The render API was confusing as mixing the access to the report and
the rendering env.
The ambiguity was present for code such as
`report.sudo()._render(record_ids)` where it was not clear if the
`sudo()` is needed to access to `report` or to `record_ids`. For low
priviledge users (such as portal or public), it was common to use
`report.with_user(SUPERUSER_ID)._render(record_ids)`.
This PR changes the render methods signature to be `api.model`. The
`report_ref` can be:
- ir.actions.report external id
- ir.actions.report id
- ir.actions.report recod
- `report_name` value
This will allow to call the report methods with any user and no longer
need to use `with_user(1)` to render reports as public user.
Task-id 2670865
closesodoo/odoo#91341
Related: odoo/upgrade#3650
Related: odoo/enterprise#27323
Signed-off-by: Martin Trigaux (mat) <mat@odoo.com>
In some cases, empty messages can be displayed in the portal chatter.
For instance, if a customer sends a message with no body and just
an attachment, and the attachment then gets deleted, it will still
be displayed as an empty message in the portal chatter.
To solve this, this commit filters out empty messages from the portal chatter.
Task-2833919
closesodoo/odoo#94828
X-original-commit: 10d2a3e01a0fb62860e502cc67e5311b9420a684
Signed-off-by: Warnon Aurélien (awa) <awa@odoo.com>
Purpose
=======
Allow portal users to deactivate their accounts from the portal view.
After the deactivation, they are redirected to the login page, so
they can verify that they can not longer login with their credentials.
We first archived the record and remove sensitive information (password,
login, so he can not log in again with the same credentials).
After the deactivation, we blacklist the email and the phone of the
user, so we are sure that we never send him again email / SMS.
Then, we create a <res.users.deletion> to delete the user and the
partner in a CRON because this operation can be heavy (write_uid,
create_uid field on all models).
Task-2629544
Part-of: odoo/odoo#78298
Default value for attachment_ids / tokens is None. However a check method consider those
as lists and check their length. When calling chatter_post without giving at least a void
list there is therefore a crash that can be easily avoided.
closesodoo/odoo#94695
Signed-off-by: Thibault Delavallee (tde) <tde@openerp.com>
Steps to reproduce
------------------
1. Create two partners A and B.
2. Create a shareable record, e.g. a sales order, and set A as the customer.
3. Share the record with B.
4. Use the share link sent to B and comment on the record.
5. Your comments will be sent with A as the author.
Expected behavior
-----------------
Share links sent to a customer should make you comment as that customer.
Task-2883044
X-original-commit: df162acc589b74b0e3c1e9687ce6a1980233f5f1
Part-of: odoo/odoo#94695
*: auth_signup, portal, web, website_knowledge
When navigating in the iframe, only same origin redirections should be
open in the iframe contentWindow. External redirections should be done
in the top window.
Some internal pages had to be served with X-Frame-Options header set to
SAMEORIGIN, and Content-Security-Policy to "frame-ancestors 'self'" (see
[1]).
All the links that are redirecting to another host, and the client
actions, are opened in the top window.
Exemples that will be opened in the iframe's top window:
- Clicking on a link google.be that should not open in a new tab
- Clicking on the language selector and adding a new one, or
clicking on "logout".
[1]: https://github.com/odoo/odoo/pull/78298#discussion_r898853383
See merge commit for more information.
task-2687506
Co-authored-by: Arthur Detroux <ard@odoo.com>
Co-authored-by: qsm-odoo <qsm@odoo.com>
No method was readily available to know if a user is `internal` (has
group `base.group_user`), which was inconsistent with other base groups.
_is_internal is now used in the codebase where it is clear that
`.has_group('base.group_user')` is called on a single record.
Part-of: odoo/odoo#85703
When portal is not installed and `auth_signup.invitation_scope` is "b2c",
visitors can create an account, leading to a blank page. Still, accounts can be
required for several use cases in apps that do not require portal (such as
survey).
We here add a landing page for users that created an account but have no
requested redirections and cannot be redirected to a customer portal either.
auth_signup_uninvited is also updated in model to be consistent with config
data.
Tests are added to check this behavior.
Task-2762102
Part-of: odoo/odoo#85703
Purpose
=======
Change all masculine nouns in Odoo's code to neutral nouns (when
possible), making sure that demo data is correctly handled. This is
particularly important since our code is open source, and nowadays lots
of machine learning models are trained on open source repositories.
With this small change we contribute to training more "fair" models, and
teaching models that "employee" or "user" != "he".
