In the frontend customer quote validation,
the company used in the sentence
```
I agree that by signing this proposal,
I accept it on the behalf of
```
was the quotation company, which is the company
which is selling, not the company/customer which is buying,
and this does not make any sense.
Instead, it should use the company of the customer
accepting the sales order, or simply the customer
if he does not have a company set.
The only case which make it a little weird is when
it's the customer himself, without parent company,
who is accepting the quote
"on the behalf of himself", but:
- This isn't possible to correct this without
breaking the translations, because the
sentence "I accept it on the behalf on"
is within the same sentence than
"I agree that by signing this proposal"
- This makes sense if another person than the
customer himself is validating the order
(the customer sent the quote link with the token
to another person).
opw-690837
On website_quote, according to the translation, the label may become much larger than
the button width. By default the bootstrap btn class has the property 'white-space: nowrap'
Here the goal is to add a class which will be used for these kind of cases.
Commit 7636b51 modifies the route from JSON to HTTP by mistake. Indeed,
the route /quote/accept is called from an ajax.jsonRpc request, not from
the `method="POST" t-attf-action="/quote/accept` which can be found in
website_quotation.xml.
The t-attf-action is actually only used to recover the order_id and the
token in website_quotation.js.
opw-652874
Closes#9227Fixes#9226
Before this fix, it was possible to validate then cancel a quote (or the other way around) simply by using two tabs in your browser. From now on, we only validate/cancel a quote if it's the 'sent' state and advise the customer of the situation if he tries to abuse the process.
* make CSRF protection the default on all non-SAFE methods
note: there currently is no way to call a CSRF-protected endpoint
without a form-encoded entity-body as that's the only place we get the
CSRF token from.
* simple CSRF token generation: just use the HMAC'd session id, no
generating a new random token per session then HMAC it
* use constant-time equal function to avoid timing attacks
* assert that a database secret is configured before hashing/validating
the CSRF token
* opt-out database manager from CSRF: The super-admin password serves
the purpose of a CSRF token in the database manager screens.
There is no request database to obtain the
secret and generate a CSRF token.
Note: This is a custom version of the lib which allows to
enable/disable the signature area and which introduces the
compatibility with IE + bug fix of the official version.
Until now, you could only sign and confirm a sale order from the frontend.
From now on, you can also pay sale orders if the 'Immediate Payment'
option is checked on the sale order.
* add on_change_uom behaviour to quote templates lines
* fixes frontend layout issues
* use action_button_confirm instead of signal_workflow
when confirming the quote in the frontend to trigger
all events properly
* adapt prices using pricelist on onchange_template_id
on sale orders
When displaying a field, it is usually preferable to use the 't-field' qweb tag
to avoid access problems: the name_get is automatic so you don't need to access
the model sub-field (in this case, you don't need to access the res.partner name)
Denis Ledoux