* make CSRF protection the default on all non-SAFE methods
note: there currently is no way to call a CSRF-protected endpoint
without a form-encoded entity-body as that's the only place we get the
CSRF token from.
* simple CSRF token generation: just use the HMAC'd session id, no
generating a new random token per session then HMAC it
* use constant-time equal function to avoid timing attacks
* assert that a database secret is configured before hashing/validating
the CSRF token
* opt-out database manager from CSRF: The super-admin password serves
the purpose of a CSRF token in the database manager screens.
There is no request database to obtain the
secret and generate a CSRF token.
How great is it to get Odoo (almost) 9.0 (almost) translated?
Clean .tx/config file
Regenerate .pot files
Fetch current translations from Transifex (10% completion)
Now that most refactoring has been merged
It is better to have red a great work of another culture in translation than never to have read it at all.
― Henry Gratton Doyle
merge *ALL* the dicts
The form rendering used to receive a dict for partner information and a dict for tx information and to transmit another dict to the qweb template; now everything is done in a single dict
- replace the portal_sale blue ribbon by a website_portal_sale link from the portal home
- remove all fields and methods related to banner in portal_sale
- remove "validation" field in payment_acquirer since it was only used here
- general:
- add payment.method and payment.transaction menu in invoicing
- payment.acquirer:
- add image field
- add stat button to see payment.transaction objects
- payment.transaction:
- language field is now a selection instead of a char
- rename s2s_cb_eval field in callback_eval
- form view cleaning
- on_change_partner_id now fills in the partner details
- add an ir.sequence for transaction name
- add a many2one to payment.method
- country defaults to the country of the company
- payment.method:
- add a one2many to payment.transaction
- add a stat button to see payment.transaction objects
[IMP] website_quote: rename s2s_cb_eval payment.transaction field to callback_eval
[IMP] payment_* (all providers): add image data and rename s2s_cb_eval field to callback_eval
- Preserved explicit 3rd-party copyright notices
- Explicit boilerplate should not be necessary - copyright law applies
automatically in all countries thanks to Berne Convention + WTO rules,
and a reference to the applicable license is clear enough.
Unify and refactor exception handling in framework and addons.
The generic `except_osv` is now deprecated, and replaced by more specialized exception subtypes:
- `UserError` (renamed from Warning, as it conflicts with the built-in `Warning`) raised when a non-technical error occurs during a business operation. It could be a missing information in the data provided by the user, or a misconfiguration.
- `AccessError`: raised when any operation is denied because the user conducting it does not have the required access rights.
- `AccessDenied`: raised when an operation that requires authenticated access is attempted via an unauthenticated request.
- `MissingError`: raised when an operation is attempted on a record that does not exist.
- `ValidationError`: raised when an operation violates a SQL or Python constraint.
- All other exceptions are internal errors due to a system problem or bug, and raised untouched to the client-side, which should display a traceback.
All exceptions take a single message argument.
The `test_exceptions` module has been updated to showcase both new and old (deprecated) exceptions.
A great many old `except_osv` had a useless title with "Error!" or "Warning", those have been removed, as this is handled by the client-side widget that displays the messages.
This commit introduces a more consistent policy for logging errors and warnings:
- All messages that do not require administrator attention should be logged at INFO level or lower. This includes all errors that are notified to the user in a friendly manner, even for access right problems or validation errors during business operations.
- All messages that indicate a likely misconfiguration or malicious use by the users should be logged at WARNING level, as they typically require administrator attention.
- All other unhandled internal errors cannot typically be handled by the user and should be logged at ERROR or higher level, as they require immediate administrator attention.
When moving fields name -> provider on payment.acquire, the condition in payment_transfer was not updated.
This lead to no post_msg value in the Wired Transfert acquire.
Fixes#2423, opw 613934
Auto confirmation is now controlled by a field on the acquirer
that proposes to confirm
- at payment (Pay Now button on ecommerce)
- at payment confirmation (transaction feedback)
- never
Also fixed the state of tx for transfer transactions that was modified
for debugging in a previous task but not reverted.
Registration are now for one attendee only. When buying several seats for an event
you have now one registration for each attendee.
event: nb_register field is removed; as well as unnecessary user_id and it subscribe /
unsubscribe behavior. Also slighly cleaned some views.
event_sale: do not auto confirm registrations linked to a draft sale order. Note: strange
origin is a char field, not a sale_order_id. Added a small wizard to edit attendees
data when confirming a sale order containing event related lines.
website_event: when buying free tickets, ask for attendee details. Added template,
controllers to handle that behavior.
website_event_sale: when buying tickets, ask for attendee details. Events ecommerce
should be better integrated with online events, using inheritance to add details
instead of being very different.
Odoo Translation Bot