This also affects some text visible by the user, hence making it more
inclusive for Odoo users.
Task-2853046
closesodoo/odoo#91292
Related: odoo/enterprise#27302
Signed-off-by: Thibault Delavallee (tde) <tde@openerp.com>
The odoo.addons.web.controllers.main python module have been splitted
over multiple files on the basis 1 controller = 1 file. In this work we
adapt all modules to use the new imports.
A non-exhaustive list of where stuff have been moved:
* main.Home --> home.Home
* main.Session --> session.Session
* main.WebClient --> webclient.WebClient
* main.clean_action --> action.clean_action
* main.ensure_db --> home.ensure_db
The complete list is accessible in odoo.addons.web.controllers.main.
closesodoo/odoo#87571
Related: odoo/enterprise#25746
Signed-off-by: Raphael Collet <rco@odoo.com>
Add the possibility for portal users to manage API keys
in the frontend portal interface.
- Allow for portal users to manage their API keys if the system parameter
`portal.allow_api_keys` is set.
A settting in `res.config.settings` is added in order
to enable or disable the feature (to add/remove the system parameter)
through a compute field,
to avoid adding a new database column in standard
(as this revision targets stable 15.0).
The setting appear only in debug mode.
- Display the API keys in the portal in debug mode only
(as in the back-end for regular users, in their profile)
- The flow in the frontend is a mimic of the flow from the backend,
the wording and the look and feel is from the back-end.
closesodoo/odoo#86915
Signed-off-by: Denis Ledoux (dle) <dle@odoo.com>
This commit is the 14th commit of a comprehensive refactor of our HTTP
framework. See odoo/odoo#78857 for complete historic, discussions and
rationnals.
* `request.uid = x` => `request.update_env(user=x)`.
* `request.context = x` => `request.update_env(context=x)`.
* `request.context = dict(request.context, x=y)`
=> `request.update_context(x=y)`.
* `request.cr = None` => `request.cr.close()`.
* `http.mono_db()` => `request.db`.
* `http.dispatch_rpc()` => `service.dispatch_rpc()`.
* `@service.model.check` => `service.model.retrying()`.
* `request.endpoint`
=> `env['ir.http']._match(request.httprequest.path)[0].endpoint`.
* `request.routing_iteration `=> `removed`.
* `request.jsonrequest` => `request.dispatcher.jsonrequest`.
Note that `request.params` is now set much later in the process. If you
are in a situation where you values from the query string or the
http body you can use `request.get_http_params()`.
Note that using the new `request.future_response`, it is possible to
add headers and cookies on the response object before the response
object is initialized. Please note that headers/cookies saved on
the future response will NOT be injected in case of error.
PR: odoo#78857
Task: 2571224
In order to reduce friction and ease the rating process for attendees,
we do not force the constraint stating that the message must contain a
message or an attachment onto the users. Instead, we allow ratings and
replace the empty message by a blank space to avoid triggering the error
message. If no stars are selected, an error message is now displayed to
the user, asking to select a rating before submission, preventing them
to post their review until then.
Since we do not really support 0 stars ratings, and do not want the user
to see that error message in case of the course, we set the default rating
to 4.0 instead of 0.0.
-> Therefore, we also remove the grey star contrast coloring on first review
since we do not want the user to have the impression a choice has already
be made beforehand. In that case, everything will be yellow.
Void content detection is done by extracting it in both python (portal
chatter post controller) and frontend (submission check) and relaxing it
in slides modules.
Task-2728564
Part-of: odoo/odoo#82792
Purpose of this commit is to make ``get_access_action`` private as it is not
necessary to expose it directly. Website management is also made explicit
using a ``force_website`` parameter instead of relying on context key of the
same name. This allows to better understand the method code flow.
Contains also some code fix / improvements :
* Website forum: update code to better skip the frontend redirection if the
forum is not active and frontend is not forced;
* Website slides: respect force website parameter in redirection;
Task-2710804 (Mail: Clean Mail.Thread API)
Part-of: odoo/odoo#82167
Within portal, subscriptions/sales orders presented in list view have their URL
containing the access_token as a GET param. However, when clicking on a
subscription and using the pager to navigate between records, the access_token
is not present in the URL. In order to keep consistency between the links and
views, this PR adds the access_token as a GET param in the pager as well.
task-2512070
closesodoo/odoo#76673
Related: odoo/upgrade#2752
Related: odoo/enterprise#20357
Signed-off-by: Arnaud Joset <arj@odoo.com>
Adds multi record support to `_show_report`.
Limited to records within the same company to stay as close as possible
to the default behaviour.
