PURPOSE
Make sure the Rainbowman animation is rightly triggered whichever way the user
marks the opportunity as won. Especially relevant for the onboarding as we want
to show the first rainbowman to users completing the tour.
SPECIFICATIONS
Now the rainbowman and its finely-tuned message are displayed to the user when
he uses the statusbar, mark lead as won using action buttons or drag and drop
a lead in the won stage in kanban view.
LINKS
Task ID-2287758
PR #54553
Steps to reproduce:
- Go to the website shop
- Add a product in the cart
- Add your address and click on checkout
- On the checkout, enable Terms & conditions
Bug:
The button was always enabled even if the check box with the terms & conditions were not
checked.
opw:2313437
closesodoo/odoo#55821
X-original-commit: 0415da51960819ec9c989e15a9229bd6d583ba1b
Signed-off-by: Simon Goffin (sig) <sig@openerp.com>
- Adds support for two-factor authentication (2FA) via time-based one-time-passwords (TOTP),
compatible with mainstream authenticators like Google Auth, 1Password, etc.
- Add support for personal API key that can be used for non-interactive RPC scripting, including
when 2FA is enabled (password-based non-interactive RPC auth gets disabled by 2FA)
- Both features can only be enabled/disabled after an extra password check, made possible
by a new "identitycheck" feature.
- Adapt user profile and portal to allow managing those new security settings.
closesodoo/odoo#33928
Related: odoo/enterprise#9112
Signed-off-by: Olivier Dony (odo) <odo@openerp.com>
New module for supporting two-factor authentication via time-base
one-time-password (TOTP).
Users (including portal users) can choose to enable two-factor auth in
their user account settings, by scanning a QR code and adding it to an
authenticator app, such as Google Auth, 1Password, etc.
When two-factor is enabled, password-based non-interactive RPC is only
possible by using API keys.
Co-authored-by: Olivier Dony <odo@odoo.com>
Follow-up on 6edb749534, where default
`autocomplete` values were introduced as default for password fields,
according to the new autofill specs.
This patch allows developers to force the "autocomplete" attribute value
on password fields, in case there really is a need for a value that is
not `new-password` (which BTW now triggers the password generator wizard
in many browsers).
It is useful for example when a backend form really needs to ask the
user for their current password, so the correct `autocomplete`
value is `current-password`, as on the login form.
* allows portal users to update their password
* and manage their API keys
* any anything technical / security related we may need to add in the
future
Also bridge module for the password meter (auth password policy).
* ability for a user to request / create keys associated to their user
* overrides can block RPC solely through API keys, by overriding
`_rpc_api_keys_only()` (to require API auth even in
situations where the user has not requested it themselves)
* hash keys just in case as we can do so and might as well, add a
cleartext index (first 4 bytes of 20) to avoid blowing up the DB if
a user decides to create millions of keys for some daft reason
* users can delete their own keys, admins can delete (invalidate)
anyone's keys
* `scope` on API keys can be used to restrict usage to certain
kind of applications, so API keys can be used for other things
than global authentication. New keys manually created by users
have no scope by default so they are valid everywhere (global
keys). RPC auth (stateless XML-RPC/JSON-RPC) requires global keys
Co-authored-by: Florimond Husquinet <fhu@odoo.com>
Co-authored-by: Olivier Dony <odo@odoo.com>
* migrate website to overriding web_login less (still needed to flag it
as website-enabled) and use _login_redirect for its login redirection
override needs
* modify portal and website to not replace / shortcut the redirection
workflow, so it's possible to override those properly if / as
necessary
Before this, invalidations to the UID cache is not synchronised
between workers because it's an ad-hoc solution (so a user changing
their password or an admin disabling a user would only lock out an
attacker currently using the API of one of possibly several
workers). Shift the entire thing to ormcache which already has proper
support for synchronising cache invalidation between workers.
