If a tag with an empty name was existing in database, the controller /forum/forum_id/tag
return a server 500 because tag.name[0] from an empty string raise a traceback.
The links present in forum messages are parsed to integrate "nofollow"
attribuate in it.
In case the content of the link contains some special char (e.g. <a>foo)bar</a>)
the regex fails as it interprates the content as an invalid expression.
When replying to a question,
there is no possibility to set a title (`name`)
in the answer form, there is no input for the title,
even if the controller `/reply` would accept it.
This revision sets a title for answers so:
- The answers doesn't appear as `False` in the breadcrumb
- The subject of the mail notifications sent
for these answers are set with a meaningful title
opw-659279
In saas-6 the editor assets were always included, in 9.0 only for
designer but if website_forum is installed it should also be included.
fixes#9402closes#9852
note: should not be forward ported after saas-8
Better message management, linked to the validation feature added in v9
- post a "new post to see" message only when the post is validated
- post a "new post to validate" message when the post has to be validated.
This message is sent only to followers having sufficient karma.
Remove forum creator as follower of the forum. Indeed this means that generally
the website admin will be follower of all posts of this forum. Which is
probably not really necessary.
As this method is overided in several modules, the mix of new and
old API makes it difficult to handle. Indeed in some cases we
receive the expected dictionary, sometimes in a list, sometimes
in a list of list, due to api.one decorator.
This is a change in the method API, however it is currently completely
buggy. Moreover this method is used internally and should not be
used as an external API. Lastly, this method is new from v9.
The read_group collating user badge counts is extremely slow when
there's a large number of users (possibly even slower than 8.0's naive
approach), replace the whole thing by a single SQL query seems to yield
pretty significant (~2 orders of magnitude) performance improvements on
the computing function resulting in ~1 order of magnitude improvement
for the page as a whole.
* make CSRF protection the default on all non-SAFE methods
note: there currently is no way to call a CSRF-protected endpoint
without a form-encoded entity-body as that's the only place we get the
CSRF token from.
* simple CSRF token generation: just use the HMAC'd session id, no
generating a new random token per session then HMAC it
* use constant-time equal function to avoid timing attacks
* assert that a database secret is configured before hashing/validating
the CSRF token
* opt-out database manager from CSRF: The super-admin password serves
the purpose of a CSRF token in the database manager screens.
There is no request database to obtain the
secret and generate a CSRF token.
The stdlib version of the json library is more recent than the 3.5.3
version we are pinning in `requirements.txt`
There is no reason to use it.
Closes#6940
How great is it to get Odoo (almost) 9.0 (almost) translated?
Clean .tx/config file
Regenerate .pot files
Fetch current translations from Transifex (10% completion)
Martin Trigaux