Before this commit, everyone could use the `fw` query string to force a
website during the dispatching. Plus, it would not require multi-website to be
enabled (multi-website only display UI elements, it does not affect behaviors
as they are already triggered even if multi-website is disabled).
This was intended but caused an issue for public users.
Indeed, the code that would force a website during the http dispatching would
be executed in `_add_dispatch_parameters`, after the auth methods.
Then, the request.uid would be the one from the website we were leaving and not
the one of the website we are forcing.
Public user would then not be recognized as such (if both websites have their
own public user) and would have interface glitchs (considered as connected).
Note: Next reload or page navigation would set the request.uid correctly.
Now:
To avoid such a behavior, we decided to allow only designer user to be able to
switch website with the `fw` query string, and only if multi-website is
enabled.
Note: The designer group check is done on the leaving website and not the
forcing one as `_add_dispatch_parameters` is executed after auth methods.
There is no way to check with which user the user will be logged on the
forcing website (Public, Same user, different user?).
Also, it would have to handle the same domain/different domain.
Step to reproduce:
- Activate multi-website
- Activate multi-company
- Create SiteA and SiteB
- Create CompanyA and CompanyB
- Set CompanyA on SiteA and CompanyB on SiteB
- A new public user will be bootstraped for CompanyB
- Optionnaly, setting manually a different public user for CompanyB will do
the same.
- Go to website 1, request.uid is PubUserA and request.website is SiteA
- Navigate to website 2 with `?fw=2` in URL, request.uid will be PubUserA and
request.website will be SiteB.
This is wrong, request.uid should be PubUserB as we are on SiteB
This will result in multiple bug, mainly the non logged user will see the
dropdown in the navbar as if they were logged in showing 'PubUserA'.
Fixes#27998closesodoo/odoo#29136
- Changed the binary_content method
to make it more generic and allow alternative ways of checking
the access rights by using a new method check_access_mode.
Reason: Asked by ODO following documents' security review.
- if all pages are processed, splitting a pdf will
archive the original attachment.
Reason: FP feedback.
Task: 1853490
Forcing website on session before navigating to the other website would not
work as expected if the other website has a different URL (hostname).
It would force the website on session on current website, then navigate to
second website which could still had another website in session.
Now, we force the website in session once we land on the website in the
dispatch() method.
Step to reproduce:
- Set website1 to 127.0.0.10
- Set website2 to 127.0.0.20
- From website1 click on website2 in website selector
- Website2 is forced on website1 session (wrong)
- You land correctly on website2 and see website2
- From there (website2) click on website1 in website selector
- Website1 is forced on website2 session (wrong)
- You land on website1 but see website2 since website2 was forced on
website1 session at steps 3/4.
This is even more trickier when there is a third website without a domain in
the equation (meaning this website can be seen from website1 and website2
without changing URL (hostname)).
-removed force_ext from ir.http.
-added signature arg to web/image to differentiate cache entries by URL.
-added an embed youtube viewer for youtube URL's
-added a PDF splitter to the PDF viewer UI
-added tests for mail's Document Viewer
-added a "signature" param to web/image to go around the browser cache
-thumbnail field of ir.attachment is now stored in the filestore
as a distinct attachment.
task 1853490
Co-authored-by: Pierre Paridans <app@odoo.com>
From now, when you install a theme, it load the data from xml to template
table theme [ir.ui.view|ir.attachment|website.page|website.menu].
Data are only copied from this template table into the real table when you
choose a theme on a website; Making them website_specific and with a link
to the original to allow futur update.
A special case is done to create theme.ir.ui.view when you are installing
a theme, even if you continue to use template tag to create quick view.
