- With the removal of the password field on the sessions (https://github.com/odoo/odoo/commit/da1f153d61d747d9357694382fe04f96c0ca886a) the non qweb reports going through the route '/web/report' were not able to be generated.
We address this issue by avoiding to call dispatch_rpc and by using the functions to generate the report directly.
This doesn't cause any security issue because the route '/web/report' is callable only by logged in user.
Meaning that the session is already validated.
Without this commit, a valid route /web/content with an extra
params eg utm or adwords will return a 500 with:
TypeError: content_common() got an unexpected keyword argument 'extra_param_name'
This commit closes#21221
Task-32836 should fix for all routes in a future version
Before this commit, if the first exported field of an M2M is `id` (the
xid) the entire M2M is folded into a single cell with comma-separated
xids and any following field is ignored. If `id` is any but the first
field, the export behaves normally (with the m2m exported as a "table"
inside the parent record).
This behaviour makes sense for import-compatible exports where the id
is the only thing which can be exported anyway, but it is troublesome
outside of that mode as the behaviour of m2m under export becomes
incoherent/unpredictable (ish) as it depends on the position of the
m2m's `id` in the exports list.
Change it so we only perform folding in import-compatible mode (which
is the default for backwards compatibility with e.g. API calling
export_data directly & the like).
opw-813361
Fixes#22600
Before this commit, when the amount of rows was above xls format threshold (>65535), the xlwt library threw an obscure Traceback to the user.
We now test the amount of rows before even calling the library, raising a more helpful message to the user
OPW 767319
closes#19035
The old code don't resize correctly if you use params in request.
because if '200' > 500 => return True
Now we force the casting to int to be sure to compare apple to apple.
before: /web/image/<id>?height=100 => don't return an image with height=100px
after: /web/image/<id>?height=100 => return now an image with height=100px
In case of a MemoryError, there is no error message, the user gets a
"Database restore error: "
without any details.
Instead fallback to the repr.
This way, a wrong password is
"Database restore error: Access denied"
and a memoryerror
"Database restore error: MemoryError()"
Closes#17393
In v8, it was not allowed to create a DB with a name containing a space.
This should still be the case from v9 since it causes issuesfor backup
scripts, for example.
Reintroduces 1a0e9063d4
opw-727613
We generally consider this a low priority issue
as it is social-engineering based and many easier
options exist for targeting gullible users.
Nevertheless, protecting a couple of obvious pages
does not hurt.
The notification mail template of a SO and an Invoice displays the logo
of the company. However, the logo is always the logo of the superuser's
company.
When accessing the logo from an email client, the UID is not defined.
Therefore, we fall back on the superuser, and display the logo of his
company.
We add the support of a `company` key in the kwargs, so we can force the
company from which we retrieve the logo. Note that this key was used
elsewhere, such as:
addons/web/static/src/js/web_client.js
opw-705420
Proxy.load is required by the livechat when it is embedded in an
external page, so that it is able to get the static xml files
(with the correct base_url).
opw-706497
With 003d85b instead of getting the name of the relation
field_relation we get field_relation/id.
But the data about the related fields are not gotten all at once when
opening the export modal. They are gotten by clicking on the arrow of
the related record.
So we need to have these /id information saved in the export list,
otherwise for example the related records can be missing when exporting
from an export list, whilst everything was OK without using the saved
export list.
With the previous change, an export list could contain an id and .id
fields for the same relational field, so a change must also be done in
fields_info method used when getting a saved list.
opw-665994
opw-693535
note: adapted forward-port of 8.0's 29be9ae80 which was lost when
merging web enterprise onto web community.
ir.needaction_mixin is not used anymore by the webclient.
From 9.0, the concept has changed: this feature is now
available in mail module, with the mail.thread mixin,
and message_neeadction field.
Remove all code handeling needaction bullet and
counter on ir.ui.menu, knowing that since 9.0
webclient does not display the counter anymore.
This code was, thus, useless and some RPC calls
were done for nothing, and adapt accounting
reconcialiation widget.
Christophe Simonis