* make CSRF protection the default on all non-SAFE methods
note: there currently is no way to call a CSRF-protected endpoint
without a form-encoded entity-body as that's the only place we get the
CSRF token from.
* simple CSRF token generation: just use the HMAC'd session id, no
generating a new random token per session then HMAC it
* use constant-time equal function to avoid timing attacks
* assert that a database secret is configured before hashing/validating
the CSRF token
* opt-out database manager from CSRF: The super-admin password serves
the purpose of a CSRF token in the database manager screens.
There is no request database to obtain the
secret and generate a CSRF token.
Replace deprecate controllers like /web/binary/image, /web/binary/saveas...
Use ETag for all content with 'unique' option to cache the content if the content is never changed.
* select2 was linked in both backend and frontend (by web and website)
* select2-bootstrap was in website and linked only in frontend but it
is in fact needed in backend too
+ Remove useless link of the lib by other modules
This huge library handle PDF file to display them, count their pages, ... Due to its size, the lib is declared in a separated optional bundle who should be called with a 't-call-assets' only on the page it is required.
website_slides: use the recently introduced website.published.mixin to
replace the website_published and website_url fields defined in various
remaining modules.
In slides, some templates have been updated because share_url was basically
website_url and has been replaced.
videos, infographics. Some kind of slideshare clone, to summarize.
Featuring :
- channel management: classify slides (presentations, videos, documents, ...)
and tune their access rights for visibility, uploading and downloading
- full branding new shiny website module !
- automatic fetch of youtube and google docs information based on URL
- statistics: views, likes, interfaced with messaging, ...
- embed mechanism to embed slides in other websites
Courtesy of RD India, notably Mantavya Gajjar, Ravi Gadhia, Vijay Patel,
Pariket Trivedi
Courtesy of Use Merge Team, notably Jerome Maes and Richard Mathot
Let us not forget our usability testing teams that tested it quite a lot of time.
Special thanks to Martin Trigaux that did nothing.
Christophe Simonis