In v8, it was not allowed to create a DB with a name containing a space.
This should still be the case from v9 since it causes issuesfor backup
scripts, for example.
Reintroduces 1a0e9063d4
opw-727613
Modern browser implement the autofill specs as described at
https://html.spec.whatwg.org/multipage/forms.html#autofill
This means that there is now a way to tell the browser when a password
field is supposed to be filled with the user's own password (e.g. on a
login field), and when it's supposed to be used to input a new secret
value (e.g. when changing someone else's password).
This can be distinguished by setting the autocomplete attribute
to `current-password` or `new-password`.
In addition, many browsers have decided to entirely disregard the
autocomplete='off' attribute value, because it is felt that using
a secure password manager (as provided by those browsers) is a net
gain for security, allowing users to pick stron passwords.
See also https://developer.mozilla.org/en-US/docs/Web/Security/Securing_your_site/Turning_off_form_autocompletion
Based on this, the framework should generally consider that
password fields in the backend are meant to be used for *setting*
new values (autocomplete="new-password", i.e. no autocompletion!),
whereas the password field on the login page can indeed be autofilled
with the user's current password (autocomplete="current-password").
In addition to making the above changes, this patch also
lets developer specify their own `autocomplete` attribute on
text input fields.
If the user writes a password larger than 4096 characters at the login
screen, it causes a crash instead of displaying the "Wrong
login/password" message.
The Python library used to hash password (passlib) is by default limited
to 4096 characters. Above this limit, it raises an error (source:
https://pythonhosted.org/passlib/lib/passlib.exc.html).
Allowing a password larger than 4096 is not necessary, we just limit the
field maximum length since such a situation should happen because of an
incorrect copy/paste.
opw-704110
When a database is created, we are not auto-logged in to the new
database anymore because the login passed to the authentication request
is 'admin' instead of the one set in the creation form.
To fix this issue, we used the login parameter from the creation form
in the authentication request. We also set the login field to
required in the create database form view.
This bug comes from rev https://github.com/odoo/odoo/commit/903733a32
The web modules defines a "layout" template which is only used by the
login default page. Now the backend template "web.webclient_bootstrap"
and the frontend template "website.layout" both use the "web.layout"
template as base.
Some parameters can be passed to customize the default "web.layout"
template:
- "head": content will be placed at the end of the <head> tag of the
page
- "title": to set the title of the page (the <title> tag should not be
placed "by hand")
- "x_icon": the url for the page icon
- "html_data": dictionnary whose key-value pairs will be placed as
attribute-value for the <html> tag
- "body_classname": the classname to set on the <body> tag
Note: xpath expression on the website.layout template can now only find
the #wrapwrap element and its children. An expression "//body" will not
have any result. If something has to be added in the body element but
not in the #wrapwrap element, simply change the xpath
<xpath expr="//body" position="inside"> with
<xpath expr="//div[@id='wrapwrap']" position="after">
When you backup 3 dbs with the database manager, you had 3 times the warning.
Underscore is not loaded, so _.once not available.
This commit closes#13173
Commit 977db823c7 refactored the web module so that it gathers
common features of community and enterprise. The problem is that the
web.webclient_bootstrap template content lost its groups attributes.
This had the effect to make the client crash when accessing the
template for calendar invitation for example, as the template was
trying to render menus without menu data.
Private browsing in Safari doesn't allow to store anything in the localStorage,
and it throws an error when you try to do so. This new JS module is a connector
to the browser's localStorage if it is enabled, and if not, it simply keeps its
own storage in RAM.
All actions of the database manager redirect the user after an action except the
backup option which returns an octet stream.
Close the modal after form submission to mimic the same behaviour.
Do not close the modal for other actions than database manager to avoid waiting
time for create that may be long to process.
Add message to warn the user about backup waiting time after cliking on submit
to be less confusing for big databases that may take a lot of time to be ready.
Fixes#10803
Mobile virtual keyboards will often capitalize the first letter of
an input text field, which is annoying as odoo logins are case-sensitive.
This will no longer happen thanks to this new attribute.
X-port of commit odoo/enterprise@b8632f8bb6
Christophe Simonis