Also simplify the cache invalidation mess in Users.write because the
caches have been unified into a single registry-level LRU, so the
half-dozen cache clears on specific ormcached methods & models is
pretty much the same as repeatedly calling clear_caches on the current
model.
**However** registry.cache is trivially accessible from server actions
and safe_eval as long as they provide access to a model (through
`model.pool.cache`). Which is common, and an issue given we're very
much putting sensible data in there.
Fix this by renaming `Registry.cache` to `Registry.__cache`, this
requires few editions and mangled names are not accessible from
safe_eval contexts.
The alternative would have been to add more bespoke handling of the
uid cache to hook it into the cache invalidation propagation
machinery.
After discussion with (@)odony, fixing LRU access and using that seems
cleaner and less error-prone.
Note on lazy_property
=====================
Make Registry.cache / Registry.__cache into a regular attribute: the
overhead of the LRU is not that high (compared to that of the registry
itself), it's rare that we *don't* need it, and it's assumed to be a
persisted attribute (it's not just a cache) so making it a normal
attribute seems fine; and lazy_property doesn't work for mangled
names: the name of the property is mangled using the name of the
definition class, but the name of the symbol (fget) is not mangled so
lazy_property would set the __cache attribute but then Python would
lookup _Registry__cache, creating a new cache every access.
And we can't (always) mangle things correctly on `__get__(obj,
owner)`: `owner` is just `type(obj)`, meaning in the case of
inheritance the type we get is the type through which the property is
accessed rather than the one it's defined on. So it would work in the
cases where no inheritance is involved (such as Registry.__cache) but
not in general (lest we want to play around walking the MRO ourselves
to find the definition source, which doesn't seem worth it).
lazy_property *could* be made to work properly on Python 3.6+: the
descriptor protocol gains `__set_name__(name, owner)`, which is called
with the properly mangled name — and with the definition class to boot
(though there might still be issues when overriding lazy properties as
the override will be mangled & named differently... or maybe that's a
feature?). However we're still supporting 3.5 at this point, AFAIK, so
that's not an option. Plus it feels unnecessary / not very useful.
However add an assertion to `lazy_property` so it signals when we try
to use it on a mangled method (as otherwise it kinda sorta work in the
sense that the property / object is accessible but is in effect a
slower way to write a regular property).
Similar to github's sudo mode, my understanding of the intent is to
avoid third parties being able to perform sensitive / serious
operations when leaving a logged-in machine unattended.
This v1 only handles protecting "action methods" (methods called
through buttons and intended to return action descriptors), although
they can be used to "lock out" any methods they won't be able to
prompt and the caller will likely be surprised.
The browser itself would get mostly cleaned up between tours, but the
session object would not get cleaned, and apparently in some cases
that could lead to an incoherent session: a tour would add data to the
session which the next tour (logging in as a different user) would
not (fully) override, leading to a session inconsistency and a Session
Expired exception during the tour.
Fix by not storing the session on the test object, the session is
created during authentication then set on the opener & browser.
Allows accessing various keys, especially whether this is an
interactive login or not.
Also have the xml-rpc `login` delegate to `authenticate` instead of
having its own half-assed implementation.
And remove some dead code: as far as I can tell, Session.authenticate
is never called with a uid.
This commit switch the cash control opening mangement from the backend to the front end of the point of sale.
task_id: 2258817
closesodoo/odoo#55741
Signed-off-by: pimodoo <pimodoo@users.noreply.github.com>
This commit fixes several small issues in the test_event_full tour that was
relying on selectors that have been since reworked.
In addition:
- Set the track we set the reminder to in the future so that the button appears
- Avoid going on the exhibitor page because Jitsi will trigger an error
- Make sure we go on the registration confirmed page
Task #2317947closesodoo/odoo#55956
X-original-commit: 11b7f4446ddec6ab237ed6076838bfbbaca03be6
Signed-off-by: Thibault Delavallee (tde) <tde@openerp.com>
11px was set as default font-size when achieving 5 or 6 edition levels
in the sidebar was the norm. Thanks to the snippet's cleanup, resulting
in a reduced number of editable elements, we can now increase the
default fon-size and, consequentially, all general spacings.
