Convert `custom_code_*` to `Html` with no sanitization, such that qweb
considers them markup-safe.
`base_popup_options` value comes from a rendered XML body so should
already be safe
raw -> out in the extended website info template, not sure why this
was even raw
Also mark robots_txt as an unsanitized Html field, that's
not *actually* true but it is true enough for our purposes, especially
since the field gets edited through a text-mode wizard.
Before this commit, we would compare a lang `code` (used in context) and a lang
`url_code`. For languages where those 2 are differents, the `if` condition
would always be falsy, making the canonical URL impossible to be reached.
Technically, this condition is used to get the translated name of records to
later construct the canonical URL.
Since the canonical URL will be incorrect and unreachable, the whole system to
tell search engine/crawler about translation won't work since no
`alternate/hreflang`[1] will be set in the DOM.
[1] see https://developers.google.com/search/docs/advanced/crawling/localized-versions
--------
Technical explanation:
- italian language `code` = `it_IT`, `url_code` = `it`
- belgian french language `code` = `fr_BE`, `url_code` = `fr_BE`
Install those languages on website as secondary languages.
Translate blog `Travel` to `Voyager` in french and `Viaggi` in italian.
Visiting `/fr_BE/blog/travel-1/post/post-1` will redirect to
`/fr_BE/blog/voyager-1/post/post-1` as it should, and the canonical URL will be
set to that same URL.
Visiting `/it/blog/travel-1/post/post-1` will redirect to
`/it/blog/voyager-1/post/post-1` as it should, but the canonical URL will be
set to `/it/blog/travel-1/post/post-1`.
opw-2486918
closesodoo/odoo#69918
X-original-commit: 733411fe03b924832d6b10cadf93c8fc09cc5802
Signed-off-by: Romain Derie <rdeodoo@users.noreply.github.com>
Add the 'data-snippet' attribute on each snippet rendered
by the configurator when building website pages.
closesodoo/odoo#69706
X-original-commit: 7c203eda4210eec7db476aa5ac056150b795b921
Signed-off-by: Quentin Smetz (qsm) <qsm@odoo.com>
Signed-off-by: Sébastien Mottet <smottet@users.noreply.github.com>
The timeout for images download from unsplash is set to
3s. The exception raised when this limit is reached was
not correctly handled.
closesodoo/odoo#69758
X-original-commit: abca5f73c9e2b992f2638341e81bcb01d86872a6
Signed-off-by: Jérémy Kersten (jke) <jke@openerp.com>
On initialization, the website configurator makes a
call to an external service (api_website) hosted on
iap-services.odoo.com to retrieve a list of industries.
This call might fail if the external service is done.
This potential failure is now correctly handled:
On '/api/website/1/configurator/industries' call
failure, the configurator is silently skipped and the
user is redirected to the view website.theme_view_kanban
closesodoo/odoo#69465
X-original-commit: 35311608197ec77bafed82505639314ca693fb19
Signed-off-by: Jérémy Kersten (jke) <jke@openerp.com>
The following two points are necessary adaptations for
the correct functioning of the configurator with the
module deployed on iap-services.
- The routes of the api_website module deployed on
iap-services.odoo.com use model converters to retrieve
the industry selected by the user. The configurator
has been updated accordingly. We now use industry id
instead of industry name. Using id instead of name make
record retrieval faster and model converters handle
exception if the record doesn't exist.
- 'homepage' is now added to the requested pages by
the client. Previously, this page was added by the iap
module to the requested pages.
The following two points are changes to the configurator
route handling:
- multilang=False has been added to the route rendering
the configurator in order to avoid having the lang in
the url.
- If no step is specified in the url, the implicit step
is 1. Therefore /website/configurator/1 has been changed
to /website/configurator.
closesodoo/odoo#69370
X-original-commit: b6efa4caf6514484c254869cb2f1965d207e7c65
Signed-off-by: Jérémy Kersten (jke) <jke@openerp.com>
Signed-off-by: Sébastien Mottet <smottet@users.noreply.github.com>
On website app installation and on new website creation a configurator is launched.
The purpose of this configurator is to generate a website that meet the user's needs.
