Previous commit (3304b31938) was not performant enough for AL, so got special autorization to make a particular controller for mail.message author avatar. Avatar of message is avaiblable if current user has 'read' access right to the document. Otherwise the default avatar is one white pixel.
To display author avatar to public user, using the /web/image url with res.partner returns the placeholder since public doesn't have access. Using the url on mail.message will display the avatar according to the access right defined on res_model/res_id of mail.message. However this executes mush query to fetch the avatar image (1 per message, against 1 per partner).
Maybe this wasn't a bug, but since it is a regression, this deserves to be fixed ...
* make CSRF protection the default on all non-SAFE methods
note: there currently is no way to call a CSRF-protected endpoint
without a form-encoded entity-body as that's the only place we get the
CSRF token from.
* simple CSRF token generation: just use the HMAC'd session id, no
generating a new random token per session then HMAC it
* use constant-time equal function to avoid timing attacks
* assert that a database secret is configured before hashing/validating
the CSRF token
* opt-out database manager from CSRF: The super-admin password serves
the purpose of a CSRF token in the database manager screens.
There is no request database to obtain the
secret and generate a CSRF token.
Transform POST param into GET param when redirecting to login page can cause security issues. Now, instead of displaying textarea (even if public user) and the redirect to login page keeping written comment, we display the login button with a redirection to the page to comment.
The redirection happen before commenting, avoiding to remenber param such comment text, rating, ...
To post a comment, the user must:
- be connected
- have a token
- or have a sha_sign
Add 'force_display' param for the frontend chatter to allow public user to see the textarea. When submitting his comment, he will be redirect to login page (like it was before generic chatter) in both mode (json and post mode). This required changing the error handeling of json mode : when a login is required, the user switch to post mode to allow http redirect, keeping its submitted params (rating, comment, ...).
Replace deprecate controllers like /web/binary/image, /web/binary/saveas...
Use ETag for all content with 'unique' option to cache the content if the content is never changed.
A new generic chatter template is available in website_mail
This template allows access rights escalation when some kind of token or uuid
is available on the model or if you use the object_shasign function in the
main controller of website_maill to generate a cryptographic signature to allow
commenting on any object.
To use this chatter, you need to make a t-call to website_maill.thread in your
template after having set the following variables:
- chatter_object: the browserecord of the mail_thread object (mandatory)
- token: if you use a token system (optional)
- token_field: name of the field that stores the token on your object (optional)
- sha_in: if you use a shasign to allow public comment (optional)
- nosubscribe: set False if you want the partner to be set as follower of the object (optional)
- message_type, subtype: see message_post in mail_thread.py
Bootstrap's CSS depends on the input-group-btn
element being the first/last child of its parent.
This was not the case because of the invisible
and useless alert.
- remove the default footer for mail.group messages,
replace with specific footer with archive and unsubscribe
link
- remove the automatic addition of user signature in
mail.group messages, as many of them will be posted
via the mail gateway and already contain a user signature.
- make it easier to unsubscribe even when not logged in,
as followers who have not signed up will have no
way to login short of signing up.
- remove tests looking for user signature in mail.group posts
CKEDITOR_BASEPATH has to be defined, by default ckeditor will load its files
relative to "itself" (the file which executes it). After bundling, the path is
incorrect and ckeditor looks for its files (e.g. en.js) in the wrong place.
bzr revid: xmo@openerp.com-20140418121503-4nsja7enutney2vn
Based on the same principle as publish, there is now a generic button to follow
or unfollow objects in openerp. This should replace all custom instance of
subscription in other addons.
bzr revid: tde@openerp.com-20130923095909-4p5aiswlwy14g32k
It is now called website_blog, and not based on mail.group anymore. It uses
document_page module, previously renamed blog.post (see previous commits).
Refactored controllers and views to work with the new model.
Added website_mail module, that holds mail-related stuff necessary
for the website. This is an auto-install module.
bzr revid: tde@openerp.com-20130920135643-rey5bwza2e96v7h5
Jérome Maes