By default, werkzeug doesn't preserve the order
of the parameters sent to routes.
As stated in the werkzeug documentation:
```
parameter_storage_class
the class to use for args and form.
The default is an ImmutableMultiDict which supports multiple values per key.
alternatively it makes sense to use an ImmutableOrderedMultiDict
which preserves order or a ImmutableDict which is the fastest
but only remembers the last key.
It is also possible to use mutable structures, but this is not recommended.
New in version 0.6.
```
For some of our use cases, it makes sense to keep the order
of the route parameters.
e.g. In the website builder, when building a form
with a bunch of inputs values that will be concatened
in a lead note, the user expects the answer to be displayed
in the same order than the form inputs.
This change is seen as a bit risky as it could lead to
performances issues in the http routes processing, and this
is the reason we do not merge this in stable 9.0 at the moment.
If needed, it could be back ported later to 9.0, after
several weeks/months of testing in this release(saas-10 atm).
opw-677508
The parameter forward_debug is used to keep the debug mode during redirection.
Previous code was setting the debug to None which is ignored by werkzeug, making
the option useless.
Closes#12107
Odoo serves files based on the mimetype imported with python module Mimetype.
In some case, mimetype on windows for svg is undefined or misconfigured and
the svg is returned as text/plain (and so xml and not img).
This commit overrides the default mimetype to render .svg file with mimetype
'image/svg+xml'.
It is similar to add/override the key from windows registry with:
```
[HKEY_CLASSES_ROOT\.svg]
@="svgfile"
"Content Type"="image/svg+xml"
```
The advantage to override it in Odoo, is to be sure that even if this key has
been updated or deleted by a cleaner software or malware, Odoo continue to work
This closesodoo/odoo#12150, closesodoo/odoo#9061, closesodoo/odoo#9118
Backport of 8423a0df34
Clear the cache/environment in addition to rolling back
the cursor, in order to retry the transaction with fresh
data, not partially stale data.
- add or fix decorators on methods
- fix most compute methods (wrong dependencies)
- revert changes in `eval_context` of `ir.actions`
- various code simplifications and improvements
- migrate methods that were not
- ir_qweb: modify `QWebContext` to take an environment instead of `cr`, `uid`, `context`
- ir_qweb: convert `AssetsBundle` to use new API `env`
- ir_ui_view: use decorator `multi` on method `read_combined`
- ir_ui_view: ensure that method `render` is never called with an xml_id
- ir_ui_view: factor out part of the `ormcache` key of method `_read_template`
This is a rather large change for developers: from this commit on, we
need to use debug=assets instead of just debug to split assets.
The About menu has been slightly improved as well (the link does not
appear when we are already in debug mode), and an option has been added
in the debugging menu to activate the assets debugging mode.
After initial implementation CSRF protection had been left poorly
documented tripping up users and developers (#9538, #10139).
Add a warning in the logs for developers, and a more extensive
explanation of the whole thing in the @route docstring (and the official
documentation).
Fixes#10158
In some cases the Referer HTTP header may be missing or
stripped by a proxy, browser extension or anti-virus.
This breaks debug mode because it was solely relying
on the Referer header.
Introducing an explicit X-Debug-Mode header for RPC
calls allows for an alternative method that works
even when the Referer is missing.
This won't work in all cases, e.g. for direct $.ajax
calls, for example.
Closes#9824
If the current cursor transaction was not empty when using the check
called endpoint, at the first call the cursor would be rollbacked but
the environment could still have outdated values.
This was an issue for example when selecting the route would trigger
database insert, for instance when a model was used in the route and
this model had also translatable prefetchable fields with tokens not
already present in ir.translation
opw-652045
* make CSRF protection the default on all non-SAFE methods
note: there currently is no way to call a CSRF-protected endpoint
without a form-encoded entity-body as that's the only place we get the
CSRF token from.
* simple CSRF token generation: just use the HMAC'd session id, no
generating a new random token per session then HMAC it
* use constant-time equal function to avoid timing attacks
* assert that a database secret is configured before hashing/validating
the CSRF token
* opt-out database manager from CSRF: The super-admin password serves
the purpose of a CSRF token in the database manager screens.
There is no request database to obtain the
secret and generate a CSRF token.
The stdlib version of the json library is more recent than the 3.5.3
version we are pinning in `requirements.txt`
There is no reason to use it.
Closes#6940
QWeb's LazyResponse mechanism allows controllers to be inherited
and to alter the rendering context (qwebcontext) *after* calling
super().
However it caused the final rendering to occur outside the protection
of the @service.model.check decorator that handles concurrent access
errors. In rare cases the lazy rendering can be interrupted by
a concurrent access error, for example when bootstrapping the
the cache of asset bundles (as it INSERTs a bunch of attachments).
By forcing the flatten()ing of the lazy response earlier, right
after calling the route's endpoint(), it occurs within the
protection of the @service.model.check, and benefits from the
automatic retry.
flatten() was modified to avoid rendering twice the template
The flatten() in get_response() is still necessary for addons
code that directly calls get_response().
Moved QWebException into openerp.exceptions next to the other
exceptions classes - since it now has more global semantics.
~
The whole request dispatching code could really do with a
complete redesign/simplification.
Request arguments were being stored on the routing
endpoint during the dispatching.
This could cause request0 to use parameters from request1
if request1.set_handler() is called before request0's
dispatching is over. No reason to store request arguments
on routing endpoints anyway.
In method `user_has_groups`, make "Technical Features" effective in debug mode.
Make the group "Employees" inherit "Technical Features".
Make the group "Technical Features" invisible in the user form view.
Remove useless `ir.rule` attached on group "Technical Features".
Fix `test_acl` by avoiding the tricks around the group "Technical Features".
When storing files send in POST in session_store, store them with a
name based on the name of the session file itself (ease matching sessions
and files for debugging purpose)
POST requests on routes with auth="user" are now correctly handled when
the user is not connected. Request data (form and files) are stored in
the session. Once the user is logged, redirect her to a specific route
that will reprocess the original POST request.
Since 31d817e, we rotate then session at login/logout.
Unfortunatly, `openerpframework.js` does not support session id change
at authentication and keep old one.
In order to keep compatibility with existing js clients (including 7.0
ones), we do not rotate the session at authentication.
Fixes#6948Closes#6949
return request.not_found crash with a internal error, because get_response
takes a environment as param.
Werkzeug Documentation:
Keep in mind that you have to pass an environment to get_response() because
some errors fetch additional information from the WSGI environment.
The `rotate` flag introduced by 31d817e849
was initialized at the very end of the session init, after
the reset of the `modified` flag.
This had the side-effect of marking the session as modified
for every request, saving the session to disk every time
even without any change.
Closes#6795
- remove useless cache clear_prefix
- add a route cache attribute when used it will save the rendered page into the
ormcache for the specified time, this is only enabled if the user is public
and reponse code is 200
- enable it on /page controller for 5min
This fixes an issue in property `field.digits` that cannot find a valid cursor
to the database. Forcing the instantiation of an environment makes the cursor
retrievable.
When returning an HTTPException e.g. by calling ``request.not_found()``
which returns a ``werkzeug.exceptions.NotFound()``, the http system
would log a warning as HTTPException is neither a subclass of Odoo's
Response nor a subclass of werkzeug's BaseResponse.
Move the string response case about (for flow clarity), and convert
HTTPException instances to Werkzeug responses then fall into the normal
BaseResponse -> Response case to ultimately get an Odoo response object
out of the HTTPException instance.
Olivier Dony