An explicit access check when posting a message has been added at odoo/odoo@9920f20e4c
when adding notably computation of display_name as sudo. However this is not
the role of ``message_post`` to check access for such an implementation
details.
Access is anyway already granted through the various browse and record access
done during the posting process. Moreover even message access (creation or
read) is protected notably through its related record ACLs.
Portal/Public access on message_post is anyway done through dedicated routes
using tokens or hash/pid that call message_post as sudo. We can therefore
remove the explicit access check added a bit wildly in the middle of the code.
Task-2710804 (Mail: Clean MailThread API)
closesodoo/odoo#99654
Signed-off-by: Thibault Delavallee (tde) <tde@openerp.com>
Currently using the ``chatter_post`` route to post a message implicitly checks
for access rights on related record. It is done manually in ``message_post``
that is called by the route. It is done because record name is accessed as
sudo and an explicit access has been added because of fear of information
leak.
However this is a bit out of scope for ``message_post`` to perform that check
at that point. As the underlying record is accessed numerous times, adding
an explicit check just adds queries.
In portal, users may have a token and/or a hash and a partner_id, in which
case they enter sudo mode if valid, and an error is raised otherwise. However
when not using a token and/or a hash and a PID access check is now done
directly in the controller helper. Moreover this allows to have the access
error directly instead of being possibly hidden by another error, which was
the case before this fix (was actually raising about missing email_from).
In this commit we add an explicit check on record access before entering
the post computation. That way access errors are directly raised.
A fix in accounting is necessary to ensure the right error is raised. Indeed
otherwise it currently raises due to non existing email_from, and should
raise due to ACL instead. Tests are now more inlined with classic flows.
Task-2710804 (Mail: Clean MailThread API)
Part-of: odoo/odoo#99654
Since the button must be rendered when its text changes, the variable
that holds its text must be stored in the component state. The button
already had the right text before a bit by chance because the new name
was computed before the component was rendered. Now we make sure that
the component will be rendered when the name is recomputed. The problem
is visible if we slow down the getUserModelName function and go to a
forum.post from a forum.forum.
task-2889929
closesodoo/odoo#99599
Signed-off-by: Quentin Smetz (qsm) <qsm@odoo.com>
When hr_recruitment is installed and a user doesn't have any recruitment access, an access error is raised.
This commit fixes the access error, allowing the user to access the hr departments view when hr_recruitment is installed and the user has no hr_recruitment access.
task-2971553
closesodoo/odoo#99591
Signed-off-by: Kevin Baptiste <kba@odoo.com>
We now display only the lines that have documents linked to them.
In case, we want to display a line even if there are no doc, we
can do so by updating the list of counter to keep with
"getCountersToKeep()".
In case, there are no lines, we display a small message.
For now we always display the quotations, sale orders and invoices.
task-2947778
closesodoo/odoo#99373
Signed-off-by: Thibault Delavallee (tde) <tde@openerp.com>
Partial revert of fba6ea5a47
If the designer group is not given automatically to all admins,
they are not able to go through the website onboarding automatically
launched after the website app installation.
Task ID - 2936569
closesodoo/odoo#98542
Related: odoo/enterprise#30626
Signed-off-by: Thibault Delavallee (tde) <tde@openerp.com>
When the admin installs an app, he should see it directly, without having
to give himself the app rights on his user form.
Finetuning of #91909
Task ID - 2936569
Part-of: odoo/odoo#98542
This commit adds the possibility to link a stress day
to specific departments. If the employee is in a
sub-department of the department subject to a stress
day, the stress day will also apply for that employee.
taskID 2946420
closesodoo/odoo#97888
Signed-off-by: Kevin Baptiste <kba@odoo.com>
- Remove `_default_log_exceptions` of our `Cursor` class (unused except
in one test)
- Deprecated `serialized` args of `__init__` (Cursor class) and
`cursor()` (of Connection class), our cursor is always serialized.
- Remove `sql_log` attribute of Cursor class and replace it with
appropriate code to do the same stuff dynamically.