The configurator is composed of 4 steps:
1) Business description: the user is asked to describe its need with its website purpose (dropdown), its industry (autocomplete search) and its objective (dropdown).
2) Logo and palette selection: the user must select a color palette for its website. He can also upload its logo. In this case color palettes recommendations are generated based on the logo's colors.
3) Features selection: the user select the pages and applications he needs.
4) Theme selection: three themes are recommended to the user based on its industry. This screen display a preview of these three themes.
task-id: 2451965
ENT PR: odoo/enterprise#16949
UPG PR: odoo/upgrade#2316closesodoo/odoo#67537
Signed-off-by: Sébastien Mottet <smottet@users.noreply.github.com>
Previous default website logo of the 'website' module ('YourLogo'
image) looked like a text and not like a proper logo, so it has been
replaced by a more stylised, gray-coloured, version, as a svg.
--
task-2448746
closesodoo/odoo#68075
Signed-off-by: Jérémy Kersten (jke) <jke@openerp.com>
Before this commit a cookie policy page was created every time the
website settings were saved with the "Cookies Bar" option enabled.
After this commit the policy page is created only if it does not already
exist for the website.
task-2454424
https://github.com/odoo/odoo/pull/67217closesodoo/odoo#67370
X-original-commit: 2f920e0023d29545d2957e5d6ca1619068af893b
Signed-off-by: Jérémy Kersten (jke) <jke@openerp.com>
With this commit, all instances of errors being raised inside
`BaseModel.unlink` overrides are moved into methods decorated with
`api.ondelete` which is safer.
Steps to reproduce the bug:
- Delete the current website
- Go to homepage
Bug:
An error 500 was displayrd
opw:2381929
closesodoo/odoo#61959
X-original-commit: ae6515a5fb849a4b561b87eaa5c78035771a17b8
Signed-off-by: Simon Goffin (sig) <sig@openerp.com>
Each time the function is called, we append to the same persistent object.
closesodoo/odoo#60808
X-original-commit: d8790cce3e4a23d2b6b1c32d48d5df14fbdcfd33
Signed-off-by: Jérémy Kersten (jke) <jke@openerp.com>
This commit redirect the user to the website in the edit mode once a theme has
been selected.
task-2172208
X-original-commit: f474eac4543712ae5b1c7d614f9eff9367445107
Use _for_xml_id to replace all the self.env.ref().read()[0]
This has the advantage of having a single point of control and to add
the fields filtering and model verification.
Add sudo for other operations on ir.actions.*
Using a few regex like
\((_\(.*%s.*)(\) % )([\w\[\]][\w .\[\]\(\)'"]*)\)
($1, $3))
Old syntax is still compatible but starts the migration to the new
syntax that catches error.
The domain field on a website is used:
1) to get the right website in case of multi-website
2) to compute base URL of canonical URL
For the 2nd usage, a scheme can be set (eg. https://hello.world) that
will be used instead of default http://
opw-2266224
closes#52784closesodoo/odoo#52796
X-original-commit: bc2899ba0905fe14a481d922a8fc57decf069692
Signed-off-by: Nicolas Lempereur (nle) <nle@odoo.com>
This restricts the attributes of a BaseModel instance to `env`, `_ids`
and `_prefetch_ids`. This way, one can only assign fields on a record;
other assignments are programming errors.
This also reduces the memory footprint of records from 168 to 64 bytes
(-62%), and makes their instanciation faster.
closesodoo/odoo#51075
Related: odoo/enterprise#10529
Signed-off-by: Raphael Collet (rco) <rco@openerp.com>
Issue
- Install website
- Go to Website->Configuration->Pages
- Group By "View"
- Open and edit "Home" view of "My Website 2"
- Remove "Website" value and save
- It should list 2 same views for same url and no website
under one of the "Home" views
- Go to Configurations->Settings
- Create a new website
Traceback is thrown.
Cause
When fetching default homepage,
it retrieve more then one pages and then try
to assign it as homepage to new website.
Solution
Limit query to one to get only one homepage.
opw-2252208
closesodoo/odoo#51280
X-original-commit: 0698f3b0ccddf77a6c0c02812bb823da2d21b265
Signed-off-by: Jorge Pinna Puissant (jpp) <jpp@odoo.com>
render, render_template, load, activity_schedule_with_view,
get_website_pages should all be private:
It should not be possible to render an aribtrary template only with
its name or id
Still need to render some qweb views from js so the method
render_template is kept public.
