* allows portal users to update their password
* and manage their API keys
* any anything technical / security related we may need to add in the
future
Also bridge module for the password meter (auth password policy).
* ability for a user to request / create keys associated to their user
* overrides can block RPC solely through API keys, by overriding
`_rpc_api_keys_only()` (to require API auth even in
situations where the user has not requested it themselves)
* hash keys just in case as we can do so and might as well, add a
cleartext index (first 4 bytes of 20) to avoid blowing up the DB if
a user decides to create millions of keys for some daft reason
* users can delete their own keys, admins can delete (invalidate)
anyone's keys
* `scope` on API keys can be used to restrict usage to certain
kind of applications, so API keys can be used for other things
than global authentication. New keys manually created by users
have no scope by default so they are valid everywhere (global
keys). RPC auth (stateless XML-RPC/JSON-RPC) requires global keys
Co-authored-by: Florimond Husquinet <fhu@odoo.com>
Co-authored-by: Olivier Dony <odo@odoo.com>
* migrate website to overriding web_login less (still needed to flag it
as website-enabled) and use _login_redirect for its login redirection
override needs
* modify portal and website to not replace / shortcut the redirection
workflow, so it's possible to override those properly if / as
necessary
Before this, invalidations to the UID cache is not synchronised
between workers because it's an ad-hoc solution (so a user changing
their password or an admin disabling a user would only lock out an
attacker currently using the API of one of possibly several
workers). Shift the entire thing to ormcache which already has proper
support for synchronising cache invalidation between workers.
Also simplify the cache invalidation mess in Users.write because the
caches have been unified into a single registry-level LRU, so the
half-dozen cache clears on specific ormcached methods & models is
pretty much the same as repeatedly calling clear_caches on the current
model.
**However** registry.cache is trivially accessible from server actions
and safe_eval as long as they provide access to a model (through
`model.pool.cache`). Which is common, and an issue given we're very
much putting sensible data in there.
Fix this by renaming `Registry.cache` to `Registry.__cache`, this
requires few editions and mangled names are not accessible from
safe_eval contexts.
The alternative would have been to add more bespoke handling of the
uid cache to hook it into the cache invalidation propagation
machinery.
After discussion with (@)odony, fixing LRU access and using that seems
cleaner and less error-prone.
Note on lazy_property
=====================
Make Registry.cache / Registry.__cache into a regular attribute: the
overhead of the LRU is not that high (compared to that of the registry
itself), it's rare that we *don't* need it, and it's assumed to be a
persisted attribute (it's not just a cache) so making it a normal
attribute seems fine; and lazy_property doesn't work for mangled
names: the name of the property is mangled using the name of the
definition class, but the name of the symbol (fget) is not mangled so
lazy_property would set the __cache attribute but then Python would
lookup _Registry__cache, creating a new cache every access.
And we can't (always) mangle things correctly on `__get__(obj,
owner)`: `owner` is just `type(obj)`, meaning in the case of
inheritance the type we get is the type through which the property is
accessed rather than the one it's defined on. So it would work in the
cases where no inheritance is involved (such as Registry.__cache) but
not in general (lest we want to play around walking the MRO ourselves
to find the definition source, which doesn't seem worth it).
lazy_property *could* be made to work properly on Python 3.6+: the
descriptor protocol gains `__set_name__(name, owner)`, which is called
with the properly mangled name — and with the definition class to boot
(though there might still be issues when overriding lazy properties as
the override will be mangled & named differently... or maybe that's a
feature?). However we're still supporting 3.5 at this point, AFAIK, so
that's not an option. Plus it feels unnecessary / not very useful.
However add an assertion to `lazy_property` so it signals when we try
to use it on a mangled method (as otherwise it kinda sorta work in the
sense that the property / object is accessible but is in effect a
slower way to write a regular property).
Similar to github's sudo mode, my understanding of the intent is to
avoid third parties being able to perform sensitive / serious
operations when leaving a logged-in machine unattended.
This v1 only handles protecting "action methods" (methods called
through buttons and intended to return action descriptors), although
they can be used to "lock out" any methods they won't be able to
prompt and the caller will likely be surprised.
The browser itself would get mostly cleaned up between tours, but the
session object would not get cleaned, and apparently in some cases
that could lead to an incoherent session: a tour would add data to the
session which the next tour (logging in as a different user) would
not (fully) override, leading to a session inconsistency and a Session
Expired exception during the tour.