- Simplify some code
- Update some docstring
- Clean import
task-2766494
closesodoo/odoo#85078
Signed-off-by: Rémy Voet <ryv@odoo.com>
- Remove depreciated `after` method of `Cursor`
- Remove `unbuffer`/`flush_env`/`clear_env` methods
- Remove specific code for psycopg version < 2.7 (psycopg version is
always >= 2.7 in our requirements)
- Depreciated autocommit
task-2766494
Part-of: odoo/odoo#85078
Since e014cc88394fb9c8f6cff556ca73d5efafea030f, our proxy
`Cursor` object doesn't return a understandable error when we
try to use it when it is already closed
(`NoneType` or `Recursion` error).
Instead of reverting e014cc88394fb9c8f6cff556ca73d5efafea030f,
add a check in `__getitem__` raising a IterfaceError (like psycopg)
if we try to use psycopg cursor (`self._obj`)
task-2766494
Part-of: odoo/odoo#85078
Small fixup of recent commit [1].
A regular user do not have delete right on iap.account model, hence
creating an access right error. We should allow him to delete accounts
without token so they will be re-created afterwards.
[1]:https://github.com/odoo/odoo/commit/974caef934b7a116b7375f05e047aea15ea960aaclosesodoo/odoo#99877
X-original-commit: 53b05e7f7a7b562154a6523547678d46a8014aae
Signed-off-by: Florian Daloze (fda) <fda@odoo.com>
Signed-off-by: Alex Thuyls (alt) <alt@odoo.com>
This commits fixes the fact that we were having a traceback when puting an image inside a div that was in the div with id #product_detail and clicking on the remove button in the editor. In reality this butotn should not have been available because the image is not in the carousel.
We now check that the image is in the
o_wsale_product_images div (which is the carousel) to display the remove button.
To remove an image outside of this carousel, simply click on the remove block button.
task_id=2973363
closesodoo/odoo#99757
Signed-off-by: William Braeckman (wbr) <wbr@odoo.com>
Before this commit, only a website.page could be used as a custom
homepage ('custom' meaning other than '/').
But it is a real use case and requirement for our users to be able to
select a controller as homepage.
For instance, an ecommerce would want its homepage to be the shop and
not a regular page from where you then have to navigate to the shop.
Right now, this can (almost) be achieved by doing some technical
advanced operations:
- Move the 'Shop' menu first in the menu navbar of the website
- Delete the specific '/' website.page for the website
- Delete the generic '/' website.page (no website_id)
That way, the system will redirect `/` to `/shop`, which is not ideal as
it should remain `/` in the URL.
That's because, until now, the homepage (`/` controller) serve order
was:
- Serve the website.page set as homepage (`website.homepage_id`),
happens when one did select another page as homepage through the page
properties dialog
- Serve the website.page having `/` as URL (default)
- Serve the first accessible menu if there no `/` page or other page set
as homepage, it acts as a last resort attempt to not serve a 404 and
to try serving relevant content (the first menu of a website is most
likely always better than a 404)
- Serve 404
This commit allows to introduce an URL as homepage, instead of only a
website.page. It can be done through the website settings in the
backend.
There is 2 main points to keep in mind about serving the homepage:
- make sure we don't serve a 404 as the website homepage. This is the
website entry point, serving a 404 is terrible. That's why we have
some fallback mechanism like serving the first menu.
- We need to serve / before fallbacking to the first menu, as a lot of
site just remove the 'Home' first menu since it is a duplicate of the
logo, which also redirect to the homepage. In such cases, it doesn't
mean that the user want his first menu to be the homepage. We
shouldn't rely on such a behavior, it should just be used as a last
resort.
With this commit, the homepage serve order is now:
- If homepage URL is set (empty by default), serve the website.page
matching it
- If homepage URL is set (empty by default), serve the controller
matching it
- If homepage URL is not set, serve the `/` website.page
- Serve the first accessible menu as last resort. It should be relevant
content, at least better than a 404
- Serve 404
Most DBs will just have a website.page with '/' as URL and keep the
homepage_url setting empty.
task-2969683
closesodoo/odoo#99100
Related: odoo/upgrade#3876
Signed-off-by: Quentin Smetz (qsm) <qsm@odoo.com>
This commit shows the user Dropship address field in the PO when subcontractor resupply is
done with dropshipping mechanism.
closesodoo/odoo#95770
Related: odoo/upgrade#3852
Signed-off-by: Tiffany Chang <tic@odoo.com>
This commit allows the user to archive/unarchive subcontracting rules by
toggling warehouse settings `Dropship Subcontractors` and `Resupply Subcontractors`.
