On website page, in debug mode, error 'web.session already defined' appears in the console. This was due to the fact the namespace web.session was redefined a second time to bind the session on the server_url param for the livechat to work. On website page, this is already done by the native web.session (session_instance.js). Define a session in the bundle is required when livechat is intergrated on external page, so fetching the bundle is done through /im_livechat/loader/, and generating a web.session can be conditional.
Update the cookie after changing conversation state
Deleting the conversation cookie when closing the conversation window
Force open the conversation if a cookie is found (even if the state is closed)
To display author avatar to public user, using the /web/image url with res.partner returns the placeholder since public doesn't have access. Using the url on mail.message will display the avatar according to the access right defined on res_model/res_id of mail.message. However this executes mush query to fetch the avatar image (1 per message, against 1 per partner).
Maybe this wasn't a bug, but since it is a regression, this deserves to be fixed ...
The commit 6327cda0a7 introduce mock_attachment object, replacing ir.attachment. This new object doesn't not have id attribute : accessing it crashes. livechat controller needs to search on the mock url to generate the status, headers and content of the response via binary_content() method.
Use case: create a new tag, change its color and create another new tag. The m2m field was rendered again but the dataset was not aware of the color change on the first new tag. We need to invalidate the cache after changing the color in a tag in edit mode.
- Remove _check_communication method which was a complex way to achieve
what extension classes can do with a simple @api.constraint
- Proper default values for partners created through the payment form.
- In res.partner.bank, store the 'acc_type' computed field so that it can
trigger constraint check (base_iban adds one)
- Misc
To show the website_sale.modal, the product_variant_ids must be in the DOM
because all the prices are computed with the product_variant_ids.
From commit 0ff26cf
opw:650167
* make CSRF protection the default on all non-SAFE methods
(any method besides GET, HEAD, TRACE and OPTIONS )
note: there currently is no way to call a CSRF-protected endpoint
without a form-encoded entity-body as that's the only place we get
the CSRF token from.
* simple CSRF token generation: just use the HMAC'd session id, no
generating a new random token per session then HMAC it
* use constant-time equal function to avoid timing attacks
* assert that a database secret is configured before
hashing/validating the CSRF token
* opt-out database manager from CSRF: the super-admin password
serves the purpose of a CSRF token in the database manager screens.
Implementation by xmo@odoo.com and chs@odoo.com
Only used by web tests (which rely on a module they don't depend on to
run, bad!) and altering the test session directly should work, so this
endpoint seems completely unnecessary.
* add CSRF token as core.csrf_token
* add CSRF tokens to client-generated and/or JS-submitted forms
* remove broken "compatibility" mode of web.ajax.post
/cc @dmo-odoo I've no idea how that was supposed to work, from looking
things up all modern browsers seem to support FormData, and old IEs
which don't don't support fallbacks either and would require
submitting an actual form as fallback so...
* make CSRF protection the default on all non-SAFE methods
note: there currently is no way to call a CSRF-protected endpoint
without a form-encoded entity-body as that's the only place we get the
CSRF token from.
* simple CSRF token generation: just use the HMAC'd session id, no
generating a new random token per session then HMAC it
* use constant-time equal function to avoid timing attacks
* assert that a database secret is configured before hashing/validating
the CSRF token
* opt-out database manager from CSRF: The super-admin password serves
the purpose of a CSRF token in the database manager screens.
There is no request database to obtain the
secret and generate a CSRF token.
Unfortunately Ubuntu LTS does not have passlib 1.6 yet,
even though Debian Stable has it now, so for the sake
of making life easier for everybody we'll stick with
passlib 1.5 for one more version.
This reverts commit c950224ef7.
In function bind_data of website.editor.js, either href is a mailto link
or an url link but not both.
The function convert_links must not convert mailto links.
opw:650443
This field is broken since 230e12b in 2011 (return value to inexistant 'basic'
key). As it was never used and not working, remove it.
Closes#8781Closes#8785
Debian Jessie provides Passlib 1.6 so we're not bound to 1.5 anymore.
Use 1.6's "deprecated=auto" feature: will automatically mark any hash
other than the default as "to update" rather than having to list all of
the supported hashes to deprecate (and remember to update in lockstep
with the schemes list).
When not specified explicitly, the default hash is the first one in the
schemes list.
As the link between moves and operations is done for every quant,
we can do all links between a same operation and move at once.
Besides helping in performance, this fixes problems to handle all the lots
at once for one operation.
The views for pack operation lots are also refined.
In qweb reports, the address is displayed according the standards of the
country where it belongs. In the email templates, the company address was
always displayed in the same way, no matter the country of the address.
Josse Colpaert