Closes: odoo/odoo#75269
See: odoo/enterprise#20334
Task ID: 2611006
Purpose
=======
Clean up messages related to email verification.
Specification
=============
Rephrase messages, add confirmation of email sent and let user change
email.
Do not show "Validation Email sent" if the current user changed their
email address.
PR: https://github.com/odoo/odoo/pull/77617
Task-2647065
closesodoo/odoo#77617
Signed-off-by: Thibault Delavallee (tde) <tde@openerp.com>
PURPOSE
Generic UX improvements for the portal
SPECIFICATIONS
For projects list view,
- clicking on the project should open the list view of tasks with groupby stage
- the number of tasks should not be clickable
For tasks list view,
- display the fa-star of the priority field on the left of the name of the task
- add the following fields on the right of the name:
user_id, time spent, kanban_state
- for the kanban_state,
only display the colored dot and indicate the name of the state on hover
- for the time spent:
indicate the nb of hours recorded / nb of planned hours(or days(as per unit))
(if the nb of planned hours = 0, only display the nb of hours recorded)
For tasks search view,
- add a group by priority and status and reorder accordingly
- add a quick search on status and priority and reorder accordingly
- add a sort by priority, assigned to and status and reorder accordingly
For task form view,
- display the fa-star icon of the priority field on the left of the name of task
- add the kanban state in the top right corner
the kanban_state field should be editable by portal users
increase nb of items displayed in the list view to 80 items per page(generic)
Task-2613330
closesodoo/odoo#74996
Signed-off-by: LTU-Odoo <IT-Ideas@users.noreply.github.com>
Co-authored-by: Xavier BOL (xbo) <xbo@odoo.com>
As mail grows and will continue to grow, ordering views and having right
files is important to understand module organization and content.
Split main.py controller file into two files, one for mail related controllers
(redirections) and one for discuss.
Rename files according to guidelines for wizards and views.
No functional change comes with this commit. This is only code move.
Task-2631873
PR odoo/odoo#75571
This branch adds request.redirect on all requests.
In case of a front end request, we do an url_for to the location.
We removed redirect_with_hash that was only for retro compatibility
local_redirect has been renamed to redirect_query, and param keep_hash has been
removed and moved.
Default code for redirect is 303 now instead of 302.
Now redirect and redirect_query make local redirect by default, you need to
pass local=False to make external redirect.
All werkeug.utils.redirect has been replaced by request.redirect.
Http.redirect now use an http.Response type, and it become easy to add an
override like 'set_cookies' e.g.
Dispatch of a website.page return an http.response too, so we first need to
check if it is a cached version before to check if it is an Odoo Response.
Migrate your code:
http.redirect -> request.redirect(location, code, local)
http.local_redirect -> request.redirect_query(location, query, code, local)
http.redirect_with_hash -> request.redirect
Courtesy of odony for help and review ;)
closesodoo/odoo#72599
Signed-off-by: Jérémy Kersten (jke) <jke@openerp.com>
The company is needed in the context to get the paper format for
instance because of `get_paperformat`
X-original-commit: a1526eb4e5b1eb7cada603d7fcee7bb77c64bbac
Issue
- Install "Sale" app
- Acivate "Discounts" feature in settings
- Create a quotation to a portal user (ex: Joel Willis)
- Add a product with a discount then send
- Logout then login as 'Joel Willis'
- Go to 'My account' then 'Quotations'
- Select the quotation just created and print it
Discount not display in pdf file.
Cause
The current env.user when rendering pdf is the portal user.
To display discount, current env.user must have group
'product.group_discount_per_so_line' who is not the case
even when using sudo() on report template.
Solution
Since Odoo 13.0, the sudo() function does not return the
superuser by default but instead the current user
with a bypass on access rights.
Therefore, must add `.with_user(SUPERUSER_ID)` on report.
opw-2501337
closesodoo/odoo#69272
X-original-commit: 5dde19c92ecee8ac0238bb5c8e71263840534c28
Signed-off-by: bon-odoo <nboulif@users.noreply.github.com>
1) in this commit, improved portal chatter for messaging. when the user sends a
message, the new message is updated in history without reloading page.
instead of submitting a form which reloads page to send message we added rpc call
to send message.