Fix by not storing the session on the test object, the session is
created during authentication then set on the opener & browser.
Allows accessing various keys, especially whether this is an
interactive login or not.
Also have the xml-rpc `login` delegate to `authenticate` instead of
having its own half-assed implementation.
And remove some dead code: as far as I can tell, Session.authenticate
is never called with a uid.
This commit switch the cash control opening mangement from the backend to the front end of the point of sale.
task_id: 2258817
closesodoo/odoo#55741
Signed-off-by: pimodoo <pimodoo@users.noreply.github.com>
This commit fixes several small issues in the test_event_full tour that was
relying on selectors that have been since reworked.
In addition:
- Set the track we set the reminder to in the future so that the button appears
- Avoid going on the exhibitor page because Jitsi will trigger an error
- Make sure we go on the registration confirmed page
Task #2317947closesodoo/odoo#55956
X-original-commit: 11b7f4446ddec6ab237ed6076838bfbbaca03be6
Signed-off-by: Thibault Delavallee (tde) <tde@openerp.com>
11px was set as default font-size when achieving 5 or 6 edition levels
in the sidebar was the norm. Thanks to the snippet's cleanup, resulting
in a reduced number of editable elements, we can now increase the
default fon-size and, consequentially, all general spacings.
Part of https://github.com/odoo/odoo/pull/55959
task-2157252
*: website
Add a field image flag on the lang model because when a language has
no country (like the arabic) we cannot use the country flag as a lang
flag. By default we use this new field and as fallback we use the
country image. We also add an arabic flag image in the website data.
Part of https://github.com/odoo/odoo/pull/55300
task-2203383
closesodoo/odoo#55300
Signed-off-by: Quentin Smetz (qsm) <qsm@odoo.com>
Co-authored-by: qsm-odoo <qsm@odoo.com>
Add an option to display the language selection inline or with a
dropdown. Add an option to choose if language labels are flags, text
or both.
Part of https://github.com/odoo/odoo/pull/55300
task-2203383
Co-authored-by: qsm-odoo <qsm@odoo.com>
On mobile device, the event PWA display an install bar to ask the user
to install the event app.
This commit allows to close it without having to install it.
closesodoo/odoo#55919closesodoo/odoo#55952
X-original-commit: 1f7b2910a75f149f1398bba147f5e10d53448adf
Signed-off-by: Adrien Dieudonné (adr) <adr@odoo.com>
On mobile devices, when you go for the first time inside the event
public page the PWA install bar and the livechat tooltip are displayed
at same area. Because of this it's was difficult to click on the
"install" button.
X-original-commit: 6705c6b6fe0360f95b4a499a9141f876648b7202
Added a new tour for the module hr_recruitment
Hr.job:
Form view:
- Using a notebook view for increased clarity
Kanban view:
- Added a toggle button to publish/unpublish a job offer.
- In the menu, added the « Create Interview Form » button to create an interview form.
Hr.applicant:
Generale:
- Use of the "Applicant: Acknowledgement" template by default when an application is moved to the "First Interview" stage.
Form view:
- Possibility to consult an interview after this one and not before
- The "CREATE EMPLOYEE" button no longer directly creates an employee. The employee will be created if the "SAVE" button is pressed.
Hr.employee:
Generale:
- Added of two new certifications.
And some other minor style and name changes.
closesodoo/odoo#55928
Related: odoo/enterprise#12420
Signed-off-by: Yannick Tivisse (yti) <yti@odoo.com>
* stock, website_sale, base
Purpose fo the task is to improve the product list view and
contact list view.
So in this commit, we have Updated the list view of the product
updated decoration, string apply the monetory widget on cost
and sales price.
Also on contact list view make the user_id field as optiona show
instead of hide.
TaskID: 2309699
Related Enterprise: https://github.com/odoo/enterprise/pull/12288
closes odoo/odoo#55451
Closes: #55451
Related: odoo/enterprise#12288
Signed-off-by: Yannick Tivisse (yti) <yti@odoo.com>
On the dashboard of Time Off (calendar view), the banner displaying
the remaining leaves is not shown as _get_contextual_employee_id
of hr_leave_type.py is returning False due to the missing required
on the company_id of hr.employee.