This explains why the website editor still need read access on
ir.ui.view as we want to allow any snippet to be rendered.
The method fields_view_get should be the only way to retrieve the view
content. This method is executed in a super-user context.
To avoid retrieving views for a model a user does not have access to
(as it may reveal some informations like name of fields), add a
verification of 'read' rights before retrieving the view content.
Execute _postprocess_access_rights with sudo(False) as this method is
used to evaluate which buttons should be displayed.
Remove the su flag to avoid misleading the user and displaying a
button they won't be able to use.
Retrieving the database id from an view key is not considered as a
sensitive information and get_view_id and viewref can be left as a
public methods.
Add missing sudo when needed
Change _handle_visibility in website to avoid increasing the query
count: Checking the visibility (to fail most of the time) to retry in
sudo was making unecessary queries.
Some apps, once installed, automatically create a menuitem in website.
What complexify the UI and create useless menu withtout plusvalue.
It is not because you install livechat to make support online, that you want
a link in your menu to show stats e.g.
Now we remove the default menu created, and help user to find it when he create
a link. The autocomplete suggest most of the main App's controllers
task-2189613
closesodoo/odoo#49081
Related: odoo/enterprise#9733
Signed-off-by: Jérémy Kersten (jke) <jke@openerp.com>
Add in one shot all the states (active or not) for all keys of customize_view
task-2211013
Co-authored-by: Romain Derie <rde@odoo.com>
Co-authored-by: Jeremy Kersten <jke@odoo.com>
Most of the website rendering process depends of customize_show views which are
part of a configuration setup.
Once it has been setup, it will most likely never change afterward.
It makes sense to orm cache those infos to avoid having to query ir.ui.view
table everytime we render something.
Note that just store basic and small infos used for customize_show case.
task-2211013
Co-authored-by: Romain Derie <rde@odoo.com>
Co-authored-by: Jeremy Kersten <jke@odoo.com>
The (private) Rule.build method takes a values *dict* parameter. From
the start it was called with an invalid argument, but before 0.15
`append_unknown` would lead to just not using the argument at all
unless the rule is dynamic (aka has converters)[0].
In 0.15 the code was refactored and the `values` mapping is now used
in every case[1], leading to a pretty systematic error when calling
`search_pages`, which occurs any time an auto-completed URL field gets
used on the website e.g. when converting text to a link using the page
editor or when trying to update menu items.
Fixing this in 13.0 because while the current debian stable ("buster")
still bundles 0.14, the soon-to-be-released Ubuntu LTS (20.04) updates
werkzeug to 0.16. Debian Testing (bullseye) also bundles 0.16 but
isn't expected to get released for another year so it's less of a
concern.
Fixes#47356
Relates to odoo/docker#299
[0]
https://github.com/pallets/werkzeug/blob/c769200d1dcf1e21daaa2781f0c5109586daad42/werkzeug/routing.py#L797-L828
[1] https://github.com/pallets/werkzeug/blob/048cdfd9b969c0c3a133d7ff43b8ad1ad6a673ec/src/werkzeug/routing.py#L1020-L1032closesodoo/odoo#50194
X-original-commit: 4f1589075d2aae65c67a01c5c0f75c19c50a61d6
Signed-off-by: Xavier Morel (xmo) <xmo@odoo.com>
Steps to reproduce the bug:
- Module website is installed
- Multi companies is set
- Go to Website > Settings
- Remove the company for the current website and save
Bug:
A traceback was raised
opw:2228183
closesodoo/odoo#48839
X-original-commit: 2c27b9d100c1f3759bfe864f8ac78bc5c0436ecd
Signed-off-by: Simon Goffin (sig) <sig@openerp.com>
This commit introduce multiple improvements regarding social image:
- (perf) Don't read ir.attachment through `social_default_image` when it is
not needed. Use a stored boolean to know if the field should be accessed.
This will remove one SQL query in attachment for public user.
- Show website logo, not the company logo since we now have a different logo
for website.
- Don't show images lower than 200 width or 200 height px. Logo will be
shown regardless of his size.
