Before this commit, when the amount of rows was above xls format threshold (>65535), the xlwt library threw an obscure Traceback to the user.
We now test the amount of rows before even calling the library, raising a more helpful message to the user
OPW 767319
closes#19035
In v8, it was not allowed to create a DB with a name containing a space.
This should still be the case from v9 since it causes issuesfor backup
scripts, for example.
Reintroduces 1a0e9063d4
opw-727613
Until 9.0 our psycopg2 DSN connection strings do not allow having
spaces within the db name, and passing some can cause duplicate
registries to be loaded.
Stripping spaces is a simple workaround until we actually support
spaces within db names.
Fixes#13078
When a database is created, we are not auto-logged in to the new
database anymore because the login passed to the authentication request
is 'admin' instead of the one set in the creation form.
To fix this issue, we used the login parameter from the creation form
in the authentication request. We also set the login field to
required in the create database form view.
This bug comes from rev https://github.com/odoo/odoo/commit/903733a32
Since the commit odoo/odoo@36e875e which disable the second-guess from browser,
IE cannot display picture from Odoo where mimetype is wrong.
Before this commit, IE and probably other browser which one respect the header
'nosniff' don't display picture not_found and resized picutre via controller if
the original was not of type 'png'.
Eg: when we return the placholder 'not_found' if you don't have permission,
or when your resize the picture, ... we need to force the mime-type with the
new one and not keep the original mimetype.
This commit closes#13193
When a user connect to /web/database/manager directly without the
login page before, the request don't have registry.
When the user click to backup a db, a traceback was raised:
return request.registry['ir.http'].content_disposition(filename)
TypeError: 'NoneType' object has no attribute 'getitem'
Because it was impossible to call content_diposable from ir_http
without registry.
Now content disposable has been moved in http.py and is callable from
anywhere.
This commit closes#13192
This commit closes#11583
The fith arguemnt of the search method in count in new API.
Passing all arguments as positional arguments will make the context passed for
the value of the `count` argument.
bbc67ec is a similar fix in 9.0
Closes#12830
The company logo file extension is always '.png', even if the logo is of
another type such as 'jpg' or 'gif'. This is not an issue for decent
browsers, but IE might not display the image under specific
circumstancies, e.g. in combination with nginx.
opw-676836
Add inputs e-mail address and country
when creating a newdatabase
This will provide the installation of the correct
chart of accounts at the installation of Accounting
Use the provided login as the admin login,
and set the email on the partner
if the login set is an email
Set the country on the company (and its partner)
The countries are parsed from XML country list
We take the opportunity to repair the `label for`
which bind the label with the input only if
the `id` attribute of the input is set with
what is set in the `for` attribute of the label
When exporting text data in CSV format, values
beginning with '=', '+' or '-' will usually be
mistaken by spreadsheet applications as formulas
upon CSV import.
That will often cause the cell to display an
error message instead of the actual contents,
such as "#NAME?"
Prefixing them with a single quote makes them
pure text cells. The special single quote
character is usually hidden by the spreadsheet
in that case.
Numbers and other types of values are not affected.
CSV export was added in f146e2a and since then newline were not
exported.
But new line should be allowed if the string is quoted by " characters
which is done in Odoo.
closes#11005
opw-667853
The `binay_image` and `content_disposition` are moved
from the web controller to the `ir.http` model,
to be able to override these methods.
This makes possible to browse the records images as sudo
when the record is published on the website.
e.g. to see the partner images on the website `/partners` page
from the `website_crm_partner_assign` module.
opw-659244
The QWeb image widget allows passing either
max_width, max_height or both, but the
controller required both.
We'll consider a 0px dimension request as
meaning: "appropriate value according to ratio".
URL attachments are now returned as data and not redirection.
If the url does not match with a module file, the 301 status
(redirection) is still returned.
This allows to use the /web/image/<xmlid>/<dimension> route
and get an image attachment with correct dimensions.
Some accounting model (i.e. account.tax) are redefining the ORM search
method, but with misordered arguments (placing count as fifth argument
instead of context).
