This commit remove required alias on res.users model. It also removes the
inheritance of mail.alias.mixin. The field alias_id is kept and allow people
to use aliases on users if they want. However there is no default void alias
created for each user anymore.
Default from of mail.message does not use user alias anymore. Indeed this
creates issues with aliases not being correctly configured and can be
confusing compared to private channels. Using user aliases is therefore
now done manually instead of being a default behavior.
Now having
* sanitize: run the sanitizer to clean the html (removing javascripts,
unwanted tags, ...)
* sanitize_tags: only a subset of tags is allowed in html content.
Unwelcomed tags are remove dand their content stripped.
* sanitize_attributes: only a subset of attributes is allowed.
* sanitize_style: only a subset of style attributes is allowed. Style
attributes are parsed to keep only a white list.
* strip_style: all style is removed. It bypasses sanitize_style as there
is no need to sanitize something that is removed.
* strip_classes: remove class attributes
Fields parameters have also been updated to match the sanitize options. Html
fields by default are sanitized with sanitize_tags activated but without any
further options. All addons have been updated to match the new options
according to their previous behavior.
As we will soon improve the sanitizer we will be able to sanitize email
templates body. However this implies some cleaning in the templates to
be sure mako is not considered as invalid html / xml and therefore removed
from the template body.
Add a link in the general settings to access easily the default_user form view in order to modify the default access rights
The default_user manager rights declarations in all the applications have been move in a noupdate="1" definition to avoid the manual configuration overwrittings
In the interface using the email scheduler of events is limited to a group
that is not activated by default. However by default emails are sent and
therefore cannot be configured by the event maanger.
As managers should always be able to configure sent emails we decided to
remove the group and always give access to the email scheduling tab of the
event form view.
* Limitate rights of event user to reading an event
Event user should not be able to create events. Its rights should be limited
to reading events, creating and updating registrations. Only event managers
are allowed to create and modify events.
* Sudo access on ir.values in event config settings
Configuring events imply modifying auto confirmation parameter which is stored
into an ir.values. As this model is limited to values with user_id = uid we
have to sudo the access here as it is not a user-defined value.
* Add some tests for the various fixed issues
registration.onchange_partner_id() method updates registration contact data
(phone, email, name) based on the partner_id field. However the onchange
currently works only when no existing contact data is stored on the
registration. A second change of partner_id does not update the contact
data.
The condition is now inversed. This way when changing the partner, if it
has valid contact data, it will replace existing information.
Commit c21568e14f deactivated the sanitization of frontend html fields so
that their modification through the editor worked again. However,
this broke the possibility to display their traduction and to modify
them.
The problem is that the translate option of html fields should not
equal "True" but instead be the html_translate function defined in
openerp.tool.translate. The translate=True option is automatically
change in html_translate though but there is a condition: the field
should be sanitized, which is why this broke since the sanitization
is disabled.
This commit sets the translate option of non-sanitized html fields
to html_translate. Maybe we should investigate for this to be automatic
for non-sanitized html fields as well.
Thanks to @rco-odoo.
Since commit c9e38cae9f in saas-10, the html fields are sanitized in
strict mode by default. This breaks all html fields behaviour when it
is editable in the website editor.
This commit deactivate the sanitization for such HTML fields (like it
was already the case for blogs contents or products descriptions for
example). A more specific sanitization will be implemented in future
versions.
Martin Trigaux