When a user has access to a quote (because he is follower) but he is not
in the same company than the customer, an access error can occur on the
the rendering of the partner field.
We use the tokenized link instead, which will read the SO as a superuser
to avoid this situation.
opw-691740
In the frontend customer quote validation,
the company used in the sentence
```
I agree that by signing this proposal,
I accept it on the behalf of
```
was the quotation company, which is the company
which is selling, not the company/customer which is buying,
and this does not make any sense.
Instead, it should use the company of the customer
accepting the sales order, or simply the customer
if he does not have a company set.
The only case which make it a little weird is when
it's the customer himself, without parent company,
who is accepting the quote
"on the behalf of himself", but:
- This isn't possible to correct this without
breaking the translations, because the
sentence "I accept it on the behalf on"
is within the same sentence than
"I agree that by signing this proposal"
- This makes sense if another person than the
customer himself is validating the order
(the customer sent the quote link with the token
to another person).
opw-690837
l is not defined, it is line.
Bug introduced with commit odoo/odoo@5f5f8d8.
But it was never detected before because there was
no value for b2b/b2C before commit odoo/odoo@e6184aeb37
so total/subtotal in report was never print.
Allow to set in configuration mode b2b or b2c.
Change the column of order line in sale view and in reports depending of sale.
Fix price_reduce field (wrong if tax was included in price)
and merge with code discounted_price from website_sale.
Change header from reports "Price Tax Excluded' by 'Price' in report.
That is wrong, sometime the amount can haxe tax included in the price.
* The compiled templates are cached per user, lang, inherit context values
* ir.ui.fields: attributes method return an dict, and record_to_html return only the content value of the field
* all rendered text use build_text and all attributes use build_attribute
* t-esc-options is removed and replace by format_value method
* AssetsBundle receive the list files and remains
This commit adds controller to list documents of customer, with pager and archive
widget to sort documents. Impacted documents are : quotations, sale order,
invoices, and issues.
Portal breadcrumd is improved too : add the home icon, and keep the query
params when using archive widget.
Some editable zones were added to templates, allowing people to customize
their frontend portal.
On website_quote, according to the translation, the label may become much larger than
the button width. By default the bootstrap btn class has the property 'white-space: nowrap'
Here the goal is to add a class which will be used for these kind of cases.
Commit 7636b51 modifies the route from JSON to HTTP by mistake. Indeed,
the route /quote/accept is called from an ajax.jsonRpc request, not from
the `method="POST" t-attf-action="/quote/accept` which can be found in
website_quotation.xml.
The t-attf-action is actually only used to recover the order_id and the
token in website_quotation.js.
opw-652874
Closes#9227Fixes#9226
Before this fix, it was possible to validate then cancel a quote (or the other way around) simply by using two tabs in your browser. From now on, we only validate/cancel a quote if it's the 'sent' state and advise the customer of the situation if he tries to abuse the process.
* make CSRF protection the default on all non-SAFE methods
note: there currently is no way to call a CSRF-protected endpoint
without a form-encoded entity-body as that's the only place we get the
CSRF token from.
* simple CSRF token generation: just use the HMAC'd session id, no
generating a new random token per session then HMAC it
* use constant-time equal function to avoid timing attacks
* assert that a database secret is configured before hashing/validating
the CSRF token
* opt-out database manager from CSRF: The super-admin password serves
the purpose of a CSRF token in the database manager screens.
There is no request database to obtain the
secret and generate a CSRF token.
Note: This is a custom version of the lib which allows to
enable/disable the signature area and which introduces the
compatibility with IE + bug fix of the official version.
Until now, you could only sign and confirm a sale order from the frontend.
From now on, you can also pay sale orders if the 'Immediate Payment'
option is checked on the sale order.
* add on_change_uom behaviour to quote templates lines
* fixes frontend layout issues
* use action_button_confirm instead of signal_workflow
when confirming the quote in the frontend to trigger
all events properly
* adapt prices using pricelist on onchange_template_id
on sale orders
Nicolas Martinelli