Part of https://github.com/odoo/odoo/pull/55959
task-2157252
*: website
Add a field image flag on the lang model because when a language has
no country (like the arabic) we cannot use the country flag as a lang
flag. By default we use this new field and as fallback we use the
country image. We also add an arabic flag image in the website data.
Part of https://github.com/odoo/odoo/pull/55300
task-2203383
closesodoo/odoo#55300
Signed-off-by: Quentin Smetz (qsm) <qsm@odoo.com>
Co-authored-by: qsm-odoo <qsm@odoo.com>
Add an option to display the language selection inline or with a
dropdown. Add an option to choose if language labels are flags, text
or both.
Part of https://github.com/odoo/odoo/pull/55300
task-2203383
Co-authored-by: qsm-odoo <qsm@odoo.com>
On mobile device, the event PWA display an install bar to ask the user
to install the event app.
This commit allows to close it without having to install it.
closesodoo/odoo#55919closesodoo/odoo#55952
X-original-commit: 1f7b2910a75f149f1398bba147f5e10d53448adf
Signed-off-by: Adrien Dieudonné (adr) <adr@odoo.com>
On mobile devices, when you go for the first time inside the event
public page the PWA install bar and the livechat tooltip are displayed
at same area. Because of this it's was difficult to click on the
"install" button.
X-original-commit: 6705c6b6fe0360f95b4a499a9141f876648b7202
Added a new tour for the module hr_recruitment
Hr.job:
Form view:
- Using a notebook view for increased clarity
Kanban view:
- Added a toggle button to publish/unpublish a job offer.
- In the menu, added the « Create Interview Form » button to create an interview form.
Hr.applicant:
Generale:
- Use of the "Applicant: Acknowledgement" template by default when an application is moved to the "First Interview" stage.
Form view:
- Possibility to consult an interview after this one and not before
- The "CREATE EMPLOYEE" button no longer directly creates an employee. The employee will be created if the "SAVE" button is pressed.
Hr.employee:
Generale:
- Added of two new certifications.
And some other minor style and name changes.
closesodoo/odoo#55928
Related: odoo/enterprise#12420
Signed-off-by: Yannick Tivisse (yti) <yti@odoo.com>
* stock, website_sale, base
Purpose fo the task is to improve the product list view and
contact list view.
So in this commit, we have Updated the list view of the product
updated decoration, string apply the monetory widget on cost
and sales price.
Also on contact list view make the user_id field as optiona show
instead of hide.
TaskID: 2309699
Related Enterprise: https://github.com/odoo/enterprise/pull/12288
closes odoo/odoo#55451
Closes: #55451
Related: odoo/enterprise#12288
Signed-off-by: Yannick Tivisse (yti) <yti@odoo.com>
On the dashboard of Time Off (calendar view), the banner displaying
the remaining leaves is not shown as _get_contextual_employee_id
of hr_leave_type.py is returning False due to the missing required
on the company_id of hr.employee.
A fix was made in 2bd5e9a but missing the part that the employee_id
is not required. Confirmed by YTI
close opw-2252479
closesodoo/odoo#53109
Related: odoo/upgrade#1596
Signed-off-by: Yannick Tivisse (yti) <yti@odoo.com>
PURPOSE
Provide some fixes after internal test deployment of event online features.
Notably: chat room management and track list.
See sub commits for more details.
