It was very confusing for the user to distinct account.payment and payment.transaction. From now on, the transactions are
technical objects and, in the backend, we only refer to it in log messages (Front end will be adapted in the same fashion
later on). They are hidden in debug mode in accounting\configuration\payments as their purpose is now purely technical/log
This commit also aims to reduce the gap between the accounting app and the transactions: account.payment objects are
created/validated upon completion of transaction.
To ease the capture/voiding of pending transactions, the related buttons are now displayed directly on the SO/invoice
instead of the transactions.
Was task: https://www.odoo.com/web#id=35857&view_type=form&model=project.task&action=333&active_id=967&menu_id=4720
Was PR #24043
[FIX] add domain based on journal to payment tokens
Was opw: https://www.odoo.com/web?debug#id=1828206&view_type=form&model=project.task&menu_id=5200
- When a quotation if viewed by a customer, a note is posted in the quotation's chatter saying "Quotation viewed by customer".
This is causes issues if the quotation is accessed without the access token and by a partner that do not have the rights to write on the model "sale.order".
To address this issue we provide to the "_message_post_helper" function the sale order's access token to bypass the accesses checks.
OPW-1839183
Commit 542201eed3 added the possibility to configure a set of countries for a
given payment acquirer.
Commit 194d52e8fd refactored the payment form, but forgot to take the country
into acount.
opw 1837819
- The module 'website_quote' inherit the CustomerPortal class defined in 'portal/controllers/portal.py'.
It does this to override a single method, namely 'portal_order_page'.
The issue here is that 'portal_order_page' is not defined in the module portal, but in sale.
This causes random issues where the inheritance was not done in the correct order.
Which means the original portal_order_page was sometimes called before its child.
Calling the original portal_order_page first means the child is never called.
This commit change the imported CustomerPortal class to the one defined in the module sale.
- Create 2 SO for the same customer
- Send them
- As the customer, click on 'Accept and sign online' for both quotes.
The message 'Quotation viewed by customer' is only posted on the first
quote.
opw-1815082
WARNING: To avoid breaking any configuration in stable (11.0), the template payment_confirmation_status has been replicated in each module.
They must be removed before a forward-port in master
- When paying with stripe an error occurs because of a callback generating the invoice for the SO which is called now automatically by the payment system
- Before this patch, stripe doesn't get displayed.
It was a bug related to the fact that stripe doesn't respect how the generic payment form works.
So to make it work, we were relying on small hacks that got broke by changes on the payment form.
To fix the bug we are no longer adding an event to the pay button of the payment form, instead
we listen all the changes made to the DOM and detect if a form with an attribute 'provider' set to
'stripe' is added.
If so, we open up the Stripe payment form.
- Fix ACL issue when trying to pay with Stripe on eCommerce without being logged.
Closes#20202
opw-776200
Before this commit, trying to pay a sale order from portal would throw an
error
* create an order in back end, set a partner, a product, a quotation
template and 'Online Payment' as Confirmation Mode;
* confirm the order;
* go to the order in portal (/quote/XX) and click on 'Pay Now';
It throws a server error because route is being called with unexpected
keyword arguments like success_url, error_url, callback_method.
After removing the `sha_in` params a while ago, we get rid of
the deprecated `token_field` option.
- Make `token_field` a model attribute, so that each model can easily
define the token field that should be used, and it does not need
to be passed around all the time anymore.
- Rename `_special_access_object()` to `_has_token_access()`, much more
readable since it returns a bool
- Do not forward the `attachment_ids` keyword arg to message_post,
as it sometimes contains unrelated IDs (the helper is not meant
to post attachments anyway)
- Update callers accordingly
sale_payment method to check or create a new transaction when paying
a sale order should be named _check_or_create_sale_tx and kept private
like account_payment one. Both versions exists. This commit fixes
the typo.
Online quote can now use the generic signature widget already used on
the standard sale customer portal. We therefore remove the custom
widget build in website_quote.
A route already exists to sign quotes; the old route is removed. The
existing route is overridden so that quotations with template requiring
payment cannot be signed. This is the expected behavior.
* website_quote should not override all sale links from the customer
portal to replace them by website_quote specific view. Indeed the
quote view should be used only if the order has an active template
defined on it;
* do not override existing columns of the order page view on portal
with same content;
* implement redirection at route level by overriding the
controller order route;
- Fixed 500 errors when trying to display payment form because of variables partner_id/acquirer_id missing.
- Accepted credit cards are now display next to the acquirer name on the payment form
- e-commerce and website_quote create a transaction with its reference when the user click on Pay.
So we need to render the inputs when the user click on pay and submit the form with the values
- Online quotation and e-commerce now use the new payment form.
