On website/theme installation and other website_* module installation,
an action was triggered to launch tours. These tours are now used only
for tests and should not be used as onboarding anymore.
Note: in master these tours will be removed to use the new test system.
Refactor snippet structure
* new "cover" snippet
* move the title out of col-md-12
* delete snippets (s_quote_slider)
* rename snippets (FAQ Roller -> Accordion)
* ...
Refactor the way the background images are handled so that themes
can customize the defaults ones easily without ugly xpath or ugly
css.
[IMP] account: d'ont create journal items for invoice lines with quantity 0 (not amount because of tax)
[IMP] crm: usability kanban view and schedule an activity
[FIX] crm: schedule an activity bug when no activity yet
[IMP] website: app for website (not a menu in website admin)
To match the current website, we should compare the request http_host to the domain and not
to the website name. That was working luckily because name and domain in demo was the same.
close#10870
Coming from a bug in web_settings_dashboard. Invited user didn't have any rights
when created from the dashboard, which was leading to an error.
This bug leaded to a new discussion. Better to have basic employee having user
rights for all main applications. For bigger entreprises there is an admin that
will carefully remove extra rights, if necessary. The target is small businesses,
it makes sense that every way to create a user gives the same result.
In conclusion, each new user has a full access to the applications by default
How is it implemented ?
We added an inactive default user which original access right to the groups
'base.group_user' and 'base.group_partner_manager' in base. Each
application will extend the default user's access right by adding the maximal
access right for this application.
On user creation, we will use by default the 'group_id' field from the default
user. We will in the same time remove the ugly 'default_groups_ref' key which
was passed sometimes in the context for some fields in some views, and sometimes
nothing.
So, the user can modify the access rights for the default user, but he should be
aware that removing project user access rights for a default user will prevent
a *created on the fly in a task* user will not be able to access the task.
- Deduplicate default website definition
- Remove hardcoded english values
- All active languages enabled in the website by default
- Default website language = default database language
* make CSRF protection the default on all non-SAFE methods
note: there currently is no way to call a CSRF-protected endpoint
without a form-encoded entity-body as that's the only place we get the
CSRF token from.
* simple CSRF token generation: just use the HMAC'd session id, no
generating a new random token per session then HMAC it
* use constant-time equal function to avoid timing attacks
* assert that a database secret is configured before hashing/validating
the CSRF token
* opt-out database manager from CSRF: The super-admin password serves
the purpose of a CSRF token in the database manager screens.
There is no request database to obtain the
secret and generate a CSRF token.
In the top menu bar, the `active` class is set when the
menu url matches the page url (the url in the browser url bar)
A while ago, we made so all urls
`/page/website.***'
were automatically redirected to
`/page/****`
Therefore, if the menu url still contains this `website.` prefix,
the active class wasn't set on it, while it should.
Fixes#3059Closes#3070
This commit impact crm, website, website_sale and web_planner modules because it
- add planner for website and website_sale
- improve planner notebook by setting texterea and input size to 100% and using col-md-* class
- split js code into common part (used in backend and frontend) and backend part (only for backend)
- adapt some tour, since every page will have the planner modal in its DOM, the tour selectors msut be more accurate
- introduce some style fixes and adaptations
- ...
Christophe Simonis