* base, website
An image URL may be like "/web/image/<xml_id>" where <xml_id> is the
xml id of an ir.attachment. In fact, the route does not use the xml_id
but the 'key' field, which is normally equal to the xml_id for standard
attachment. In the context of themes + multi-website, the value used as
an xml_id may refer to a theme.ir.attachment instead of an ir.attachment
and this led to a bug as those must not be used the same way.
The crop route which gets image information is adapted by this commit to
always look for the *current website* *ir.attachment* related to the
given xml_id/key.
Thanks to @kig-odoo for spotting the issue.
Closes https://github.com/odoo/odoo/pull/27588closesodoo/odoo#27611
Before the fix, routes using binary_content with access_mode
and access_token didn't work properly since access_token
was compared to the object's access token in all cases.
This commit:
-prevents the object's access_token check if
access_mode is truthy (since access_mode does its own access_token
check).
-changes check_access_mode so it now returns a boolean instead of
a record and is now private.
Closes#27401
- Add a method for generating an image data URI, and expose it in QWeb context
- Fix reports, website templates or mail templates with data hardcoded
data URIs, to use the helper (Python cases), or the existing
kanban_image helper (for JS cases)
This will gracefully handle SVG support in addition to classical image
formats.
Closes#26635
Introduce official support for SVG files in the framework, including the
following parts:
1. When client-side SVG images are uploaded, the content is displayed until
you save using data URI scheme according RFC 2397 [1]. This scheme requires
to specify content format. Using hardcoded "image/png" works for all images
types except SVG.
Type-sniffing is done using "magic byte" detection via the first base64
encode byte, so that the proper data URI scheme can be used.
This should not cause SVG-related security problems as the file is
displayed through `<img>` tag, which does not allow SVG scripting [2].
2. Make /web/image controller compatible with SVG
3. Add support for SVG files for company logo, which uses a dedicated
controller.
4. Resizing of SVG files is a no-op, as it makes little sense for a
vector-based format. We also want to avoid micro-alterations to the SVG
document (in "natural" viewport parameters) as we would store multiple
copies of the files in the filestore.
5. Because SVG files are inherently dangerous, upload of SVG files is
restricted to administrators, either by blocking it directly before
saving it in the database (binary fields with attachment=False), or by
neutering them to text/plain mimetype (for binary fields with
attachment=True)
6. Add tests for the SVG upload cases and for the non-admin uploads.
[1] https://tools.ietf.org/html/rfc2397
[2] https://www.w3.org/wiki/SVG_SecurityCloses#26635
Purpose
=======
They are a lot of places where we set an attribute 'groups' on a view element and:
- The group doesn't exist anymore
- The group xmlid is not correct
- The group xmlid exists but the modularity is not respected (example: group_stock_user
used in a view in the 'product' module).
Where it happens, nothing warns the user or the developer. The element is just never
rendered.
Specification
=============
In the method _check_xml, log a warning if a 'groups' attribute is set and if
a group doesn't not exist at that moment.
Introduced at 574f4c3d
model._module has for value of the last module extending the model.
This means that, when a module B inherit from a model defined in a module A (e.g
to add a field on the model), an external id, tagged with module B, will be
created for each field of the model, including the one defined only in A.
The intention of the patch at 574f4c3d was to include the automatic fields (i.e.
LOG_ACCESS_COLUMNS) into the condition.
Without that condition, the fields such as create_date were deleted when
upgrading a module (not defined in any module)
Upon module upgrade, automatic fields are removed from `ir.model.fields`. This
is because those fields do not belong to the module of their model. Fix the
condition to update their XML id when the module of their model is upgraded.
Reason: Following feedback from FP and AVW.
- Fixed the "split PDF" feature, it is now possible to leave an
empty page input, check the "split all" box and get a result.
Task: 1888982
This commit adapts the business code to changes introduced by
the parent commit in order to keep the same behaviour as before.
All readonly=False fields will have to be checked afterwards to confirm
that the business case requires write access to the source field.
- Changed the binary_content method
to make it more generic and allow alternative ways of checking
the access rights by using a new method check_access_mode.
Reason: Asked by ODO following documents' security review.
- if all pages are processed, splitting a pdf will
archive the original attachment.
Reason: FP feedback.
Task: 1853490
After a module upgrade, validate the architecture of the module's views that
are impacted by updates, but have not been checked yet. Before this patch,
views were checked twice on average.
This patch speeds up the installation of modules by about 15% without demo
data. With demo data, the speedup is around 10%.
When rendering a report (`render_qweb_html` for example), one can pass `data`
(a dict of values, used for the template rendering).
This dict was overriden in `_get_rendering_context` if the method
`_get_report_values` on the report model was not correctly written.