- Added the ability to chose on an acquirer if it uses only form/s2s or both.
(Still need some code cleaning)
* StringIO removed from stdlib, replace with io
* try to correctly handle BytesIO/StringIO (one is for bytes the other
is for text)
* fix base64: Python 3 removed bytes-encoding and bytes-bytes
codecs (via #encode) so replace all calls to str.encode('base64'),
also b64encode is a bytes->bytes conversion so attempt to properly
handle that
issue #8530
This commit moves the whole customer portal to the portal module.
It now completely uses portal and http_routing features and is not
dependent on website anymore.
An override of web controller is added in portal in order to redirect
portal users to /my instead of /web. That way once having the customer
portal installed all share users are correctly redirected to their
account.
All modules defining customer portal templates and controllers are
updated accordingly.
We make the breadcrumbs of the portal uniform and remove them when we
access the document with an access token without being logged in
(for sales orders).
Online quote now uses JS code from payment module in order to make online
payments. Front-end template is updated to use o_payment_acquirer_button
generic class for payments and data is added to be managed by payment.js.
This allows to remove some strange code parsing the url to find the order
ID and token instead of using rendered values.
A payment controller is removed because it was only a shortcut to another
one. In transaction controller token parameter is renamed to access_token
to avoid confusion with payment token and match the payment and website
sale naming.
Online Quote controller now uses tools method from sale_payment module
like website_sale. This way it is now standardized and moved out of
controllers that should not perform so much model-level computation.
Move sale and payment bridge code into its own module. This commit mainly
moves (and reorganizes without changes) code from website_sale related
to payment and SO confirmation.
Only change is that payment_acquirer_id field on sale order is now a
related on transaction.acquirer_id . Indeed in website_sale and
website_quote both values were written but only managing transactions
and getting its acquirer is more efficient and ensure values are coherent.
JS part controlling payment form management is moved directly into
payment to reuse later on in future commits. Probably.
In Python 3:
* various builtins and dict methods were changed to return
view/iterable objects rather than lists
* and the separate Python 2 view/iterable builtins and methods were
removed altogether
This is problematic when using these items as list (which the happens
repeatedly in Odoo), but more viciously when iterating *multiple times*
over them (which also happens, which I've messed up multiple times while
writing this, and which is a pain to debug even when you've just created
the issue).
Convert all code using these to semantics-matching cross-version
helper functions to get the LCD behaviour between P2 and P3, and
forbid the builtins via lint.
issue #8530
Portal has access (read only) to partner, pricelist,
taxes, ... These access were given to display informations
on portal pages. Since, these are not very secure, we
remove the access right.
Some modifications are required to make the portal work again :
- 'sudo' business document before rendering templates. ir.rule
are still apply to filter the documents do display.
For instance, SO total amount is computed using account.tax.
- a related field has been added on SO line to allow portal user
to see the image of the ordered product (on SO frontend view)
- a new controller is created to display invoice PDF (as 'sudo'),
since the rendering of this document required read access to
taxes, payment terms, ...
Currently when the salesman clicks on 'Preview' button of quotation it
is set as 'Viewed by Customer'. This commit improves this behavior by
ensuring it is triggered only by shared users.
callback_eval is currently a code string that is evaluated directly
at payment confirmation. This commit changes it to have parameters
on the record and method to call on it. Moreover a hash done once at
transaction creation ensure that a modified transaction does not allow
to execute code on other records.
A side effect of commit b9d1239eff if that the method `sale_get_order`,
which is used to retrieve the SO, will also update information on this
SO (change partner, change pricelist...). We therefore need another way
to retrieve the SO.
opw-692919
When a quotation is opened from the frontend, set the SO id in the
request. This is necessary in the following use case:
- Receive a website quote
- Pay thanks to Stripe
After commit da82a6b705, we call the route
`/shop/payment/transaction/` manually. However, this route expects to
retrieve the SO id thanks to a call to `sale_get_order`. Since we are
not going through the webshop and the user might not be connected, the
method is unable to retrieve the SO id.
opw-692341
Somehow in the migration to the new api, it was decided that the
acquirers would be browser as sudo only for token access. This caused
portal users to have a crash when trying to view their quotation since
some fields from acquirers are set the specific groups for security.
This commit reintroduces the old behaviour, which was to browse as
SUPERUSER in all cases for the rendering of the buttons.
When the route /quote/<order_id>
is accessed without token
e.g. through the `View sales Order` button
in the headers of thread mails
the user must be redirected to the login screen
if he's not signed in.
In other words, you must be signed in to access
this route without token.
opw-687931
Christophe Simonis