The current user was used to generate the sitemap. So if a user with
more permissions than `public user` goes on the sitemap, he could
generate it (if he is the first to see it or the last generation was
more than 12 hours ago (by default)) and have pages unavailables for
a user with lower permission in the sitemap (until the sitemap is
generated again).
The issue was solved in 8.0 with d08facdcb but was introduced back in
10.0 with fd09ddb6f because the `uid` argument was dropped from
`generate` method on `ModelConverter`.
From 10.0 up to saas-14 the fix introduced is to use a `use_public_user`
key in `request.context` but in master we will keep the fd09ddb6f fix
by adding uid to the `generate` method.
opw-708456
note: to forward-port only up to saas-14
Template "sitemap_index_xml":
<loc><t t-esc="url_root"/>sitemap-<t t-esc="page"/>.xml</loc>
should be:
<loc><t t-esc="url_root"/>sitemap-<t t-esc="website_id"/>-<t t-esc="page"/>.xml</loc>
The fix in python is not elegant but allow to fix without -u of website.
Commit e11f23b701 split the website
customize_template_get into web_editor and website ones. This split
was not perfect and commit 20861b482a
tried to make it work... but did not made it totally and added an
indirect dependency to website module in web_editor...
As the final result is wrong and inconsistent and that the previous
9.0 implementation was already ugly, this was not possible to make
a consistent full-stable fix.
This commit tries to make a fix as stable as possible (the main method
name did not change, the arguments did not change, their purpose is
the same, ...) which makes the code work and be less ugly. However,
the function returns are now slightly different (and JS depends on it).
It returns only valid view information (not header stuff which is not
related to anything and the inherit_id value is now a combination of
the inherit view id and name). Also, a new private method has been
created.
Also, the method contained code which was deprecated since saas-6 but
was never removed (and never broke anything "by chance").
In master these methods will be refactored to make more sense.
The commit e59a7fe3ff has moved
the ACE editor from website to web_editor. As some code on ir_ui_view
was used for this widget, the code has also been moved to web_editor.
The dashboard must be visible for non-'group system' users, hence
the sudo call + only display the link to modify the client id
if the user has sufficient access rights.
Small visual correction for live users counter in the dashboard.
The Website Admin dashboard displays graphs for sales, analytics,etc.
using a (somewhat easily) extensible js framework.
Unfortunately, this framework is ACL unaware, meaning that it will
completely and silently crash if you are missing any of the required
access rights.
To solve this, extensions must now specify not just a graph name
but a necessary group for it and set the value for this group in
the extension of the backend controller.
This commit also
- make the icon visible for the group 'Website Designer and Editor'
(not juste the Settings group, which is extremely restrictive)
- make the button to set the Google API key only visible to people
with sufficient access rights
When logged in a user was redirected to the website instead of the backend.
This was due to a wrong group verification, at that point:
- request.uid = ID of the user authenticating (e.g. admin)
- request.env.uid = ID of the user that rendered the page (public)
As public does not belong to `base.group_user` group, the user was redirected to
the website.
Introduced at fd09ddb6 during migration.
Fixes#13203Closes#13204
Since saas-3, website controllers use `request.website.render`
to render the template of a web page. This was kept for retro
compatibility. It's time to stop using deprecated stuff.
Same for `_render` method on website.
'json' route don't use `request.render` since
`JsonRequest` has no `render` method.
Migration of website module to new API.
The tricky phase is ir_http.py : we need to use `request.env`
only when the authenfication phase is done. Normally by
calling `super` of `_dispatch` method, but website module
required it to be done before. This is important since
`env`is a lazy property of `request` object.
Some hack were kept since this commit is a migration ('RequestUID'
in ir.http, ...)
Some docstrings were added.
Some address have required state.
We add by default moreover 500 new states.
We try also to merge duplicated states
wich have the same country and code.
Once merge is done, we try to had the unicity constraint
to avoid futur duplicates.
Merge code, should be removed in v11.
Before this revision, it was possible to use the
`/website/image` controller using kwargs only
e.g.