Co-authored-by: Derie Romain <rde@odoo.com>
Co-authored-by: Kersten Jérémy <jke@odoo.com>
Set up env & tools for module website multiwebsite (blog, event, sale..)
website_id in modelConverter and ir_rule
add _compute_domain_keys to have a different cache per website
or rules would not be correctly website_dependant
eg: blog 1 on website 1, blog 2 on website 2
access blog 1 from website 1 => can access -> normal
access blog 1 from website 2 => can access -> should crash because (ir rule)
split mixing website.published.mixin and website.published.multi.mixin to have
website_id only on last one.
multi mixing will:
- override website_published compute to take current_website into account (not in backend)
- force website when clicking on published in backend
- website blog, website_sale, website_event, website_forum, website_slides are now multi website
Co-authored-by: Derie Romain <rde@odoo.com>
Co-authored-by: Kersten Jérémy <jke@odoo.com>
Fix bug from the initial poc of JOV
Fix menu creation
- creating a menu would create a 'container' menu in the DB (.create is call without website_id)
then writing on it would copy (if condition to cow) the menu with a website_id leaving the first
one as a menu container unused.
- website_menu should always have a website_id
we dont want to support the multiwebsite system that allow to have generic/specific menu
unlink/write is useless now since we always have a website_id
Make unique_path website dependent, 2 distinct website can have a page with same name
Make Sale report multiwebsite compliant
Make website_id on sale_order / account.invoice as a related stored from partner_id.
Co-authored-by: Derie Romain <rde@odoo.com>
Co-authored-by: Kersten Jérémy <jke@odoo.com>
Now we can see which specific page override wich page when page are sorted by url.
Co-authored-by: Derie Romain <rde@odoo.com>
Co-authored-by: Kersten Jérémy <jke@odoo.com>
This implements support to administer multiple websites. Although the
core functionality already existed, managing multiple websites was
fairly technical.
In the interest of database updates and migration this attempts to
keep duplicated data to a minimum. To do this the usual generic
records are rendered unless some website-specific record exists that
replaces it. Copy-on-write (COW) is used to create these
website-specific records. Through this mechanism creating a
website-specific record is delayed until necessary. A COW mechanism
has been implemented on 4 models: ir.ui.view, website.page,
website.menu and ir.attachment. These COW mechanisms are activated
when editing data through the website (aka frontend). These frontend
edits (e.g. with web_editor) will be website-specific, possibly
creating a website-specific record when necessary. When editing data
in the backend nothing special will happen, even when editing a
generic record. Note that because of this mechanism also facilitates
the ability to create new, uncustomized websites because the generic
data is kept.
Support is provided for a website to have any theme. Themes are fairly
complex to handle. Standalone themes can depend on other standalone
themes (e.g. theme_beauty depends on theme_loftspace) and themes
usually modify some data of the themes they depend on. Because a theme
can be installed on multiple websites, using website_id m2o fields
does not work well. It would require duplicate data, making updates
and migration harder. Because of this, data for themes (ir.ui.view and
ir.attachment specifically) have a theme_id m2o. website has a
theme_ids m2m that identifies all theme modules currently installed on
it. Through these fields we figure out what to render. A theme is only
fully uninstalled when it's no longer active on any website. The
advantage of this approach is that upgrading or migrating theme data
is no different from the single-website case.
The website.published.mixin class was modified to handle multiple
websites. A wizard was added in the backend to easily manage this for
multiple website.
Although not used anywhere in this commit, a 'website_id' variable has
been added in the evaluation context of ir.rule. It allows to easily
make any model multi-website aware, all that's needed is a custom
website_id m2o field on a model and a custom record rule.
This commit is the counter-part of an enteprise commit introducing
the Documents app.
Here is a summary of what has been done:
- tweak unlink of ir_attachment to prevent unlink recursivity
(when attachments are attached to ir_attachments)
- improve ir_attachment kanban view
- add several arguments to binary_content controller:
- 'force_ext': to force the extension in the filename, base on
mimetype
- 'share_token' and 'share_id': to autorize download from a
share link
- add 'thumbnail' field on ir_attachment to optimize Kanban view
- add 'upper_limit' argument to image to allow to bypass the
500*500 size limit
- DocumentViewer now handles text files
More information available on task 1853490
Co-authored-by: Pierre Paridans <app@odoo.com>
Co-authored-by: sri-odoo <sri@odoo.com>
Co-authored-by: ThanhDodeurOdoo <tso@odoo.com>
web (tagged with `openerp-web`) translations are loaded in the backend, in
`odoo.addons.web.controllers.main.WebClient.translation(mods=None, lang=None)`
method (through `/web/webclient/translations` controller).
