Refactor snippet structure
* new "cover" snippet
* move the title out of col-md-12
* delete snippets (s_quote_slider)
* rename snippets (FAQ Roller -> Accordion)
* ...
Refactor the way the background images are handled so that themes
can customize the defaults ones easily without ugly xpath or ugly
css.
To match the current website, we should compare the request http_host to the domain and not
to the website name. That was working luckily because name and domain in demo was the same.
close#10870
- Deduplicate default website definition
- Remove hardcoded english values
- All active languages enabled in the website by default
- Default website language = default database language
* make CSRF protection the default on all non-SAFE methods
note: there currently is no way to call a CSRF-protected endpoint
without a form-encoded entity-body as that's the only place we get the
CSRF token from.
* simple CSRF token generation: just use the HMAC'd session id, no
generating a new random token per session then HMAC it
* use constant-time equal function to avoid timing attacks
* assert that a database secret is configured before hashing/validating
the CSRF token
* opt-out database manager from CSRF: The super-admin password serves
the purpose of a CSRF token in the database manager screens.
There is no request database to obtain the
secret and generate a CSRF token.
Rebranding has been done in:
- data/demo files
- html templates
- help notices
- comments
- logger messages
- and other various messages
(Commit taken from odoo-dev:8.0-improve-openerp-odoo-rlu at rev 7deaa08)
Closes#1260
qsm-odoo