`/website/image?field=datas&model=ir.attachment&id=718207`
After, it's no longer possible.
It was assumed `/website/image` without any argument
in the route itself (`<xmlid>`, `<field>`, ...)
could simply never be called,
but this is not the case.
We therefore restore it by retro-compability purposes.
Multiple technical routes were listed in the sitemap,
and it's pointless to list them in the sitemap.
There is currently no way to exclude routes
from the sitemap using a specifc argument
(e.g. sitemap=False on the route).
Therefore, in order to remove them from the sitemap,
we play with the current conditions to exclude
these routes from the sitemap:
- routes with `auth` other than `none` and 'public`
are excluded. Technical routes marked as `auth="public"`
for no reasons are changed to `auth="user" so they
are excluded from the sitemap
- routes with required arguments are excluded as well.
the route `website/image` cannot work without any argument,
`website/image` has therefore been removed from the possible
routes for the method `website_image`, so it's no longer
listed in the sitemap.
For an exhaustive list of the conditions to exclude
a route from the sitemap, check the method
`rule_is_enumerable` in `website/models/website.py`
opw-670865
- add or fix decorators on methods
- fix most compute methods (wrong dependencies)
- revert changes in `eval_context` of `ir.actions`
- various code simplifications and improvements
- migrate methods that were not
- ir_qweb: modify `QWebContext` to take an environment instead of `cr`, `uid`, `context`
- ir_qweb: convert `AssetsBundle` to use new API `env`
- ir_ui_view: use decorator `multi` on method `read_combined`
- ir_ui_view: ensure that method `render` is never called with an xml_id
- ir_ui_view: factor out part of the `ormcache` key of method `_read_template`
Iterator was consuming the first 45k records.
So don't need to specify an offset, because that will ignore the next 45k.
Eg: if step of 5, and range(1,13),
it will only use [1, 2, 3, 4, 5, 11, 12, 13]
Cherry-pick/backport of de8296c3a8
* Remove recursive assets inclusions (i.e. assets_editor was including
assets_common, summernote, ...)
* Better construct the assets (link, then script + type attribute)
* Better include the assets (split js / css, always use t-call-assets)
* Simplifies the number of assets
* Move bootstrap js to assets common
* assets_frontend is now created by web module to allow using it on the
connexion page but also in the web_editor, where colors have to be
bootstrap/theme ones. Note: if a module depends on website, then keep
using the inherit_id="WEBSITE.assets_frontend"
Iterator was consuming the first 45k records.
So don't need to specify an offset, because that will ignore the next 45k.
Eg: if step of 5, and range(1,13),
it will only use [1, 2, 3, 4, 5, 11, 12, 13]
The controller /event/<event_id>/page/<page> raise exception if page is not existing.
Allow to pass the template reference when user are creating a new page.
Without it, it is impossible for the end user to create a website_event page without
change manually the xml id because the xml id is based on the module from the template.
This fix is retro compatible, because from_template will be ignored until next update
of website. And during update from website, website_event will be updated because it's a
dependance and so the default_page template created.
Unsetting the URL of the menu `Home`,
in Settings > Configuration > Website Settings > Configure Website,
leaded to the unavailability of the website.
opw-657572
It seems like nobody other than me ever had issues with this line
since its introduction in January 2015, so I just swapped the
conditions, since this param is seemingly always present, unless
you are using oauth with redirect.
Assets are now split in multiple files and there is not a route which
always leads to the last version of an asset. This commit adapts theme
customization (without reloading) to these new features.
Add multilang=False to website_image controller to prevent redirects
Because website_image is decorated with website=True
Requests made for the product image at
`/website/image/product.template/xx_xx/..`
triggered redirections to add the language code to the
requests URLs. This redirection was useless, as setting
the language code for images is non-sense.
Adding `websitelang=False` prevents this redirection.
In addition, the redirection could lead to
SSL security concerns, as the redirection
could use the http:// scheme.
Closes#8515
Replace deprecate controllers like /web/binary/image, /web/binary/saveas...
Use ETag for all content with 'unique' option to cache the content if the content is never changed.
Nicolas Lempereur