If the main object is not set, the default object used is 'ir.ui.view'.
One of the consequence is that website SEO metadata will be stored on
'ir.ui.view' instead of the correct model, in this case 'blog.blog'.
This will cause the SEO metadata to be the same for all the blogs.
opw-651898
* make CSRF protection the default on all non-SAFE methods
note: there currently is no way to call a CSRF-protected endpoint
without a form-encoded entity-body as that's the only place we get the
CSRF token from.
* simple CSRF token generation: just use the HMAC'd session id, no
generating a new random token per session then HMAC it
* use constant-time equal function to avoid timing attacks
* assert that a database secret is configured before hashing/validating
the CSRF token
* opt-out database manager from CSRF: The super-admin password serves
the purpose of a CSRF token in the database manager screens.
There is no request database to obtain the
secret and generate a CSRF token.
When the public user comments the website, he will be redirected
to the login page and his comment will be posted with his logged
user name.
opw:643412
The commit 4b122ad41d rename the 'type' field of mail.message into 'message_type'. The change was not applied to the adding comment feature of website module. The comments were posted but not displayed.
It's better for SEO to have tags slugged in url
tag=1,2 => tag=website-1,functionnal-2
It allow to keep the retro-compatibility with v8 and google links.
Traceback because id was not casted: AccessError: ('AccessError', u"Database fetch misses ids (u'1') and has extra ids (1), may be caused by a type incoherence in a previous request")
The next post button at the bottom of an article was stuck when getting to
the last page. A cookie storing the *all* the visited posts was used
to determine the next one according to a non-stored (so not working) and
unexpected criteria 'ranking'. Also could get articles from other blog.
Instead of this whole broken logic, simple loop through articles by classic
order and go back to first one when at the end.
Better looping algorithm can be used in master where ranking is stored.
Fixes#3097, opw 614559
Unify and refactor exception handling in framework and addons.
The generic `except_osv` is now deprecated, and replaced by more specialized exception subtypes:
- `UserError` (renamed from Warning, as it conflicts with the built-in `Warning`) raised when a non-technical error occurs during a business operation. It could be a missing information in the data provided by the user, or a misconfiguration.
- `AccessError`: raised when any operation is denied because the user conducting it does not have the required access rights.
- `AccessDenied`: raised when an operation that requires authenticated access is attempted via an unauthenticated request.
- `MissingError`: raised when an operation is attempted on a record that does not exist.
- `ValidationError`: raised when an operation violates a SQL or Python constraint.
- All other exceptions are internal errors due to a system problem or bug, and raised untouched to the client-side, which should display a traceback.
All exceptions take a single message argument.
The `test_exceptions` module has been updated to showcase both new and old (deprecated) exceptions.
A great many old `except_osv` had a useless title with "Error!" or "Warning", those have been removed, as this is handled by the client-side widget that displays the messages.
This commit introduces a more consistent policy for logging errors and warnings:
- All messages that do not require administrator attention should be logged at INFO level or lower. This includes all errors that are notified to the user in a friendly manner, even for access right problems or validation errors during business operations.
- All messages that indicate a likely misconfiguration or malicious use by the users should be logged at WARNING level, as they typically require administrator attention.
- All other unhandled internal errors cannot typically be handled by the user and should be logged at ERROR or higher level, as they require immediate administrator attention.
a blog will receive notifications only for published posts. They
will not receive all comments of all posts anymore.
When commenting a post users will receive the answers.
Added tests to try to test this behavior.
A squashed merge is required as the conversion of the apiculture branch from
bzr to git was not correctly done. The git history contains irrelevant blobs
and commits. This branch brings a lot of changes and fixes, too many to list
exhaustively.
- New orm api, objects are now used instead of ids
- Environements to encapsulates cr uid context while maintaining backward compatibility
- Field compute attribute is a new object oriented way to define function fields
- Shared browse record cache
- New onchange protocol
- Optional copy flag on fields
- Documentation update
- Dead code cleanup
- Lots of fixes
is now done server-side and stored directly in the html content, as post processing.
The front-end attaches messages based on the attribute data-chatter-id, but do not
compute the attribute itself anymore.
Misc cleaning of code.
bzr revid: tde@openerp.com-20140403112656-ane3ovhh70qdc8b4
display partner-related stuff without having to tweak the access rights.
Misc update of templates due to some filed renaming.
Added author field on the blog, allowing to avoid having issues with
create_uid field.
bzr revid: tde@openerp.com-20140402140200-a3g0750akro2n12v
Denis Ledoux