Route with method="['POST']" should not appear in sitemap
This code had never works.
rule.method is not the list of methods declared on the endpoint but "the HTTP
method for the rule if there are different URLs for different methods on
the same endpoint" (src http://werkzeug.pocoo.org/docs/0.11/routing/)
The new code uses the method declared on endpoint and so will avoid to add
endpoint with method declared and wich doesn't support GET.
The controller /event/<event_id>/page/<page> raise exception if page is not existing.
Allow to pass the template reference when user are creating a new page.
Without it, it is impossible for the end user to create a website_event page without
change manually the xml id because the xml id is based on the module from the template.
This fix is retro compatible, because from_template will be ignored until next update
of website. And during update from website, website_event will be updated because it's a
dependance and so the default_page template created.
The `binay_image` and `content_disposition` are moved
from the web controller to the `ir.http` model,
to be able to override these methods.
This makes possible to browse the records images as sudo
when the record is published on the website.
e.g. to see the partner images on the website `/partners` page
from the `website_crm_partner_assign` module.
opw-659244
The attribute `data-oe-*` (`data-oe-id`, `data-oe-model`, ...)
must not be added when rendering the assets, to avoid
having different assets content,
e.g. a different content for the assets_common,
according if the user is signed in or not,
if the user can edit the website or not.
A different content for an assets according to the
users rights or the user being signed in or not means
that the assets are permanently re-written in the filestore,
which is against the point of the assets.
The content of the assets (assets_common) must not be
different from time to time, it must always be the same
(except when installing a new module, obviously).
Adding the `data-oe` attributes was pointless for the assets
anyway, and prevented having an identical content all
the time, therefore rewritting the assets all the time
in the filestore.
opw-657046
First 'key' and 'website_id' fields must be checked to retrieve
the right view.
Then if no view is found, it falls back on xml_id.
To choose the right ir_ui_view, _view_obj must take into account
the 'website_id' set in the context.
Inspired from function "get_view_id" in addons/website/models/ir_ui_view.py
Difficulty for the user to understand how to change the images.
Some options summernote being in the bar and the other in the snippets editor.
Need to merge this options.
Use the parameter zoom as in `google_map_img`
Change the default value to 10 to avoid changing the behaviour for existing
links (zoom was not used anyway).
Closes#8318
simplejson and the builtin json module apparently differ in how they
decide to optimise decoding JSON strings to str rather than unicode
python strings, so check for basestring rather than one or the other.
This may also depend on the Python version.
Closes#8726
The method that set `geoip` in the session, `_geoip_resolve`,
is called just before `self._authenticate`, which logout the user
when the session is invalid, and therefore reset the session.
Therefore, `geoip` could not be in the session in that place.
This isn't that bad, as, at the next request, the `geoip` will be
correctly set in the session.
During the analysis of this issue, we observed that the reset
of the session is actually not saved, because the save
of this session is done in `Root.get_response`, through the call
`self.session_store.save(httprequest.session)`,
but `Root.get_response` is not called in `Root.dispatch` in case
of HTTPException (500 internal server error in this case).
This might need to be changed, to do the session save with a finally
in this `Root.dispatch` method, so the above bug could have been
resolved with a simple refresh (which would have re-defined the
`geoip` in the session).
opw-650416
The CDN domain will typically be different from the main
website domain, so session cookies cannot be shared.
This means that assets that require elevated privileges
(such as the website editor rights) will not be reachable
from the CDN's proxy server.
This could cause random problems with CSS/JS/images not
being accessible.
The benefits of the CDN are mostly meant for the masses
of new visitors (less workload and less bandwidth consumed
for the main domain) anyway.
Authenticated users are also returning users that have most
of the resources in the browser cache anyway (assets bundles
and images, typically).
Escape text nodes changed via the web editor before sending the content
it to the server controller.
It is done since the content is unescaped one time when being displayed,
and it is not done for inline style and script tags (which may be
injected by dropping a snippet) since that would break them.
replacing the solution in cdb900044.
Replace deprecate controllers like /web/binary/image, /web/binary/saveas...
Use ETag for all content with 'unique' option to cache the content if the content is never changed.
When saving a template in version 8.0, html would be saved as it should
be displayed once on the site. In particular, if some text should be
escaped once send to the browser, it will be saved as such.
But when rendering, a text node content is unescaped two times:
* for translation which seems wrong since we already use .text of a node
which already escaped it, doing it one more time is bad,
* when rendering the template, since the html template is stored in xml,
This commit remove superfluous unescaping for translation, and add an
escaping when saving the changed template content.
closes#7967
opw-646889
to mail. The only use was to update a method of publisher_warranty.contract
model that is defined in mail.
This code has been moved to the bridge module between website and mail
aka website_mail.
Dependency to share has also been removed.
When clicking on the publish/unpublish button in a form view, if the
user does not belong to the `base.group_website_publisher` group,
fallback to a simple toggling behavior.
Martin Trigaux