Better message management, linked to the validation feature added in v9
- post a "new post to see" message only when the post is validated
- post a "new post to validate" message when the post has to be validated.
This message is sent only to followers having sufficient karma.
Remove forum creator as follower of the forum. Indeed this means that generally
the website admin will be follower of all posts of this forum. Which is
probably not really necessary.
As this method is overided in several modules, the mix of new and
old API makes it difficult to handle. Indeed in some cases we
receive the expected dictionary, sometimes in a list, sometimes
in a list of list, due to api.one decorator.
This is a change in the method API, however it is currently completely
buggy. Moreover this method is used internally and should not be
used as an external API. Lastly, this method is new from v9.
The read_group collating user badge counts is extremely slow when
there's a large number of users (possibly even slower than 8.0's naive
approach), replace the whole thing by a single SQL query seems to yield
pretty significant (~2 orders of magnitude) performance improvements on
the computing function resulting in ~1 order of magnitude improvement
for the page as a whole.
* make CSRF protection the default on all non-SAFE methods
note: there currently is no way to call a CSRF-protected endpoint
without a form-encoded entity-body as that's the only place we get the
CSRF token from.
* simple CSRF token generation: just use the HMAC'd session id, no
generating a new random token per session then HMAC it
* use constant-time equal function to avoid timing attacks
* assert that a database secret is configured before hashing/validating
the CSRF token
* opt-out database manager from CSRF: The super-admin password serves
the purpose of a CSRF token in the database manager screens.
There is no request database to obtain the
secret and generate a CSRF token.
The stdlib version of the json library is more recent than the 3.5.3
version we are pinning in `requirements.txt`
There is no reason to use it.
Closes#6940
How great is it to get Odoo (almost) 9.0 (almost) translated?
Clean .tx/config file
Regenerate .pot files
Fetch current translations from Transifex (10% completion)
Now that most refactoring has been merged
It is better to have red a great work of another culture in translation than never to have read it at all.
― Henry Gratton Doyle
Main addons updated :
- crm: Conversion and Won / Lost actions
- hr_holidays: Approve / Refuse for hr users / officers
- project: Assign / New (task and issues)
- forum, website_project_issue, website_portal_sale: go to the
website view
Notification emails have been redesigned. They notably include buttons
allowing to perform some action directly from the email.
The notification creation and sending has been partially rewritten
and improved. The purpose is to lessen the number of rendering to perform
when sending emails to recipients. Recipients are first categorized into
groups. Basic groups are partners and users. The notification template
is then rendered twice, one for followers and one for not-followers. In most
cases there will be few rendering to perform. Through inheritance it
is possible to further categorize users. For example HR users / officers
that have approve / refuse buttons in their email.
A custom data structure is used to store data about buttons and actions.
URLs, follow / unfollow are added in the structure and used in the
template to render the email for a given group.
New routes are added in mail. Those allow to perform some action, like
going to a form in create mode, following / unfollowing, executing a method,
sending a signal for a workflow. Those routes are for users only and rely
on classic access rights.
A generic route for viewing records is added. It replaces the old redirect
action. According to some specific action given by the already-existing
get_access_action, the record will be visible for everybody (forum, blog)
or restricted (going on the Inbox / login / form view, according to access
rights).
The next commit will add the various inherits necessary to add the actions
in the main addons.
Replace deprecate controllers like /web/binary/image, /web/binary/saveas...
Use ETag for all content with 'unique' option to cache the content if the content is never changed.
Main changes :
- mail.notification model is removed. People do not receive notifications
anymore. Instead two ways of following documents exist
- using a channel; messages will be displayed on the channel itself
in a near future commit
- following with its partner; messages will all be considered as
needaction, using a new m2m table. People should receive less
needaction messages by following less records by themselves.
There is no more read / unread state anymore. Instead only needaction
messages are considered. Todo (Favorites) messages still exist, and are
stores on a new m2m table instead of using decorated notifciations.
- the main filter for documents is not message_unread anymore, but
message_needaction. A lot of views and filters have been updated
accordingly.
- the vote feature has been removed
Followers can now be partners or channels. Partners following a document
will receive needaction, as previously. However people can follow documents
through channels. Members of a channel are able to listen to a stream
of messages using the channel. Those messages do not create needaction
messages. It is therefore possible to follow documents without receiving
too much notifications. For interesting documents subscribing with its
partner will create notification.
message_follower_ids fields is udpated. It is now a many2many to
mail.followers, not to res.partner anymore. A subscription can be either
a partner (partner_id) or a channel (channel_id).
Some access rules have been updated accordingly.
The biography of established users (with high karma) can be seen
with an expanded tooltip. This gives to users that participate
some kind of reward and gratitude of their work.
eLBati