- Don't show website logo if there is a website social_default_image.
Indeed, the spec was to prevent showing logo and social_default_image if
they are the same image. Technically, this is hard to identify as they
could be the same image uploaded with different resolutions (media dialog),
especially if one of those was uploaded through the backend and one from
the frontend.
It is most likely we will never correctly identify duplicate as they won't
be exactly the same.
For this reason, it makes more sense to hide the website logo if the
social_default_image is set. It avoids every issues while it makes sense
since you won't want to use the logo over the social_default_image. If you
really want to, you could reupload it through the SEO media dialog.
closesodoo/odoo#47848
Related: odoo/upgrade#1012
Signed-off-by: Jérémy Kersten (jke) <jke@openerp.com>
Co-authored-by: Romain Derie <rde@odoo.com>
Co-authored-by: Jeremy Kersten <jke@odoo.com>
The dispatching layer of Odoo (common to any call) can avoid a query on website
if those 3 values are cached.
Note that for complex business flows, there won't be any gain since website
infos will have to be fetched at some point.
About user_id:
In most cases, for a website page you will need to browse the website btw so
we don't remove this request previously. But in case of a simple image, the
controller /web/content need the public user just to set the request.uid in
auth_public but no other info from website.
With this commit, we don't do the 'select * from website where id in()'
request on each controller declared in auth='public' but use the user_id
from the cache. (Invalidated by the write on website_id)
task-2211013
Co-authored-by: Jérémy Kersten <jke@odoo.com>
Co-authored-by: Romain Derie <rde@odoo.com>
Render page flow:
- Search website.page in _serve_page for requested URL
- Check if the page is visible with `is_visible`
- `is_visible` will get the `ir.ui.view` of the page
Note that this is not 'cachable' as being visible depends of now() for the
publishing date
- Render layout which is getting the website menus
Note that this can't be cached either as a menu visibility might also
depends of it's website.page visibility which depends of now()
- Checking menus `is_visible` fetch the menus pages and those pages views.
Before this commit, every level of menu hierarchy would add 2 queries.
This can be avoided by prefetching everything in once during the dispatch if we
know we will render the website menu.
In such a case, read `is_visible` on every website menus will fetch every
pages, views and menus in the lowest SQL queries possible, eg one query for
every table.
For a 3 level menus, requests goes from 20 to 12 to load a untracked page.
task-2211013
When creating a website, we:
1. Create the website
2. Bootstrap a homepage
3. Copy the generic menu hierarchy tree for that website
But since we just bootstraped a homepage for the website, the home menu was not
using that page but the generic one from the xml data instead.
That's an issue for tests recently introduced in master that needs the relation
to be correctly set for the query count to work as expected.
task-2211013
To avoid a SQL Query on hot state, the website menus ids are now prefetch.
Related to #47257
task-2211013
X-original-commit: 73421c27f01e7100403eaa72e027c34dbdf9f720
Without this commit, the website menus would not be prefetch all in once.
Thus, every call to `submenu` template (called recursively) would do SQL
queries. One when accessing website.menu_id, then for every access on menu's
child_ids. It would also make an extra request for groups since the menus have
an ir.rule for that.
with following structure, 13 SQL queries will be avoided, regardless if there is
a group or not on the menus:
- Top menu
- Home
- Contact us
- Sub Contact us
- Sub Sub Contact us
Related to #47257
task-2211013
X-original-commit: 7fb016f9966bb5e2289ba17eacafb8887626514e
This commit adds two buttons on the Theme side menu that allow users to
add custom XML to the head and to the footer of the website.
Part of #44633
task-2168391
Signed-off-by: Quentin Smetz (qsm) <qsm@odoo.com>
* website_blog, website_event_track, website_forum, website_mail_channel
7dd70438e1 was introduced in stable as a fix, which obviously had some stable
policy preventing some changes.
This commit improves that commit in master.
task-2119086
closesodoo/odoo#45622
Signed-off-by: Jérémy Kersten (jke) <jke@openerp.com>
Following things are done in this commit:
1. changed some labeling and string for more readable and helpful to the user
2. added extra width to the text box
3. added publish/unpublish option for mobile view.
