Before this commit, website.page xml record were created in 2 steps:
1. Create an ir.ui.view record with <template> tag
2. Create a website.page record with <record model="website.page">
But this is useless since website.page inheritS ir.ui.view, you can create both
records just in one <record> tag.
Note: This is NOT TRUE in every case:
Odoo's ORM will suffix external_id of inherited records (in this case the
ir.ui.view created through the website.page record) with its model's name.
This can be a problem in some case (this is an example):
website_crm_template.xml create an ir.ui.view inheriting the
ir.ui.view 'website.contactus'.
But if we didn't keep website.page & ir.ui.view records split for that
specific case, the ir.ui.view would inherit a website.page record
causing an error. (website.contactus would be the id of the page record
while the ir.ui.view's id would be website.contactus_ir_ui_view)
In short: when migrating an ir.ui.view (<record> xml) to a website.page:
* If there is record inheriting the ir.ui.view ID, then split
website.page & ir.ui.view
* if not, you can create the website.page and its ir.ui.view both in one
record (<record model="website.page").
This commit also removed remaining page="True" from xml template since we
removed the 'page' attribute from ir.ui.view model overrided in website module.
Before this commit, website.page had a 'name' field which was useless because
website.page inheritS from ir.ui.view which has its own 'name field.
At the end, we were duplicating/synchronizing 'name' field between
website.page and its ir.ui.view for no reason because we were always using the
one from ir.ui.view.
Now, getting website.page's name will always retrieve the one from its
ir.ui.view and there is no redundant information.
website.page = old ir.ui.view with page=True
website.redirect is a new mechanism to replace in the futur the ir.attachment
mechanism of redirect.
From now, we don't have a specific /page controller to serve 'page'.
We use a new model website.page which is rendered if none route matches the url
and that the field 'url' on website.page matches the request.httprequest.path.
The order to serve a path is:
- Routes defines in controllers (/shop, /blog, ...)
- ir.attachment with name matching the path
- website.page with url matching the path
- website.redirect with url_from matching the path
- 404
To improve:
- allow regexp in website.redirect model
- allow to edit the view_arch from the page.management via redirect backend
(needed when traceback in the page, or when modifying a js/css/less/...)
Purpose
=======
- Settings are too complex: too long + too many options that shouldn't be suggested with checkboxes
e.g. twitter roller is now suggested as a new snippet to install from website editor
google maps, slides, forum, etc. should show up in the apps store
- When saving the page I expect to stay in the settings -> no redirection to homepage anymore!
Specification
=============
See task 33620
If the feedback of a form is too slow, people might be tempted to
click a second time, trigerring a second request. If, after that,
the result has not been received yet, the user might be tempted
to click a lot of time because he is angry at such slowness. This
behavior would trigger a record creation each time the user clicked
the submit button. This fix disables the button once it has been
clicked once, and re-enable it if the record could not be created,
which means that there was an error in the input and the user needs
to change the values and try again.
The button has been changed to a span to avoid the default browser
behavior to post the form when no function is bound on the send button.
If the feedback of a form is too slow, people might be tempted to
click a second time, trigerring a second request. If, after that,
the result has not been received yet, the user might be tempted
to click a lot of time because he is angry at such slowness. This
behavior would trigger a record creation each time the user clicked
the submit button. This fix disables the button once it has been
clicked once, and re-enable it if the record could not be created,
which means that there was an error in the input and the user needs
to change the values and try again.
The button has been changed to a span to avoid the default browser
behavior to post the form when no function is bound on the send button.
* make CSRF protection the default on all non-SAFE methods
note: there currently is no way to call a CSRF-protected endpoint
without a form-encoded entity-body as that's the only place we get the
CSRF token from.
* simple CSRF token generation: just use the HMAC'd session id, no
generating a new random token per session then HMAC it
* use constant-time equal function to avoid timing attacks
* assert that a database secret is configured before hashing/validating
the CSRF token
* opt-out database manager from CSRF: The super-admin password serves
the purpose of a CSRF token in the database manager screens.
There is no request database to obtain the
secret and generate a CSRF token.
NB : Some tests have been modified.
One assert statement in orderpoint_calendar.yml has been modified,
but the change is legit has no python method has been modified at all
get argument are processed and set into input fields + hidden fields
save some datas from http headers
controller should save all the submitted vars
bzr revid: chm@openerp.com-20140310162626-libizyxlycvuwo7h
- added error management in contact us form, using a new error argument in the view;
- improved thanks template, to display more like contactus with company description;
- extracted company description in website to be able to re-use it in thanks template
- added optional company_name in contactus form, used to flil partner_name in lead
bzr revid: tde@openerp.com-20131002114818-y369gu6u32uxry1m
rde