A fix was made in 2bd5e9a but missing the part that the employee_id
is not required. Confirmed by YTI
close opw-2252479
closesodoo/odoo#53109
Related: odoo/upgrade#1596
Signed-off-by: Yannick Tivisse (yti) <yti@odoo.com>
PURPOSE
Provide some fixes after internal test deployment of event online features.
Notably: chat room management and track list.
See sub commits for more details.
UPDATE
Templates
* website_event_meet.meeting_room_card
* website_event_meet.community_aside
* website_event_meet.meeting_room_main
* website_event_track_session.event_track_content
* website_event_track_session.event_track_aside_other_track
Views
* website_event_meet.event_meeting_room_view_tree
* website_event_track_online.event_sponsor_view_tree
* website_event_track_exhibitor.event_sponsor_view_tree
SPECIFICATIONS: TRACKS LIST
It allows to better know who the speaker is. This is done through a related
on the speaker function and partner_name fields. It allows to display a
sentence like "Director at Azure Interior", which gives information on both
its position and its company.
SPECIFICATIONS: CHAT ROOMS
Clean code managing chat rooms: handle most of its management in chat room
mixin. It allows to lessen custom code in website_event_meet.
Improve sanitize heuristic of chat rooms by avoiding name collision. If a
room with a given name already exists, simply increment a counter as suffix.
Improve copy management: when copying from the chat.room.mixin on a record
with a room set, simply propagate an updated room name. As room_id itself
is not kept but a new one is create, it will create a new room with a name
avoiding collisions.
Allow multi edit for event meeting rooms and exhibitors. It allows notably
to publish by batch, and to set exhibitors as having chat rooms by batch.
Give default values for max participants count when creating exhibitors so
that required field has a default value. Otherwise people forgot it and have
to come back on form view to set it. This is due to default value coming
from mixin not being propagated to the form view.
LINKS
Coming from internal feedback while deploying online support
Task ID-2314778
PR #55887closesodoo/odoo#55949
Forward-port-of: odoo/odoo#55887
Forward-port-of: odoo/odoo#55941
Signed-off-by: Thibault Delavallee (tde) <tde@openerp.com>
SPECIFICATIONS
Slightly improve meeting room model
* set chat room as required. Meeting rooms without chat room make no sense;
* allow to translate room summary. As this is displayed in frontend having
it translated makes sense;
* improve label of reached participants, allowing notably to display it
nicely in backend;
LINKS
Coming from internal feedback while deploying online support
Task ID-2314778
PR #55887
X-original-commit 54bd8281cf94ddee77073cf5d6356d847d08d024
PURPOSE
Ease chat room management, especially when dealing with meeting rooms and
exhibitors in backend: multi edit, avoid name collision, better support of
copy with room names, ...
SPECIFICATIONS
Clean code managing chat rooms: handle most of its management in chat room
mixin. It allows to lessen custom code in website_event_meet.
Improve sanitize heuristic of chat rooms by avoiding name collision. If a
room with a given name already exists, simply increment a counter as suffix.
Improve copy management: when copying from the chat.room.mixin on a record
with a room set, simply propagate an updated room name. As room_id itself
is not kept but a new one is create, it will create a new room with a name
avoiding collisions.
Allow multi edit for event meeting rooms and exhibitors. It allows notably
to publish by batch, and to set exhibitors as having chat rooms by batch.
Give default values for max participants count when creating exhibitors so
that required field has a default value. Otherwise people forgot it and have
to come back on form view to set it. This is due to default value coming
from mixin not being propagated to the form view.
LINKS
Coming from internal feedback while deploying online support
Task ID-2314778
PR #55887
X-original-commit d35d6295ae1b50e9ecb4e57c5e7fb6cdd52c8b27
It allows to better know who the speaker is. This is done through a related
on the speaker function and partner_name fields. It allows to display a
sentence like "Director at Azure Interior", which gives information on both
its position and its company.
LINKS
Coming from internal feedback while deploying online support
Task ID-2314778
PR #558877
X-original-commit 69cf94cec0913db4132ae96d2bc82be4f465d6db
This commit adds a few minor improvements to crm views:
- Add the crm.team currency on opportunity amounts on the crm.team kanban view
- Slightly reorganize "My Activities" view for increased usability
- Remove the "alias_user_id" field in the crm.team form view because it's a
related technical field that is not supposed to be modified there.