In website, the controller `/website/translations` is called used, fetching
the translations from modules with the (fragile) clause `name ilike 'website'`
This commit fixes two bugs:
1. Install `website_sale`, activate discussion on products
-> the chatter is not translated as the portal translations not loaded in the
`/website/translations` controller
2. Install `helpdesk` but not `website`, go to portal view of a ticket
-> the heldesk chatter is not translated as the `/website/translations`
controller is not called (only provided by the website module)
This patch implements a modular approach to translate the web resources of the
right modules only.
The controller /website/translation is moved to http_routing and each module
override the new _get_translation_frontend_modules_domain method to adds its
translatable module
Closes#23618Fixes#23610
Before this commit if /foo redirect to /bar?a=1
/foo?debug=1 was redirectd to /bar?a=1
After this commit,
/foo?debug=1 is redirected to /bar?a=1&debug=1
Website Versioning module (website_version) is applied when displaying
views by interfering when doing the "render the view of this `key`" and
showing the view with the same `key` but of the currently displayed
version.
The website.page model when directly rendering a page would directly
specify its `id`, thus website version was bypassed and just the master
page was displayed.
With this commit website.page has a "get_view_identifier" that can be
overrided in website_version and has the same previous behavior
otherwise.
This changeset also solves a conflict (`website().get_current_website`
also modify `request.context`) when modifying the context which also
disabled versions.
opw-1824957
closes#23847
Don't rewrite the wheel with serve_404.
It is the job of HandleException to do it.
In the same time, that will fix the status code that was
previously 200 instead of 404 in serve_404
This commit closes#22438
This field should be required.
This commits closes#21997
@kangol: diff in addons/website/models/ir_http.py is for existing db
It can be ignored in master because required will be apply
Before this commit, website had incomplete context.
It was causing website.menu to not be translated correctly because lang was
not set on website.
Now, since the website has the context correctly binded, menus are translated
opw-787012
Clean method _add_dispatch_parameters
Remove unused code for caching
Call super before to have the correct lang when we browse website.
Without it, menu was not loaded in correct language.
Before this public users could see pages before their
date_publish.
request.website.is_publisher is a function that always exists. So the
if body will never be executed. Additionally, is_visible is a
non-stored computed field that can't be searched. So instead grab all
records that match and filter the ones that are visible.
This commit closes#20296
This reverts partially commit ab2283ef83.
This commit clean and clarify some code.
It also secure the call to specific page extension's template to avoid somehow
calling unexisting tempalte
Before this commit:
1. You could create a page with supported extension in the path (eg: myfile.js)
You would then be redirected to the webeditor (myfile.js?enable_editor..)
But in this case, it would just redirect you to a plain text page without odoo
layout because supported extension are rendered with a specific mimetype.
(is it is a .js page, it will just render the page content as a js file)
2. These kind of page would still call t-layout that you should be removed in
backend in order to make it work
Now:
1. You will be automatically redirected to the back end to edit your file
instead of landing on a text-only page.
2. Supported extension now have their own template (eg: .js file now have
<script text=..> tag added automatically in their content)
Before this commit, the website.redirect records would never been called since
we switched call order from redirect>page to page>redirect.
It would always render a 404 and would never check redirect records.
Now, if there is no page found, it will check for redirects and if no redirect
found it will return 404.
Don't add useless routes or route that will return 404.
Improve generate function from ModelConverter to have a better management of
query_string.
Now we have an helper sitemap_qs2dom that will analyse the current route and
check if query string is plausible and if yes, generate a domain, when the
query_string don't seems to match the route, we return a Falsy domain.
Before this commit, if qs was /product/ipad, enumerate_page check for each
modelconverter of the route a name ilike '/product/ipad'.
Now we check all routes that contains product and one converter that match ipad
or routes that contains ipad and one converter that match product.
This commit a new way to declare the sitemap for a route.
def sitemap_xx(env, rule, query_string):
yield {'loc': '/my_url'}
@http.route(..., sitemap=sitemap_xx)
In this case, only the loc returned by this function will be in the sitemap
for all rules.
