* blacklist all fields by default
* don't use blacklist in get_authorized_fields which is called to see if
a field can be added to a form, instead only use it afterwards to see
if the field can be written to by the formbuilder. That way
formbuilder can whitelist fields which are actually added to forms
on-demand resulting in a more secure interaction
In noupdate, the opt-in setting is ignored by migrations and breaks the
corresponding feature. If the feature is undesirable, don't install the
module.
* make CSRF protection the default on all non-SAFE methods
note: there currently is no way to call a CSRF-protected endpoint
without a form-encoded entity-body as that's the only place we get the
CSRF token from.
* simple CSRF token generation: just use the HMAC'd session id, no
generating a new random token per session then HMAC it
* use constant-time equal function to avoid timing attacks
* assert that a database secret is configured before hashing/validating
the CSRF token
* opt-out database manager from CSRF: The super-admin password serves
the purpose of a CSRF token in the database manager screens.
There is no request database to obtain the
secret and generate a CSRF token.
How great is it to get Odoo (almost) 9.0 (almost) translated?
Clean .tx/config file
Regenerate .pot files
Fetch current translations from Transifex (10% completion)
Now that most refactoring has been merged
It is better to have red a great work of another culture in translation than never to have read it at all.
― Henry Gratton Doyle
* run tours as public users since these screens should be accessible to
and used by public users
* fix access rights issues in website_crm tour (default value of team_id
when creating a crm.lead requiring read access on crm.team, which the
public user does not have)
* remove duplicated crm.lead field (phone declared as char(size=64) then
as char() a few lines below, removed first instance)
To check for result of a tour, would run a second tour performing
JSON-RPC calls to check if the first tour had correctly impacted the
database.
Tours are expensive, an empty tour takes ~6s without doing anything.
Replace second tour by regular ORM calls.
NB : Some tests have been modified.
One assert statement in orderpoint_calendar.yml has been modified,
but the change is legit has no python method has been modified at all
This causes issues when people delete the Website Sales team. The
website_sale module already adds a salesteam_id to website, which is
configurable. So instead set that to website.salesteam_website_sales by
default and use this field.
Modified version of afc9507 after 8c31ecd:
website_crm doesn't look for the website_sale salesteam anymore
The website_crm module doesn't depend on website_sale, so the
salesteam_id field may not exist on website in contactus.
There is clearly a strange overlap with the website salesteam
between website_crm and website_sale, as indicated by the xml_id's.
The previous version didn't crash when the xml_id was not found,
though, while this one would always crash when you try to use
website_crm without website_sale, so I prefer to revert it.
A proper fix would be to set the salesteam at the level of the
website module, but I'm not sure it would make sense considering
that it wouldn't be used at all unless you happen to install one
of those two modules.
In the meantime, I'm reverting afc9507f3a.
In the top menu bar, the `active` class is set when the
menu url matches the page url (the url in the browser url bar)
A while ago, we made so all urls
`/page/website.***'
were automatically redirected to
`/page/****`
Therefore, if the menu url still contains this `website.` prefix,
the active class wasn't set on it, while it should.
Fixes#3059Closes#3070
This causes issues when people delete the Website Sales team. The
website_sale module already adds a salesteam_id to website, which is
configurable. So instead set that to website.salesteam_website_sales by
default and use it in both website_sale and website_crm.
Jeremy Kersten