Task #2314894closesodoo/odoo#55940
Signed-off-by: Thibault Delavallee (tde) <tde@openerp.com>
Co-authored-by: Aurélien Warnon <awa@odoo.com>
In pivot view, a cell data is determined by his row/column key which
are the value chain of field values to get to that row/column.
If you had a grouping with value in a cell and then close the grouping,
you could somehow get the old value back wrongly on next grouping
operations.
This happened because:
- the key was computed based on the value (eg. for relational field the
record ID) but without the field name.
- succeeding read_group only fill existing values.
eg. If on pivot view we had a salesperson with same ID as product
category, if we closed salesperson grouping then opened product
category grouping, we could possibly get the cell value to the product
category that has the same ID as the salesperson.
With this changeset, we clear the cell data corresponding to a grouping
that has been closed.
Added test without the fix would fail by displaying data of a previous
read_group that should have been cleared inbetween.
opw-2262306
closes#55129closesodoo/odoo#55936
X-original-commit: f1df73adca4955561814d4b8e90a62d7d50c1c33
Signed-off-by: Nicolas Lempereur (nle) <nle@odoo.com>
Co-authored-by: Mathieu Duckerts-Antoine <dam@odoo.com>
PURPOSE
Provide fixes for event online modules after internal testing.
SPECIFICATIONS
Those fixes mainly target front-end display of tracks, exhibitors
and community leaderboard. Purpose is to make display nicer and
better looking notably in mobile.
See sub commits for more details.
Impacted templates
* website_event_track_online.agenda_main
* website_event_track_online.agenda_main_track
* website_event_track_exhibitor.exhibitor_aside
* website_event_track_session.tracks_display_list
* website_event_track_session.event_track_aside_other_track
* website_event_meet_quiz.community_leaderboard_small
* website_event_meet_quiz.visitor_quiz_points_card
* website_event_track_quiz.top3_visitor_card
* website_event_track_quiz.all_visitor_card
LINKS
Coming from internal feedback while deploying online support
Task ID-2314778
PR #55634closesodoo/odoo#55933
Forward-port-of: odoo/odoo#55634
Signed-off-by: Thibault Delavallee (tde) <tde@openerp.com>
It allows to help debugging and could also allow to change gained points in
case some tweaking is necessary.
LINKS
Coming from internal feedback while deploying online support
Task ID-2314778
PR #55634
X-original-commit: 6d81690ff77dfbae74128cc2cbd875b2b3074823
Make it looking nice in mobile (and desktop). Also remove some unnecessary
complexity in DOM.
Display leaderboard even if only one or two visitors had points. It is
better for onboarding purpose.
Display 'You' only in if the visitor is you AND if visitor.name is empty.
This allows to display 'You' instead of 'Website Visitor #123' but still
display your complete name if you are logged in or if you have a registration.
LINKS
Coming from internal feedback while deploying online support
Task ID-2314778
PR #55634
X-original-commit: d767c998f2d269ec0f23a6e96874b47f78fd87f8
SPECIFICATIONS
Do not hide closed exhibitors, as we may feel there is nothing to show outside
of classic opening hours. Instead simply put open exhibitors on top of list.
Improve display of exhibitor line: put badge below country to gain space
for the exhibitor's name. Also apply the color of ribbon like done in sponsor
card view, to better distinguish sponsor levels in badges.
LINKS
Coming from internal feedback while deploying online support
Task ID-2314778
PR #55634
X-original-commit: 421247a1d6127349989b38e596cc197565800c7d
Purpose is to gain space and avoid having long date strings with timezone and
all unrelevant details.
LINKS
Coming from internal feedback while deploying online support
Task ID-2314778
PR #55634
X-original-commit: 2e67ba9f16dc4614e94027820408699dc3dabed5
SPECIFICATIONS
Currently agenda does not display well on mobile. This commit improves display
of card in order to have a cleaner display.
When displaying tags, track name, reminder, speaker name: ensure that mobile
uses more vertical space than horizontal one, leading to a better result.
Fix: remove fa-user if no speaker on agenda card
LINKS
Coming from internal feedback while deploying online support
Task ID-2314778
PR #55634
X-original-commit: d8b35ece9e3627953700c281057fbf09f973cdd0
Xavier Morel