
override the new _get_translation_frontend_modules_domain method to adds its
translatable module
Closes#23618Fixes#23610
This commit prevent VAT and company name edition if an user has already at
least one document (SO or invoice) for his partner or his related company
partner.
Any module can override this feature to add their own condition to prevent
campany name/VAT edition.
task-33088
Closes#23420
In the frontend only plaintext is saved without any javascript fiddling
so in the controller it should be adapted to be saved.
With this change, the behavior is more similar to backend chatter which
sends html (processed by javascript) to the server.
opw-1817918
closes#23706
When a chatter is displayed and the document is accessed with a valid
access_token, the message related to the document are searched in sudo.
This bypass valid filtering we may down the line.
This change apply the filtering so note type messages are not displayed
for user who are not employees.
note: before 11.0 this logic was in 1b5c2ced. In future version it would
probably be better to have a method eg. _get_domain_based_on_user
that would be called before sudo and if not sudo.
opw-1819702
closes#23544
Redirections are not correctly computed when the error or success urls
already contain some query parameters, like the access token. We now
use a function added in portal module that correctly computed the
redirection using standard werkzeug methods.
After removing the `sha_in` params a while ago, we get rid of
the deprecated `token_field` option.
- Make `token_field` a model attribute, so that each model can easily
define the token field that should be used, and it does not need
to be passed around all the time anymore.
- Rename `_special_access_object()` to `_has_token_access()`, much more
readable since it returns a bool
- Do not forward the `attachment_ids` keyword arg to message_post,
as it sometimes contains unrelated IDs (the helper is not meant
to post attachments anyway)
- Update callers accordingly
Original commit e38de9dfa4 is about CSS classes and state code
update. It is not clear why hiding Your Details in some cases improve the
state code update. Forward port 017ee5eab3 broke the customer portal
display using this condition. This commit fixes the customer portal by
removing the condition.
Second part of the original fix that was about using a correct base layout
to render the your details page is already done in master since the
customer portal cleaning.
This commit moves the whole customer portal to the portal module.
It now completely uses portal and http_routing features and is not
dependent on website anymore.
An override of web controller is added in portal in order to redirect
portal users to /my instead of /web. That way once having the customer
portal installed all share users are correctly redirected to their
account.
All modules defining customer portal templates and controllers are
updated accordingly.
As customer portal will be moved to portal module support of pager
has to be moved previously to the various portal moves. This commit
moves the pager code and template to portal.
Compatibility using website-based pager is provided to avoid having
to update all website addons currently. Future commits will make
addons use the portal pager instead of website pager.
This module adds required base code for a fully integrated customer
portal. It contains the base controller class and base templates.
Business addons will add their specific templates and controllers
to extend the customer portal.
This module contains most code coming from odoo v10 website_portal.
Purpose of this module is to allow the display of a customer portal
without having a dependency towards website edition and customization
capabilities.
Some CSS files used in frontend assets are already moved to have a
working portal skeleton. A is_public method on users is also added
as it will be used in various portal code soon.
David Beguin