Additionally, if there is no warehouse with a setting enabled, the corresponding global
routes are archived as well.
Part-of: odoo/odoo#95770
This commit introduces a new pick type used when dropshipping subcontractors,
specifically when the PO resupply relies on the dropship mechanism
this is done by using it for the rules of the `Dropship subcontractor on order` route
Part-of: odoo/odoo#95770
Before this commit, to access the location subcontractors, you needed to search
everytime, the one2many will provide this as well as cache the result for future use.
Taskid: 2848013
Part-of: odoo/odoo#95770
Before this commit, when content of dialog was long, content
overflow but was not scrollable, which makes bottom unreachable,
which is especially a problem when buttons are at the bottom.
This problem solves the issue by adding classname `modal` to
dialog. This classname puts proper handling of overflow of
dialog and its content.
Also remove `align-items-center` so that top doesn't overflow
in isolation from the rest of content, which made top unreachable.
Task-2973866
closesodoo/odoo#99865
X-original-commit: 9f4495aa065da5e94d6ccd007c9f26b7d755f140
Signed-off-by: Sébastien Theys (seb) <seb@odoo.com>
Signed-off-by: Alexandre Kühn (aku) <aku@odoo.com>
Since a field is put inside of the button, the space used by the button
is a bit overblown compared to the text inside, by adding oe_inline we
make it use less space.
closesodoo/odoo#99830
Signed-off-by: William Braeckman (wbr) <wbr@odoo.com>
Before this commit, when searching an emoji in emoji picker,
the last row was frequently now showing. This is especially
a problem with very specific search, whose results are not
showing any result, like "bomb" for 💣
This commit fixes the issue by properly showing the last row.
Task-2976677
closesodoo/odoo#99766
Signed-off-by: Alexandre Kühn (aku) <aku@odoo.com>
This commit fixes the size of an image being set with
a 0 when it was given using the 'size' option.
In legacy, when 0 was given to one of the parameters,
it was simply ignored and not set on the image. Since
the fields has been converted, it was set and the image
was not visible, because of an height/width equal to 0.
A test has been added to assert this behavior.
closesodoo/odoo#99613
Signed-off-by: Simon Genin (ges@odoo) <ges@odoo.com>
The changes in `auth_password_policy` are largely the owlification of
the password meter widget:
- modernize the password policy module and convert it to an
odoo-module (note: now exports a pseudo-abstract class which is
really a policy, for the sake of somewhat sensibly typing
`recommendations`)
- replace the implementation of the Meter and PasswordField widgets by
owl versions
The changes to web and base stem from taking a look at converting the
ChangePassword wizard, and finding that it would be a pain in the ass
but also... unnecessary? It seems to have been done as a wizard
completely in javascript despite being backend-only for legacy
reasons: apparently one of the very old web clients (v5 or v6
probably) implemented it as a "native action" which was directly part
of the client's UI, and so it had to be implemented entirely in the
client.
Over time it was moved back into the regular UI (and moved around
quite a bit), hooked as a client action to maintain access to the
existing UI / dialog.
But since it's been an action opened via a button for years it can
just... be a normal wizard, with password fields, which
auth_password_policy can then set the widget of.
So did that:
- removed the old unnecessary JS, and its dedicated endpoint (which is
*not* used by portal, portal has its own endpoint)
- used check_identity for the "old password check"
- split out `change_password` with an internal bit so we can have a
safer (and logged) "set user password" without needing to provide
the old password, which is now used for the bulk password change
wizard as well
- added a small wizard which just takes a new password (and
confirmation), for safety a given change password wizard is only
accessible to their creator (also the wizard is restricted to
employees though technically it would probably be fine for portal
users as well)
Rather than extensive messy rewrite / monkeypatching (the original
wizard was 57 LOC, though also 22 LOC of template, the auth_policy
hooking / patching was 33, plus 8 lines of CSS),
`auth_password_policy` just sets the widget of the `new_password`
field in the new wizard, much as it did the bulk wizard.
