In v8, it was not allowed to create a DB with a name containing a space.
This should still be the case from v9 since it causes issuesfor backup
scripts, for example.
Reintroduces 1a0e9063d4
opw-727613
We generally consider this a low priority issue
as it is social-engineering based and many easier
options exist for targeting gullible users.
Nevertheless, protecting a couple of obvious pages
does not hurt.
About a `sudo` on ir.ui.menu, this commit (3649b7f359) removed it,
this commit (3d0cc2d6d2) re-added it.
Since portal user can not go on /web anymore, I think portal does not need to read ir.ui.menu.
Here some news scenario:
- if website is not installed, portal can log in, but will be redirected to login page
with an error message 'only employee can access'. Indeed, there is no page to display for
such user.
- if website is installed, but not website_portal, portal user can log in and will be
redirected to homepage. If he tries to manually access to /web, he will be redirect to
login page with access error (even if he will still be logged).
- if website_portal is installed, the portal user can fully enjoy its features.
The notification mail template of a SO and an Invoice displays the logo
of the company. However, the logo is always the logo of the superuser's
company.
When accessing the logo from an email client, the UID is not defined.
Therefore, we fall back on the superuser, and display the logo of his
company.
We add the support of a `company` key in the kwargs, so we can force the
company from which we retrieve the logo. Note that this key was used
elsewhere, such as:
addons/web/static/src/js/web_client.js
opw-705420
The database manager and selector triggered an internal server error
according to the modules installed.
The issue is that some modules (like utm) overrode ir_http's dispatch
and openned a cursor before calling super. Following rev[1], the
database manager can tell you the incompatible databases. For that, it
opens a new cursor to each database and get back the Odoo's version.
After the information is fetched, the cursor is closed. Closing a cursor
does not release it from the connection pool, so the database cannot be
dropped and here comes the fix [2]: this commit removes all cursors to
`database` from the connection pool.
Now, if a module overrides the ir_http's dispatch and open a cursor
before calling `super`, the automatic commit/close done at the end of
a successful request cannot succeed in the database manager or
selector as the cursor is closed during the call to super, leading to
an internal server error.
To workaround this issue, we explicitely set the cursor to None, as it
will prevent the automatic commit/close at the end of the request.
This is similar to rev 5c6087e38e
[1] 96f703ff84
[2] 610036756a
Proxy.load is required by the livechat when it is embedded in an
external page, so that it is able to get the static xml files
(with the correct base_url).
opw-706497
With 003d85b instead of getting the name of the relation
field_relation we get field_relation/id.
But the data about the related fields are not gotten all at once when
opening the export modal. They are gotten by clicking on the arrow of
the related record.
So we need to have these /id information saved in the export list,
otherwise for example the related records can be missing when exporting
from an export list, whilst everything was OK without using the saved
export list.
With the previous change, an export list could contain an id and .id
fields for the same relational field, so a change must also be done in
fields_info method used when getting a saved list.
opw-665994
opw-693535
note: adapted forward-port of 8.0's 29be9ae80 which was lost when
merging web enterprise onto web community.
ir.needaction_mixin is not used anymore by the webclient.
From 9.0, the concept has changed: this feature is now
available in mail module, with the mail.thread mixin,
and message_neeadction field.
Remove all code handeling needaction bullet and
counter on ir.ui.menu, knowing that since 9.0
webclient does not display the counter anymore.
This code was, thus, useless and some RPC calls
were done for nothing, and adapt accounting
reconcialiation widget.
Explicitly remove the cursor of the request. Dropping a database
is not transactional and if overrides of ir_http's dispatch worked
with the database (for example, utm), we are not able to commit
the changes at the end of the request.
It worked nice before rev 40561b0fb6 that changed the use of self.pool
by request.env. Note: a cursor is always attached to an environment. Since
the call to super possibly broke the cursor (for example by dropping the
database), the end of the dispatch operation that try to commit and/or close
the cursor could possibly result in the traceback 'unable to close a closed
cursor' with request.env. With self.pool, it didn't happen because the
code actually called in the utm's dispatch override doesn't use a cr
and so there's nothing to close.
Until 9.0 our psycopg2 DSN connection strings do not allow having
spaces within the db name, and passing some can cause duplicate
registries to be loaded.
Stripping spaces is a simple workaround until we actually support
spaces within db names.
Fixes#13078
Christophe Simonis