* Make Users._login and session.authenticate always raise AccessDenied
on authentication failure instead of only sometimes (cf
Session.authenticate calling security.check() which raises and not
catching the exception)
* Alter AccessDenied such that it's possible to add a custom access
message, for use with login rate limiting instead of smuggling the
information via the session
* Alter the RPC endpoints to catch and convert AccessDenied back to
a boolean sentinel
Task 31122 section 4.
Implement per-IP rate limiting of login attempts after some number
of failures.
* check_credentials has no reason to be public, make it private
* add hooks to check for login cooldown on a source IP (remote_addr:
http://werkzeug.pocoo.org/docs/0.14/wrappers/#werkzeug.wrappers.BaseRequest.remote_addr)
basis
* add baseline/default configuration of 60s cooldown
* add baseline threshold of 10 login failures, after checking odoo.com
logs it looks like we have short runs of up to 7 failures (assumed
to be legitimate) before the user either gets it right or goes and
looks it up
Depends on #24187
Task 40692
Various changes to import/export (mainly) UIs:
* default to excel & "full" (non-import-compatible) export
* auto-detect encoding of CSV using chardet
* remember column -> field mapping after having imported a file (useful
for repeated imports where auto-matching failed)
* better handle localised booleans & column names
* automatically select source list view's fields when exporting
* better integrate import templates feature and add a number of templates
According to RFC 6266,
content-disposition = "Content-Disposition" ":"
disposition-type *( ";" disposition-parm )
disposition-parm can't be an empty string, and thus a ; in terminal
position is not legal, even though browsers apparently work around it.
When posting an svg image, Odoo tries to resize it for thumbnailing
(like any image).
However this is of no interest since this is a vectorial file format, and
furthermore it distastefully makes the image library Pillow crash, since it only
supports raster formats.
The result would be a broken thumbnail instead of the image itself.
By not setting the thumbnail size if the mimetype contains svg,
we ignore the thumbnailing altogether.
Note that this only applies to the admin user, as otherwise the file is
treated as binary and thus no thumbnailing occurs anyway.
opw 1841153
Before this commit, when uploading a file as attachment in Safari,
The file icon kept on showing 'downloading' whereas the request was successful
This was because the return from the server had a different UTF-8 norm than Safari
After this commit, it works well
OPW 1836545
closes#24307
Before this commit, whenever we do an operation on any of these custom views,
such as folding it, the custom view was saved by creating a new one.
This behaviour comes from a lost feature to undo operations on custom views.
Since we do not have this feature anymore, it makes no sense to create new
custom views on save, instead of applying the changes in place.
With this commit, custom views are edited in place.
Fixes#23712
Before this commit, whenever we do an operation on any of these custom views,
such as folding it, the custom view was saved by creating a new one.
This behaviour comes from a lost feature to undo operations on custom views.
Since we do not have this feature anymore, it makes no sense to create new
custom views on save, instead of applying the changes in place.
With this commit, custom views are edited in place.
Fixes#23712
- With the removal of the password field on the sessions (https://github.com/odoo/odoo/commit/da1f153d61d747d9357694382fe04f96c0ca886a) the non qweb reports going through the route '/web/report' were not able to be generated.
We address this issue by avoiding to call dispatch_rpc and by using the functions to generate the report directly.
This doesn't cause any security issue because the route '/web/report' is callable only by logged in user.
Meaning that the session is already validated.
Without this commit, a valid route /web/content with an extra
params eg utm or adwords will return a 500 with:
TypeError: content_common() got an unexpected keyword argument 'extra_param_name'
This commit closes#21221
Task-32836 should fix for all routes in a future version
Before this commit there was no option to avoid resizing images when it
was smaller than expected size. This leads to several image being displayed
with extra and unnecessary padding due to resize. This option will allow
to avoid that behavior by allowing to propagate the parameter directly
to image_resize_image.
This commit is related to task ID 31994 .
Before this commit, if the first exported field of an M2M is `id` (the
xid) the entire M2M is folded into a single cell with comma-separated
xids and any following field is ignored. If `id` is any but the first
field, the export behaves normally (with the m2m exported as a "table"
inside the parent record).
This behaviour makes sense for import-compatible exports where the id
is the only thing which can be exported anyway, but it is troublesome
outside of that mode as the behaviour of m2m under export becomes
incoherent/unpredictable (ish) as it depends on the position of the
m2m's `id` in the exports list.
Change it so we only perform folding in import-compatible mode (which
is the default for backwards compatibility with e.g. API calling
export_data directly & the like).
opw-813361
Fixes#22600
Xavier Morel