2) rating on courses is implemented by extending portal chatter, applied changes in
website_slides to do reviews without reloading page
3) refactoring: cleaned or removed code
eg. removed form and some input fields as data is not submitted as form anymore,
introduced some methods to avoid duplication of code
task-2054662
Closes https://github.com/odoo/odoo/pull/47746closesodoo/odoo#47746
Signed-off-by: Samuel Degueldre <sdegueldre@users.noreply.github.com>
Co-authored-by: ktr-odoo <ktr@odoo.com>
Co-authored-by: Siddarth Gajjar <sga@odoo.com>
This commit adapts the business code in which
class/module/function/method redefinition took place so that it no
longer happens and the pylint test passes.
PURPOSE
Clean code and be and more performance oriented.
SPECIFICATIONS
Various portal pages hold references to archive_groups. It was a summary
of customer documents for portal, containing a count of all documents split
by model.
Currently its computation is not used. Indeed archive_groups is displayed
only in 'my_details' page that does not hold any document-based reference
or code call. Other calls to archive_groups are dead code as the result is
not used. Since 13.0 it is even not computed on standard pages to speedup
their load (as it was not used).
It is not used anymore and its computation and references can be removed
safely, especially with v14 in mind for which we want to remove dead code
to maintain.
Followup of odoo/odoo#55228
LINKS
Task ID-2329081
PR odoo/odoo#55800
PR #12368closesodoo/odoo#56859
X-original-commit: e75086000ee4317b2ad2994db5d906fbcbd5081f
Related: odoo/enterprise#12830
Signed-off-by: Thibault Delavallee (tde) <tde@openerp.com>
Signed-off-by: Victor Feyens (vfe) <vfe@odoo.com>
Before this commit, the time to compute all counters was making the rendering
of the portal page slow.
Now the count is done in rpc after the loading of the page.
Now you can decide which part you want to show on the portal, and only compute
for these one.
It is not because you have purchase installed for your internal process, that
it means that your supplier use your portal and it avoid the computation for
all end users.
We parallelize the counters in arbitrary 3 rpcs.
closesodoo/odoo#55999
Related: odoo/enterprise#12456
Signed-off-by: Jérémy Kersten (jke) <jke@openerp.com>
* allows portal users to update their password
* and manage their API keys
* any anything technical / security related we may need to add in the
future
Also bridge module for the password meter (auth password policy).
* migrate website to overriding web_login less (still needed to flag it
as website-enabled) and use _login_redirect for its login redirection
override needs
* modify portal and website to not replace / shortcut the redirection
workflow, so it's possible to override those properly if / as
necessary
Before this commit, some errors were shown to the end user when
he tried to login to the mobile app with a portal user.
The problem is the user was stuck to a blank page and wasn't
able to logout even after reloading the app.
Note that even if portal users aren't supposed to access to the
backend, it's quite annoying to not be able to go back.
After this commit, portal users are automatically redirected to
the portal page ("/my") if they try go to "/web". This is the same
behavior as when portal users login via "/web/login".
By doing this we avoid having custom code in the native apps
because we already avoid any login to the app if we are out of "/web".
Note: this commit doesn't cover all cases as portal users are defined in
the "base" module and the portal page is set in the "portal" module.
So this this fix will not work if "portal" is not installed and if you
manually created a portal user (only possible in debug mode).
This is unlikely and we therefore consider that this fix covers the
majority of cases while being the safest.
Task ID: 2266024
opw-2281168
closesodoo/odoo#55439
X-original-commit: 29cbba73a71990e76f497ee892ce16fc7fc53d9f
Signed-off-by: Adrien Dieudonné (adr) <adr@odoo.com>
The record counts are only useful for the badges displayed in /my &
/my/home.
By avoiding those counts on subpages, we gain a lot of useless queries,
improving the loading speed of those sub-pages.
X-original-commit: 79c8384f1bcbcdede030e187008319a70c664571
Using a few regex like
\((_\(.*%s.*)(\) % )([\w\[\]][\w .\[\]\(\)'"]*)\)
($1, $3))
Old syntax is still compatible but starts the migration to the new
syntax that catches error.
Bugs
====
On e-commerce, the portal user is not able to upload
attachment with his comment, under a product.
On website blog, the portal user is not able to upload attachment with
his comment, in the discussion of the blog.
And, in `website_crm_partner_assign`, portal user is not able to upload
attachment with his comment, under the lead/opp.
Issue
=====
In the create method of the mail message, we check is the user can
read the attachment. If he can't, we raise an error.
But, the method that make the verification doesn't care about the access
token. So, when a portal user want to upload an attachment on a "public"
record (without a token on the record to sudoed it) the error is raised.
The portal user give an token for the attachment, so he should be able
to attach it to the message. This verification is done with
`_portal_post_check_attachments` so we can sudo write the attachment
after the creation of the mail message to bypass the verification.
