simplejson and the builtin json module apparently differ in how they
decide to optimise decoding JSON strings to str rather than unicode
python strings, so check for basestring rather than one or the other.
This may also depend on the Python version.
Closes#8726
* add CSRF token as core.csrf_token
* add CSRF tokens to client-generated and/or JS-submitted forms
* remove broken "compatibility" mode of web.ajax.post
/cc @dmo-odoo I've no idea how that was supposed to work, from looking
things up all modern browsers seem to support FormData, and old IEs
which don't don't support fallbacks either and would require
submitting an actual form as fallback so...
* make CSRF protection the default on all non-SAFE methods
note: there currently is no way to call a CSRF-protected endpoint
without a form-encoded entity-body as that's the only place we get the
CSRF token from.
* simple CSRF token generation: just use the HMAC'd session id, no
generating a new random token per session then HMAC it
* use constant-time equal function to avoid timing attacks
* assert that a database secret is configured before hashing/validating
the CSRF token
* opt-out database manager from CSRF: The super-admin password serves
the purpose of a CSRF token in the database manager screens.
There is no request database to obtain the
secret and generate a CSRF token.
In function bind_data of website.editor.js, either href is a mailto link
or an url link but not both.
The function convert_links must not convert mailto links.
opw:650443
The method that set `geoip` in the session, `_geoip_resolve`,
is called just before `self._authenticate`, which logout the user
when the session is invalid, and therefore reset the session.
Therefore, `geoip` could not be in the session in that place.
This isn't that bad, as, at the next request, the `geoip` will be
correctly set in the session.
During the analysis of this issue, we observed that the reset
of the session is actually not saved, because the save
of this session is done in `Root.get_response`, through the call
`self.session_store.save(httprequest.session)`,
but `Root.get_response` is not called in `Root.dispatch` in case
of HTTPException (500 internal server error in this case).
This might need to be changed, to do the session save with a finally
in this `Root.dispatch` method, so the above bug could have been
resolved with a simple refresh (which would have re-defined the
`geoip` in the session).
opw-650416
Help has been moved to web_planner, but only in backend. The comportement needs to be defined in website also so it is now shared in frontend and backend (mixin in common)
The `unittest2` package is simply a backport of `unittest` from the
Standard Library of Python 2.7 to previous versions.
There is no reason to use it any longer.
Closes#6941
Avoid 'Uncaught TypeError: t.value.trim is not a function'
When t.value is empty / false, trim crash and so it's impossible
for end user to make translation.
Fix for saas-6 only, don't forward port.
If the user translate a record html field like product... and add block after in English version, the translation doesn't have the new blocks.
In version >= 9.0 the translations contain only textual contents (with font, bold, color...). If a user add a block in english the block appear in all translations (with new text marked to translate).
jQuery has a special behaviour when using .contents() over an iframe
object. This caused an error for escaping when saving the page with an
iframe content of an external domain.
introduced by 8c77c711
opw-649570
The CDN domain will typically be different from the main
website domain, so session cookies cannot be shared.
This means that assets that require elevated privileges
(such as the website editor rights) will not be reachable
from the CDN's proxy server.
This could cause random problems with CSS/JS/images not
being accessible.
The benefits of the CDN are mostly meant for the masses
of new visitors (less workload and less bandwidth consumed
for the main domain) anyway.
Authenticated users are also returning users that have most
of the resources in the browser cache anyway (assets bundles
and images, typically).
Add multilang=False to website_image controller to prevent redirects
Because website_image is decorated with website=True
Requests made for the product image at
`/website/image/product.template/xx_xx/..`
triggered redirections to add the language code to the
requests URLs. This redirection was useless, as setting
the language code for images is non-sense.
Adding `websitelang=False` prevents this redirection.
In addition, the redirection could lead to
SSL security concerns, as the redirection
could use the http:// scheme.
Closes#8515
For some strange reason, two CSS rules had different priorities between
firefox and chrome (which forced chrome to always display published and
unpublished at the same time).
The chosen solution is to change the value of the button in published/
unpublished instead of toggling and relying on CSS classes (with this
method, the DOM looks better too).
There was also duplicated code in website for assets_backend.
How great is it to get Odoo (almost) 9.0 (almost) translated?
Clean .tx/config file
Regenerate .pot files
Fetch current translations from Transifex (10% completion)
Each theme was duplicating this file.
Now we need to improve this file to be re-usable by others themes.
This fix is only to catch input, in case of the selector is an image.
In 7d40a7d, f820c07, 3ed0628 the way the mobile preview iframe is set
was altered several times. This left an inconsistent needless page load.
This page load was cancelled, but as a side effect in a given set of
conditions:
- an ajax request is done early in current (and so iframe) page,
- phantomjs is used for the test,
- server response time
this could lead to a false positive caused by a cancelled xhr request
throwing the error: "Can't load template, http status 0".
Odoo Translation Bot