4. track page option auto-activated for any new page,event,job offer,course,
blog.
task-2088546
closes#40085
Co-authored-by: jpr-odoo <jpr@openerp.com>
As an admin or website publisher, you have the possibility to switch website in
the navbar. This will force a website in your session*.
If this website is removed at some point, your session will be broken as the
dispatch will lead to a traceback, trying to read un unexisting website.
* There is other way to have the website forced in the session: theme install,
go to website from settings, create website from settings..
opw-2092845
X-original-commit: 835d1201b8a26168bb003a5fc664e692005cb0a2
With this commit, it is now possible to activate a cookies bar on a
website through the res.settings.
The cookies bar can be edited in the frontend by entering edit mode.
The cookies bar will appear until the user clicks on 'I agree'.
Part of https://github.com/odoo/odoo/pull/41294
task-2087003
closesodoo/odoo#41294
Signed-off-by: Quentin Smetz (qsm) <qsm@odoo.com>
You can use has_group(employee) instead
+ fix enumerate_page: when you search a page with visibility constraints,
you never seen it even if force was set to True.
task-2091365 again
closesodoo/odoo#41483
X-original-commit: f1c7a34f0b8276895c18ca6c450a142f9a815e3b
Signed-off-by: Jérémy Kersten (jke) <jke@openerp.com>
View creation/edition represent a important part of an install and a lot
of possible view errors are not detected, like fields used in domain
filters. Some part of the code a difficult to maintain, and view checks
are splitted in multiple places.
This commit aims at refactoring view validation by regrouping most part
of the logic in ir_ui_view and trying to optimize the overall process.
Since most of the lines were touched, this task was also an opportunity
to modernize the API.
Main changes on method `check_xml`:
- extract node processign and validation to individual postprocessor
- add validation for filter node, buttons, ...
- fix accessibility checks (and improve their performance)
- move xpath check to specific Python node validator
- clarify error messages (wip to continue)
Main changes on method `read_combined`:
- optimize the search for inheriting views in a single query doing the
whole recursive search
Indeed, after removing xpath validations, `get_inheriting_views_arch`
was the most expensive method in `check_xml`, spending most of the time
in `search` because of recursive calls to retrieve children views.
The view Backend Assets is a good example of the latter point, since a
line is added in the view for almost every module. 70 views (community)
are added at first level, `get_inheriting_views_arch` is efficient and
returns all 70 views. Then at the second level, the method
`get_inheriting_views_arch` is called 70 times for nothing. 70 calls to
`search` (squared/2 since each view is checked independently) are almost
useless. The same case applies to the settings view.
As a result, the average module installation time is 25% faster, and the
average time spent in `read_combined` is almost divided by 2.
Now, you can define a Visibility mode between:
Public (All poeple)
Connected (Portal or Employee)
Restricted Group (Has this group or is Employee)
With Password (Know password or is Employee)
Internal Users (Is Employee)
It is a 'fair' feature, but without really warranty that the content is
really unreadable via others methods, ...
It is more for frontend display, that real secret. Dont use this like
a keychain ;)
We only catch the visibility on the main view and not the t-call inside.
Even if it should work on controller too, it is only display now on the
page property menu. (Or on the view directly in backend)
task-2091365
From now, you need to explicitely add sitemap=True if you want your controller
into the sitemap.
It's the default value, but if you forgot it, it will raise a Warning on runbot.
It will avoid wrong controller in sitemap and duplicate (empty) content.
From now, if your model contains a field website_id, the modelConverter for
sitemap will automatically add the domain:
"[('website_id', 'in', (False, current_website_id))]"
It avoid redundant declaration and ugly url in redirect/rewrite view.
Migration: need to remove it from url_from in website.rewrite
task-2065018
closesodoo/odoo#39427
Signed-off-by: Jérémy Kersten (jke) <jke@openerp.com>
You need to provide a small part of the code, because to avoid fraud, google
make several request to be sure that you don't allow all codes :)
So the 'WPS' solution was dropped, now we take the first request from google
that match the part provided, as the good one, and refuse all others requests.
task-2086915
closesodoo/odoo#39186
Signed-off-by: Jérémy Kersten (jke) <jke@openerp.com>
Simon Genin (ges)