Also improve the "hide meter if field is empty" feature by leveraging
`:placeholder-shown`. This requires setting a placeholder, and while
empty works fine in firefox, it doesn't work in chrome. So the
placeholder needs to be a single space. Still, seems better than
updating a fake attribute or manipulating a class for the sake of
trivial styling.
Notes on unlink + transient vacuum
Although the wizard object is only created when actually calling
`change_password`, and is deleted on success, it is possible for the
user to get an error and fail to continue (it should be unlikely
without overrides since the passwords are checked while creating /
saving but...).
While in that case the `new_password` in the database is not the
user's own, it could be their *future* password, or give evidence as
to their password-creation scheme, or some other signal useful to
attack that front of the user's life and behavior. As such, quickly
removing leftovers from the database (by setting a very low transient
lifetime) seems like a good idea.
This is compounded by the `check_identity` having a grace period of 10
minutes. 0.1 is 6 minutes, but because the cron runs every 10 the user
effectively has 6~10 minutes between the moment they create an
incorrect / incomplete version of the wizard and the moment where it
is destroyed if they just leave it.
closesodoo/odoo#99458
Signed-off-by: Xavier Morel (xmo) <xmo@odoo.com>
Purpose of this PR to improve generic usage of project app.
So in this commit done the following changes:
- move the the filter 'tasks_due_today' and 'late_milestone' above the
'late' filter.
- change label for 'remaining_hours_on_so' according to timesheet uom.
- add placeholder in milestone wizard
- make remaining_hour field colour red when it's value < 0.
- added filter in project_sharing_view search view 'overtime',
'remaining_hours_percentage','tasks_due_today','late_milestone',
'open_tasks','closed_tasks','closed_last_7_days','closed_last_30_days'.
- added optional field in project_sharing_view sub-task list view
'subtask_effective_hours', 'total_hours_spent','priority','remaining_hours_so'.
- added optional field in portal tree view 'timesheet_uom','progress','priority',
'portal_user_names','remaining_hours_so'.
- re-arrange quick search options in search view options in portal view.
- make the 'subcontract service' field company dependent and add
fa-building icon on form view.
task-2889829
closesodoo/odoo#96149
Related: odoo/enterprise#29563
Related: odoo/upgrade#3712
Signed-off-by: Laurent Stukkens (ltu) <ltu@odoo.com>
This commit attempts to fix an undeterministic error, calling an
ensure_one method on an empty recordset.
closesodoo/odoo#99808
X-original-commit: 8e079bc0509f13794c61efeb1080c59baad65590
Signed-off-by: William Braeckman (wbr) <wbr@odoo.com>
Since https://github.com/odoo/odoo/pull/99503, o_xxl_form_view is
removed from the modal but there was still an useless overflow present.
Also we removed the `flex-flow: row nowrap;`,
as the flex direction is handle by the `form_compiler`
Note:
for a display: flex the default value for direction and wrap are:
```css
flex-direction: row;
flex-wrap: nowrap;
```
To reproduce:
- Add a bank account on accounting app
- Choose "create it" at the bottom of the modal
- The modal is broken
closesodoo/odoo#99677
Signed-off-by: Aaron Bohy (aab) <aab@odoo.com>
Before this commit, these tests sometimes failed because the
autocomplete dropdown updated itself after a delay. These tests
patch it s.t. there's no delay in the tests. Something similar is
done in the Many2oneField test suite.
Example of impacted staging and nightly builds:
https://runbot.odoo.com/runbot/build/19121210https://runbot.odoo.com/runbot/build/18976006
This commit also removes unnecessary patches that set the delay of
the Autocomplete component to 0, but this has no impact as this
property doesn't exist (this was done in addition to a patch of
setTimeout which is enough anyway).
Closes#99781closesodoo/odoo#99788
Signed-off-by: Julien Mougenot (jum) <jum@odoo.com>
This commit fixes the BooleanField which didn't
turned the row in edition when clicked on it since
the event was stopped by the Checkbox component.
The disabled input should not stop the event, since
the component do not need to handle a click being
done on it.