You can pass sitempa=False, if you don't want that route are into the sitemap
Introduce a new attachment field (access_token) to allow external
unauthenticated access. This will be an opaque unique number
(typically a UUID) that should be provided via an appropriate
controller, for unauthenticated display.
The field is intended to be NULL unless unauthenticated access has been
allowed, in which case a value will be set for the access_token.
This could be used e.g. for allowing access to images within mailings,
even when the recipient is not logged in (which is sometimes entirely
impossible, when email providers use restricted proxy servers to
load images)
Note 1: this is still a work-in-progress, but serves to freeze the API.
The implementation of the access check and provisioning of the new
field will be added later.
Note 2: namimg collisions with the file download token prevent the use
of a shorter 'token' parameter for download routes.
Apologies for the late (and incomplete) addition in saas-18 :-/
website.page = old ir.ui.view with page=True
website.redirect is a new mechanism to replace in the futur the ir.attachment
mechanism of redirect.
From now, we don't have a specific /page controller to serve 'page'.
We use a new model website.page which is rendered if none route matches the url
and that the field 'url' on website.page matches the request.httprequest.path.
The order to serve a path is:
- Routes defines in controllers (/shop, /blog, ...)
- ir.attachment with name matching the path
- website.page with url matching the path
- website.redirect with url_from matching the path
- 404
To improve:
- allow regexp in website.redirect model
- allow to edit the view_arch from the page.management via redirect backend
(needed when traceback in the page, or when modifying a js/css/less/...)
Let us completely support auth_signup_token and auth_login in request
session and parameters in the auth_signup module instead of in various
separate places.
Code managing language in URLs and redirection is moved from website
to http_routing. Override of _dispatch in website now consists in adding
website to the request.
url_for and is_multilang_url tools methods are also moved from website
to http_routing.ir_http as those are required for the moved code.
Some renaming is performed on request attributes previously added in
website. Indeed as website keyword may be misleading now a renaming
has been performed to better understand them :
* request.website_enabled -> request.is_frontend
* request.website_multilang -> request.is_frontend_multilang
* request.httprequest.cookies.get('website_lang') -> ('frontend_lang')
* first_pass variable in _dispatch is replaced by a new attribute of
request, routing_iteration, that is the number of routing iterations
currently done
ir_http override in website manage languages through methods or attributes
directly defined on website model. Those methods are get_languages method
and default_lang_code attribute. In order to be able to have a translation
layer independent of website we have to have access to this data without
depending on website record.
This commit solves this by adding class methods on ir_http override
located in http_routing. Basic implementation comes directly from website
default methods _active_languages and _default_language. Website overrides
those methods in order to be based on website values defined through
language_ids and default_lang_id for available languages and default
language.
Website behavior is therefore untouched whereas http_routing implements
a basic default behavior. This commit updates ir_http code in website
to use those methods and ease next commits which will move parts of that
code.
Slug and unslug API is now available in http_routing. Indeed there is no
link to any website or any reason to not support slufigied URLs when
website is not installed. A new unslug_url method is added as a tool
coming from an embedded method from website. Doing it allows to have all
slug related methods defined at the same point.
Support of slug and unslug in qweb rendering is also moved directly in
http_routing version of ir_ui_view instead of website inheritance. This
is done in order to keep things coherent.
Some code from website about ModelConverter is also moved. Indeed both
versions of ir_http uses some kind of placeholder to store the uid
when converting urls to python. This commit unifies it by using the
website one directly in base to simplify the override.
This commit also updates all module importing slug. Enterprise modules
will have to be updated, see related commit.
Calling super when it is possible it always a good practice. It ensures
to have a basic behavior that is the fallback when the behavior defined
in the inheritance does not apply. Previously the base behavior was done
directly in the inheritance without calling super. This commit improves
that and calls super like a pro.
When you receive an url with parameters
* auth_signup_token: uuid
* auth_login: login
those will be stored in the session and used
* when the user will want to sign up in order to be linked to the right
partner;
* when he logs in so he's sure to log in with the right account +
autofill is nice
This commit only adds the support, future commits will support its use.
Romain Derie