This was causing an issue when rendering a report in Studio because the `studio`
key was overriden.
Now, the `data` dict is updated (instead of replaced) with the rendering context.
Purpose of this commit is to give description more "business oriented"
because those descriptions appears in Odoo Studio which is supposed to be used by end users, not only by developers.
Related Task ID : 37311
Purpose: improve understanding of partner and product models as well as their
daily use. This is done by improving tooltips and labels of some fields
according to business logic.
This commit is related to task ID 1880696 and closes PR #27133 .
Thanks to @xmo-odoo for its in-depth review.
Bank statement lines need to be matched with entries; We have to automate this operation as much as possible.
At the same time, create an algorithm that fit everyone needs is quite impossible.
For that reason we will let users choose the rules they want with the improvement of reconciliation models.
Note that we did it only for bank statement reconliation, not for manual reconciliations.
Was task: 1877375
Was PR #26669
Purpose
=======
Traceback when following these steps:
- Install MRP
- Load French translations
- Set language to French
- Activate 'work orders' on MRP configuration
Error: The field 'sel_groups_9_10_1' doesn't exist.
This is because the only selection groups field on the res_users view
that doesn't have a transitive closure (the user's type Internal/Portal/Public)
is ordered by name.
1: Internal User
9: Portal
10: Public
becomes
9: Portail
10: Public
1: Utilisateur Interne
which lead to the traceback.
We should retrieve these groups ordered by 'id' to avoid the issue.
Purpose
=======
- Add the SwissQR Code on the invoice in aim to replace the actual ISR
- Improve the settings of the SEPA QR Code to make it more user friendly
Specifications
==============
- ln_ch:
- Add a SwissQR Code on the invoice to fit the Switzerland QR-Bill Format
- Use the "partner_bank_id" field to generate the QR Code
- Add function to get the address number out of the field "street" and "street2"
- account:
- Remove the SEPA QR Code's journal settings from the general setting
- Display the "partner_bank_id" field on the invoice "Other info" page
- Use the "partner_bank_id" field to generate the QR Code
- website_sale:
- Add a check box on the payment acquirers to use the SEPA QR Code on the e-commerce
- Use the payment acquirer "journal_id" field to generate the SEPA QR Code
In order to ease the integration with the snailmail posting service provider,
We will generate specific reports with a layout that fits their
criteria.
In short,
* we specify the postition of the recipient's address on the
document
* we force the A4 format
This also support the din5008 type B report.
Reverting some changes introduced in
f29df7fb2e.
By changing the html tag from 'article' to 'page' we were losing the
style on the body of the document. The problem it was supposed to tackle
will be addresed in the future.
When getting the context of res_users, all the fields are read but if
the schema is being modified and the modifications are not yet commited
in the database, this leads to a bad query.
With this commit, a read is used to fetch only the needed fields.
Thanks to @RCO for finding this issue that only occurs in specific
planetary alignment.
This css rule is used notably by bs4 .card-deck. The fix is needed to make sure multiple cards inside a card-deck prints on a new line instead of overflowing horizontally out of the view.
PR: #26801
task-1876864
Rev. 2f7c03d added a second admin user (id 2), the 'human' one, on
top of the 'technical' one (id 1, also known as the superuser).
Basically, all calls to _is_superuser() should have been changed to
_is_admin(). They weren't. As a consequence, some features that
were previously available for the admin weren't anymore (e.g.
tours).
This rev. replaces all calls to _is_superuser() by calls to
_is_admin().
The ir_translations were pretty slow to load, this was mainly caused by
the condition in variable 'find_expr' and the import of po values in the
temporary table.
To improve the load performance, we made two improvement:
1. Insert the row in the temporary table by batch instead of making an
insertion for each record.
2. Replacing the condition in the variable 'find_expr' by partial unique
index. To perform such a thing, we had to separate the type model in
two types, 'model' and 'model_terms' because it wasn't possible to
create a partial unique index on type 'model' because the type was
used for two different use cases. The type model is now used for
fields that have have a value not callable for the attribute
translate, these field can only have one record for the same field,
model, res_id and language. And the type 'model_terms' is used for
the fields callable, because they can have multiple sources for the
same res_id.
We also removed the deprecated types 'report', 'help', 'view', 'field'.
Thanks to @rco-odoo for the improvement of the first point.
By default, the `set_value` method doesn't do anything, and is expected
to be overridden. However, `ir.default`, groups and
`ir.config_parameter` are set BEFORE `set_value` is actually called.
This is an issue when it is necessary to retrieve one of these values
before the save, for example in order to compare the value before and
after.
We move the setting of the various values directly in the `set_value`.
This way, it becomes possible to interact with the values before any
modification is performed. On the other hand, the existing logic remains
unchanged.
opw-1882068
qsm-odoo