Current behaviour:
If we add a blockquote in the `website_description` of a product on
the e-shop, we cannot checkout the product. Silent HTTP 400 error
code, due to an exception raised by
https://github.com/odoo/odoo/blob/bf772181933ce5334da35c8368455963b2478399/odoo/fields.py#L1987-L1993
Expected behaviour:
You should be able to checkout products even if they have blockquote
in their `website_description`.
Steps to reproduce:
- Install eCommerce, sale_quotation_builder (issue is present only
after installing sale_quotation_builder)
- On a product, with the website editor, add a `blockquote` to the
description of the product > Save
- In a private browser window, as public user, visit the product on
the e-shop and try to checkout with it.
- Observe there is no visible error, and we do not proceed in the
checkout process.
Reason for the problem:
The exception mentioned above is triggered when there is a
difference between the html content that is saved in the DB and after
sanitization, meaning that someone with escalated privilege saved
the HTML content by overriding the sanitization with
`sanitize_overridable`. In our use case the only diff is the
presence of the attribute `data-o-mail-quote-node` which is removed
after the sanitization.
Fix:
This issue can be resolved two ways:
1) Adding `data-o-mail-quote-node` to the list of save attributes,
meaning it will not be removed during the sanitization process.
Since this is an attribute that we add on `<blockquote>` nodes,
it can be considered safe, just like `data-o-mail-quote`.
2) Remove the attribute sanitization of the `website_description`,
just like it is done in the website_sale module.
Since the `website_description` and `quotation_description` are both
computed from one-another, they should have the same sanitization
level.
I am implementing both solutions, 1) because adding the attribute to
the safe list seems safe in general, and may prevent future
issues of this sort. 2) because it is the root cause of the issue,
since the bug is present only after installation of the
`sale_quotation_builder` module.
Affected versions:
- 16.0
- saas-16.1
- saas-16.2
- master
opw-3297237
closesodoo/odoo#122154
X-original-commit: 23022144cb1a338db05870b28f17360b92c46a9c
Signed-off-by: Xavier Morel (xmo) <xmo@odoo.com>
Signed-off-by: Piryns Victor (pivi) <pivi@odoo.com>
This commit put the same field description between 'sale.order.template.line'
and "sale.order.line"
closesodoo/odoo#119576
X-original-commit: 811cf78ee1e63a7c41efe578fb64ee2deeca1dde
Signed-off-by: Romain Derie (rde) <rde@odoo.com>
Signed-off-by: Vranckx Florian (flvr) <flvr@odoo.com>
The quotation templates got a button to design them, which lands on
their website/frontend preview.
The goal is to then be able to enter edit mode and customize it.
But since we merged frontend > backend with [1] (and multiple iterations
since then), landing on the frontend is not a good idea to do that as
you would then need to click on the "Editor" button to go back to the
backend and be able to enter edit mode. Now we reach the iframe preview
directly.
Note: this will be improved in a further update to not require a reload
of the backend when clicking on the button.
[1]: https://github.com/odoo/odoo/commit/31cc10b91dc7762e23b4bde9b945be0c4ce3fe3b
X-original-commit: a98ea96b52f6ccfd43e364720001ed4c4bcbcb4e
Part-of: odoo/odoo#102787
The previous commit allows the sanitizer to be bypassed by some users if
those users are part of one of the `base.group_sanitize_override` group
and if the HTML field is declared as `sanitize_overridable`.
This commit flag frontend HTML fields as `sanitize_overridable`.
See the main commit of this PR for more details.
It also gives the `base.group_sanitize_override` group to the "Editor &
Designer" group.
Part-of: odoo/odoo#97398
That way, the method overrides are grouped with the new fields to
propagate between template lines/options and order lines/options.
Eases code comprehension and maintainability.
Part-of: odoo/odoo#91222
Harmonize backend & frontend behaviors
Avoid the overhead and additional stacktrace depth of write/create
overrides
Ligth cleanup of the fields & code as well.
Part-of: odoo/odoo#81818
quotation_description on the sale order is copied from the
product template, where it already is sanitize_attributes=False,
and it has to stay like that because otherwise widgets like
"tab" or "accordion" cannot be rendered correctly.
This is also linked to a bug in the ORM where the _related_attrs
weren't copied correctly.
Related ORM PR: https://github.com/odoo/odoo/pull/78687
Ticket link: https://www.odoo.com/web#id=2487749&model=project.task
opw-2487749
closesodoo/odoo#78836
X-original-commit: ee90f6bcea35350efa9eae8db749199b39ff5644
Signed-off-by: Paolo Gatti <lordkrandel@users.noreply.github.com>
* = event, website_event_track, website_sale, website_hr_recruitment,
website_livechat, website_sale, website_slides
The option to sanitize or not the forms was not available, this will
allow better flexibility on whether forms should be sanitized or not on
an HTML field.
Also we use this new param to allow forms to be added on some already
existing html fields where forms where sanitized out.
task-2209554
closesodoo/odoo#47318
Signed-off-by: Jérémy Kersten (jke) <jke@openerp.com>
Multi is the default api for methods, it is not necessary to explicitly
decorate methods with it, adds clutter and most people use it because
they see that the rest of the code uses it.
Done with `find . -type f -name '*.py' | xargs sed -i '/@api.multi/d'`
This commit adapts the business code to changes introduced by
the parent commit in order to keep the same behaviour as before.
All readonly=False fields will have to be checked afterwards to confirm
that the business case requires write access to the source field.
*** Activate pay and sign, as well as quotation template, by default when using demo data.
Previously, the features would show by default on runbot because they activated on installing modules.
Now that they are settings of sale_management, we need to specifically activate them for demoing. However we don't want them for on-boarding.
*** Remove the default template from sale_management, move it into sale_quotation_builder
The default template was useless in sale_management because it was empty: it was previously a required field, which is not the case anymore.
It was only filled and used in sale_quotation_builder to display an example quotation, which is why it is now moved there.
*** Update manifests
Fix category of sale_quotation_builder and slightly improve its text.
PR: #26801
task-1876864
[MOV] move sale_payment into sale
=================================
Almost all use cases of sale require sale_payment down the line.
There is only one case which does not: using sale_management without website_sale or website_quote.
However, since we want to move most of the features of website_quote into sale_management, moving sale_payement first will make the task easier.
[MOV] move website_quote into sale and sale_management
======================================================
We want to use some features of website_quote without having to install the whole module.
The main issue with website_quote was that it had a requirement on website.
What is common to website_sale and sale_management has been moved into sale. This is primarily the sales order portal view.
What is only related to sale_management has been moved into it. This is notably: sales order templates, optional products, sign and pay, ...
Everything that requires website has been moved into a new module named sale_quotation_builder. This is related to using the HTML builder to customize the quotation view.
Models, files and routes have been renamed to better convey their purpose and to follow guidelines more closely.
[IMP] merge sales order portal views
====================================
The old sales order view on the portal has been merged into the one from website_quote. The new view contains features of the two.
A lot of fixes and improvements have also been done, related to BS4 issues but also to improve the sales order view in general.
[IMP] add new settings
======================
The commit adds new settings related to activating the features that previously were activated by installing website_quote.
PR: #26345
Task: 49205, 1838924
Victor Piryns (pivi)