The reified view on the res users will be dropped in the following commit.
The previous commit adds support to define each group as a computed field on the res users.
This commit defines:
- A boolean field for each 'isolated' res.group, i.e. a group in the hidden category.
- A selection field for each 'Application' res.group, i.e. a group in a application category.
Example:
- The group to manage pricelist in sales becomes a boolean field
- The groups project user/manager become a selection field
Purpose
=======
Lots of small things could be improved in the general settings (labels to rename, layout issues,...)
Specifications
==============
- auth_oauth: Remove useless title
- base_gengo, : Fix layout issue due to missing oe_inline class
- base_setup: Modify Inter_company_rule labels
- google_calendar: Remove technical menuitem leading to general settings
- ir_actions_todo, ir_ui_menu, mail_message_subtype: Add a handle widget on the line instead of displaying the sequence
The new settings model loads by default all settings. In the case of
non-admin user having the 'Settings' access rights this can lead to
access errors.
This commit deals with the multi-company issues on a standard
installation. If the admin is in Company A and the other user in Company
B, accessing the settings is pretty much impossible because of records
rules.
This fixes the master or demo data to avoid setting a company by
default. Note that it only fixes a standard installation: if the
settings are later customized, there is no guarantee that it will still
work.
Problematic fields:
`auth_signup_template_user_id`
`crm_default_team_id`
`leave_timesheet_task_id`
opw-801210
If it is unsetted there is currently no way to set it back unless putting
directly the ID in the ir.config_parameter table. Let us therefore allow
people to reset their template user for signup.
* allow new signup on invalid token
* relabel signup buttons
* send a welcome email upon signup with a signup token.
This way, should the token somehow be usurped by someone else,
the original partner's email address will be notified.
(before the usurper can change the email)
This commit duplicates the General settings' User Signup options in
the Website configuration, with a clear description of the options.
We also remove the unnecessary usage of safe_eval in auth_signup's
res_config.py. As stored values are repr values of a boolean field
just comparing the string values is sufficient. There is no need to
use safe_eval as it should be used only when necessary.
Mobile virtual keyboards will often capitalize the first letter of
an input text field, which is annoying as odoo logins are case-sensitive.
This will no longer happen thanks to this new attribute.
X-port of commit odoo/enterprise@b8632f8bb6
* make CSRF protection the default on all non-SAFE methods
note: there currently is no way to call a CSRF-protected endpoint
without a form-encoded entity-body as that's the only place we get the
CSRF token from.
* simple CSRF token generation: just use the HMAC'd session id, no
generating a new random token per session then HMAC it
* use constant-time equal function to avoid timing attacks
* assert that a database secret is configured before hashing/validating
the CSRF token
* opt-out database manager from CSRF: The super-admin password serves
the purpose of a CSRF token in the database manager screens.
There is no request database to obtain the
secret and generate a CSRF token.
In the case of a signup with token, the user login
already exists, and changing of login (email) is
therefore not allowed.
It's the same behavior than in the reset password
view (`auth_signup.reset_password`)
opw-648125
- fix html and css layout using only pure bootstrap
- replace db selection by a link to the database selector
- reorder templates
- remove unused templates
Yannick Tivisse