UPDATE
Templates
* website_event_meet.meeting_room_card
* website_event_meet.community_aside
* website_event_meet.meeting_room_main
* website_event_track_session.event_track_content
* website_event_track_session.event_track_aside_other_track
Views
* website_event_meet.event_meeting_room_view_tree
* website_event_track_online.event_sponsor_view_tree
* website_event_track_exhibitor.event_sponsor_view_tree
SPECIFICATIONS: TRACKS LIST
It allows to better know who the speaker is. This is done through a related
on the speaker function and partner_name fields. It allows to display a
sentence like "Director at Azure Interior", which gives information on both
its position and its company.
SPECIFICATIONS: CHAT ROOMS
Clean code managing chat rooms: handle most of its management in chat room
mixin. It allows to lessen custom code in website_event_meet.
Improve sanitize heuristic of chat rooms by avoiding name collision. If a
room with a given name already exists, simply increment a counter as suffix.
Improve copy management: when copying from the chat.room.mixin on a record
with a room set, simply propagate an updated room name. As room_id itself
is not kept but a new one is create, it will create a new room with a name
avoiding collisions.
Allow multi edit for event meeting rooms and exhibitors. It allows notably
to publish by batch, and to set exhibitors as having chat rooms by batch.
Give default values for max participants count when creating exhibitors so
that required field has a default value. Otherwise people forgot it and have
to come back on form view to set it. This is due to default value coming
from mixin not being propagated to the form view.
LINKS
Coming from internal feedback while deploying online support
Task ID-2314778
PR #55887closesodoo/odoo#55949
Forward-port-of: odoo/odoo#55887
Forward-port-of: odoo/odoo#55941
Signed-off-by: Thibault Delavallee (tde) <tde@openerp.com>
SPECIFICATIONS
Slightly improve meeting room model
* set chat room as required. Meeting rooms without chat room make no sense;
* allow to translate room summary. As this is displayed in frontend having
it translated makes sense;
* improve label of reached participants, allowing notably to display it
nicely in backend;
LINKS
Coming from internal feedback while deploying online support
Task ID-2314778
PR #55887
X-original-commit 54bd8281cf94ddee77073cf5d6356d847d08d024
PURPOSE
Ease chat room management, especially when dealing with meeting rooms and
exhibitors in backend: multi edit, avoid name collision, better support of
copy with room names, ...
SPECIFICATIONS
Clean code managing chat rooms: handle most of its management in chat room
mixin. It allows to lessen custom code in website_event_meet.
Improve sanitize heuristic of chat rooms by avoiding name collision. If a
room with a given name already exists, simply increment a counter as suffix.
Improve copy management: when copying from the chat.room.mixin on a record
with a room set, simply propagate an updated room name. As room_id itself
is not kept but a new one is create, it will create a new room with a name
avoiding collisions.
Allow multi edit for event meeting rooms and exhibitors. It allows notably
to publish by batch, and to set exhibitors as having chat rooms by batch.
Give default values for max participants count when creating exhibitors so
that required field has a default value. Otherwise people forgot it and have
to come back on form view to set it. This is due to default value coming
from mixin not being propagated to the form view.
LINKS
Coming from internal feedback while deploying online support
Task ID-2314778
PR #55887
X-original-commit d35d6295ae1b50e9ecb4e57c5e7fb6cdd52c8b27
It allows to better know who the speaker is. This is done through a related
on the speaker function and partner_name fields. It allows to display a
sentence like "Director at Azure Interior", which gives information on both
its position and its company.
LINKS
Coming from internal feedback while deploying online support
Task ID-2314778
PR #558877
X-original-commit 69cf94cec0913db4132ae96d2bc82be4f465d6db
This commit adds a few minor improvements to crm views:
- Add the crm.team currency on opportunity amounts on the crm.team kanban view
- Slightly reorganize "My Activities" view for increased usability
- Remove the "alias_user_id" field in the crm.team form view because it's a
related technical field that is not supposed to be modified there.
Task #2314894closesodoo/odoo#55940
Signed-off-by: Thibault Delavallee (tde) <tde@openerp.com>
Co-authored-by: Aurélien Warnon <awa@odoo.com>
Jérémy Hennecart