Task-2214795
closesodoo/odoo#51772
X-original-commit: d59f8f62dbc7771fee51c3593f89f9b6832bb7ec
Signed-off-by: Thibault Delavallee (tde) <tde@openerp.com>
render, render_template, load, activity_schedule_with_view,
get_website_pages should all be private:
It should not be possible to render an aribtrary template only with
its name or id
Still need to render some qweb views from js so the method
render_template is kept public.
This explains why the website editor still need read access on
ir.ui.view as we want to allow any snippet to be rendered.
PURPOSE
Clean posting process and improve mail.message definition and comprehension.
SPECIFICATIONS
Website mail defines a website_published field allowing to publish / unpublish
comments on the frontend of some modules. This field has several drawbacks :
* it is used only for front-end people (portal, public) and has no real
effect in chatter / classic discussions;
* it is used only in some advanced front-end module and is not available
in portal by default;
* its naming is not really correct as it is not linked to fields coming
from the website_published mixin and its behavior is not really
the same;
* its use is a bit duplicated with internal flag coming from subtype
allowing to hide messages related to an internal subtype;
* there are overrides of standard mail.message methods just to handle
this flag;
In this commit we change that field by an is_internal flag directly on
mail.message model itself. It tells if share people (customers, share users)
are allowed to read the message. This field can be given through posting
API or set manually using widgets. It is also used in access rights custom
methods and managed like the internal flag of subtypes.
Mailgateway was already using an internal flag for internal note replies. It
is renamed to is_internal and propagated as it is now a standard field. It
also eases code understanding.
Portal is updated to allow managing the flag directly. It means customer portal
now natively allows to moderate customer comments without any need of website
modules.
Rating is updated accordingly. An is_internal field is added, replacing the
related on website published.
LINKS
Task ID 2071556
PR #38692
PURPOSE
Clean posting process and improve mail.message definition and comprehension.
SPECIFICATIONS
In order to be more explicit subtype parameter is renamed to subtype_xmlid.
It therefore clearly indicates it should be a valid subtype Xml ID. Support
of ill formatted Xml IDs is removed because there is no reason to try to
add some random prefix. Give something that exists or go to hell, punk !
LINKS
Task ID 2071556
PR #38692
Steps to reproduce the bug:
- Create a portal user U
- Try to update the details of U from portal
Bug:
A server error was raised because the country_id was set as a character.
opw:2082450
closesodoo/odoo#38924
X-original-commit: 009b632c552822cb9892a2ccdbe9d79947d88a34
Signed-off-by: Simon Goffin (sig) <sig@openerp.com>
Go on the portal with a portal user
Drop a message in the chatter
The message is logged in the chatter from the right partner
Before this commit however, the email that was sent had
its address from of the OdooBot
After this commit, the mail is sent with the partner's email from
OPW 2074154
closesodoo/odoo#38553
X-original-commit: 2ce5d3840c7c43a2226b007a180cb91c5031312c
Signed-off-by: Lucas Perais (lpe) <lpe@odoo.com>
PURPOSE
Allow to manage attachments when updating a frontend review.
SPECIFICATIONS
Currently when posting a review in eLearning or eCommerce one can attach
files to its review thanks for portal composer. Rating popup composer allow
to update its comment and rating. However this edit mode has two limitations.
It does not display attachments previously added and does not allow to add
attachments.
This commit fixes that by
* giving attachment values to the composer, allowing its display by the
composer display at startup;
* allowing to give new attachments and properly handle them in slides
route;
Uploaded and validated attachments cannot be removed by users. Indeed
message with attachments has probably already be sent to people and removing
attachments would lead to information loss.
LINKS
Task 2066600 (manage attachments)
Task 2058595 (eLearning v13 testing)
From the user's frontend "My Account" page:
- Try to edit your details.
- Complete the form with all required fields.
- Select a country for which there are no states
(the `state_id` field is hidden)
- And confirm
=> Internal server error
The state was not filled, therefore the value sent to the server
is an empty string. This empty string is used in the UPDATE
query to register the state value. Since it's a string and
not a valid (integer) id, the query fails.
closesodoo/odoo#36272
Signed-off-by: Yannick Tivisse (yti) <yti@odoo.com>
Follow up of 3620cb68a0
`split` called on an empty string returns a list containing the empty string.
The previous commit assumed it was returning an empty list.
closesodoo/odoo#35773
Signed-off-by: Christophe Simonis <chs@odoo.com>
Martin Trigaux