An ir.attachment record can be served as a request's reponse if:
- a request triggers a 404
- the ir.attachment record has its url field matching the url of
the failed and is of binary type
Following rev[1], portal users have the right to create these kind of
records, and it is a security concern.
This patch restrict the ability to create and write on the ir.attachment
records that may be served through the dispatch's exception mechanism to
settings users.
As the asset bundles files are served through the use of these special
ir.attachment, we make sure to retrieve only ir.attachment records
created by the superuser in the `get_attachment` method.
As website administrators often need to play with these special
ir.attachment, we also let to this group the permission to manage them.
[1] 61065b6d04
Some IPs (like google-proxy ones) are not bound to a specific country.
Legacy Database used to set country_code to 'EU' for these one. geoip2,
on contrary, does not set the country. Read information from `continent`
attribute in this case.
opw-1844888
Urls like `/page/website.XXX` are redirected to `/page/XXX`.
Before this commit, the redirection would not keep query strings:
`/page/website.XXX?rde=1` would redirect to `/page/XXX`.
Now, we keep the query strings:
`/page/website.XXX?rde=1` will redirect to `/page/XXX?rde=1`
Closes#24140
Courtesy of @MTantin
Before this commit, if you or a lib uses Glyphicons, the font was loaded from
/web/content/fonts/ (or /web/static/src/less/fonts/ in debug=assets)
It is because bootstrap is imported from /web/static/src/less/import_boostrap.less
not directly from /web/static/lib/bootstrap/less/bootstrap.less
Now, we use absolute path to load font, overriding the variable define in
variables.less from bootstrap.
This commit https://github.com/odoo/odoo/commit/965f49201812cc3cca319a3b5b93331272dd2288 removed empty meta-description and meta-keywords from
the DOM for SEO audit reasons (these tags when empty are considered as
duplicates at a SEO point of view).
By doing so it prevent the 'Optimize SEO' to work correctly since it can't
retrieve the DOM elements that are used to store the user modifications until
he saves.
Now, even when these meta-tags are empty, we display them to people having the
rights to 'Optimize SEO'.
This closes#23659
Apparently, SEO audit thingies (possibly google's own? unclear) don't
ignore *empty* keyword or description meta tags, then complain that
they're duplicated (there's a use case for SQL-like nulls).
So remove the keyword & description metas entirely if the
corresponding fields are empty.
OPW-815492
* web_editor, website
This commit fixes a bug with table duplication in mailing template:
- Click on a snippet with two columns
- Duplicate it
-> the snippet is duplicated but the two columns are transformed in two
rows.
This was because there is an implemented behavior for column
duplication: if we duplicate a column which was alone on its row, we
duplicate the row instead. This code should however be triggered when
duplicating the column alone to be working, not the snippet that
contains it.
Note: this required a backport of a33ec972ab
which was fixing a non-critical "bug" for 11.0. This non-critical "bug" is
therefor fixed here too.
opw-807105
Odoo Translation Bot