For the export function, this lead to have the "context" variable
associated to the "count" function variable. As "count" is then
considered as True, the method returns the number of records instead
of the list of record ids. This then exported the last record (the
count'th one) instead of all the records that matched the domain.
The solution here is to explicitly give the context variable by name.
- Differentiate between the Community and Enterprise editions
in the version number. By adding this attribute on the global
odoo JS object in the web client bootstrap controller /web,
we can differentiate between versions easily on the client
side without extra RPC calls.
- Remove a couple of version-related RPC calls in case
the global version info is present in the JS environment
- Update "About" panel to display the edition info
- This commit also reverts 07fe5afc87
which implemented the idea in a more limited way.
Closes#9625
HTTP status lines are required to have both
a status code *and* a "reason phrase".
Some stricter HTTP clients / proxies choke
on status lines without "reason".
Technically, setting `response.status` is supposed
to set both at the same time, so we need to provide
both, or to set `status_code` only and let werkzeug
add the reason. This patch does the latter.
Fixes#8924
This reverts commit bd9cbdfc41.
The above revision solved the SQL constraints not being
translated when raised. They were not translated because
the context, containing the lang, was not located as expected
in the `kwargs` dict.
While it solved this issue, it had as side-effect to raise
`current transaction is aborted,
commands ignored until end of transaction block` errors more
often when using the web client.
This can be explained by the double check, when the first
check raised this error
- which can happen, e.g. when the cursor is closed,
there is a retry mechanism in such cases -
and by the fact the transaction was not rollbacked.
This issue could have been solved as well by rollbacking
the transaction, but it is regarded as not-so-clean.
Therefore, to solve this issue, while still having
the SQL constraints translated, we apply the
second patch proposed in bd9cbdfc41
commit message, which is not-so-clean as well, but
which is a proper solution.
opw-651393
Only used by web tests (which rely on a module they don't depend on to
run, bad!) and altering the test session directly should work, so this
endpoint seems completely unnecessary.
* make CSRF protection the default on all non-SAFE methods
note: there currently is no way to call a CSRF-protected endpoint
without a form-encoded entity-body as that's the only place we get the
CSRF token from.
* simple CSRF token generation: just use the HMAC'd session id, no
generating a new random token per session then HMAC it
* use constant-time equal function to avoid timing attacks
* assert that a database secret is configured before hashing/validating
the CSRF token
* opt-out database manager from CSRF: The super-admin password serves
the purpose of a CSRF token in the database manager screens.
There is no request database to obtain the
secret and generate a CSRF token.
The stdlib version of the json library is more recent than the 3.5.3
version we are pinning in `requirements.txt`
There is no reason to use it.
Closes#6940
The structure `filename*=UTF-8` works in Safari, from
release 6.2 (which is set as version 537 in the user_agent version).
This structure has the advantage to handle the UTF-8 encoding,
and therefore special characters, such as accents.
Therefore, from this Safari release, we use the same format
than other browser. For older releases, we use the format
`filename=`, without UTF-8, ASCII encoded, replacing
special characters by `?`.
opw-649863
The `check` decorator expects the context to be in the `kwargs`
or to be the last arguments of the method.
The `call_kw` route, which is decorated by the `check` decorator,
like every route,
expands its kwargs arguments.
Therefore, once in the `check` decorator,
the context is located in the `kwargs` key
of the kwargs.
(More simply, instead of
`kwargs.get('context', {})`
it's
`kwargs.get('kwargs', {}).get('context', {})`
As the context is not retrieved correctly,
the lang is not set correctly either,
and the sql constraints were not translated.
In 7.0, it worked, because there was a double
check, as the call_kw was called trough an rpc
(`dispatch_rpc`) call,
which was decorated by the `check` as well.
As a fix for 8.0, we apply the same logic,
we perform a double check, with an indirection.
The check decorator should probably be
refactored, but this cannot be done
in a stable release such as 8.0.
Closes#3634
Olivier Dony