The test in editable list has been adapted to add
this assertion.
closesodoo/odoo#99759
Signed-off-by: Aaron Bohy (aab) <aab@odoo.com>
Instead of fetching all field attributes sent with the field list
to the web client,
restrict the attributes to the ones actually required by the web client
This allows, for instance,
to gain 44,75KB on each call on `get_views` for `account.move`,
from 208.78KB to 164.03KB,
with only `account_accountant` installed.
closesodoo/odoo#99660
Signed-off-by: Denis Ledoux (dle) <dle@odoo.com>
To reproduce the issue, set the local timezone of the computer and the user to Pacific/Auckland.
Create a new time off from the dashboard.
The date_from and date_to are one day apart.
task-2885980
closesodoo/odoo#99072
Signed-off-by: Kevin Baptiste <kba@odoo.com>
Opening journal items does a query similar to
```sql
SELECT
"account_move_line".id
FROM "account_move_line"
LEFT JOIN "account_move" AS "account_move_linemove_id" ON ("account_move_line"."move_id" = "account_move_linemove_id"."id")
WHERE
ORDER BY "account_move_line"."date" DESC,"account_move_line"."move_name" DESC,"account_move_line"."id" ,"account_move_line"."id" LIMIT 80
```
Indexes on `date` weren't used in such queries. Building a compound index that includes
`id` changes the index cost computation, and allows a Index Only Scal. So, it does not
have to jump on data pages anymore to retrieve the ID of rows.
Without that, postgresql will use a Seq Scan. It went from 10s to 5ms in our production
database, to open the list of journal items.
Part-of: odoo/odoo#99795
Since the "canCreate" option was not propagated this was leading
to a traceback with the autocomplete.
Indeed the option "No records" was never added because it was always
in a loading state.
closesodoo/odoo#99689
Signed-off-by: Aaron Bohy (aab) <aab@odoo.com>
Since the PR introducing the wowl environment in the discuss app, the
model manager is not set in debug mode during tests. The debug mode
is usefull since it adds integrity checks and more verbose error
messages. This commit restores it.
closesodoo/odoo#99556
Related: odoo/enterprise#31086
Signed-off-by: Alexandre Kühn (aku) <aku@odoo.com>
- Made executeGracefully in messaging so it can have specific
behaviour in qunit tests (no timeout)
- guard all usages of `executeGracefully` in case current record
is deleted (e.g. during test teardown).
Task-2976295
Part-of: odoo/odoo#99556
This computed field was manually updating a field, which is
not correct. Instead, this field should have been an `onChange`,
which is what this commit does as a fix.
Task-2976940
Part-of: odoo/odoo#99556
Since recently fields are not present in the views if the user does not
match the groups attribute on that field, this means that the field is
not loaded an may not be used in domains in `attrs` for example.
Most fields were properly checked but some remained broken.
closesodoo/odoo#99751
Signed-off-by: William Braeckman (wbr) <wbr@odoo.com>
Before the websocket were introduced, the last notification id was
persisted in the local storage in order to use it even after a page
reload.
The last notification id is now stored on the `SharedWorker` which
means this information is lost if the last opened tab is reloaded.
This commit fixes this issue by storing this information by the mean of
the localStorage. Since the localStorage is not accessible from the
worker global scope, the bus service will store this information and
relay it to the worker when starting. The worker will now wait to
receive the last notification id before subscribing.
closesodoo/odoo#99621
Related: odoo/enterprise#31124
Signed-off-by: Sébastien Theys (seb) <seb@odoo.com>
Refactor the tabs to be :
* Automatically aligned on a 40px grid.
* A tab only need one delete to remove.
* Arrow navigation around tabs is working as intended.
task-2871848
closesodoo/odoo#99460
Signed-off-by: David Monjoie (dmo) <dmo@odoo.com>
Ensure the selection is never put inside a contenteditable=false
element when correcting the selection due to navigating around ZWS.
Part-of: odoo/odoo#99460
* Add test for the new Odoo Editor Tabs.
* Refactor test utils to simplify and
remove deprecated or unused features.
task-2871848
Part-of: odoo/odoo#99460
Géry Debongnie