* add CSRF token as core.csrf_token
* add CSRF tokens to client-generated and/or JS-submitted forms
* remove broken "compatibility" mode of web.ajax.post
/cc @dmo-odoo I've no idea how that was supposed to work, from looking
things up all modern browsers seem to support FormData, and old IEs
which don't don't support fallbacks either and would require
submitting an actual form as fallback so...
* make CSRF protection the default on all non-SAFE methods
note: there currently is no way to call a CSRF-protected endpoint
without a form-encoded entity-body as that's the only place we get the
CSRF token from.
* simple CSRF token generation: just use the HMAC'd session id, no
generating a new random token per session then HMAC it
* use constant-time equal function to avoid timing attacks
* assert that a database secret is configured before hashing/validating
the CSRF token
* opt-out database manager from CSRF: The super-admin password serves
the purpose of a CSRF token in the database manager screens.
There is no request database to obtain the
secret and generate a CSRF token.
In function bind_data of website.editor.js, either href is a mailto link
or an url link but not both.
The function convert_links must not convert mailto links.
opw:650443
Help has been moved to web_planner, but only in backend. The comportement needs to be defined in website also so it is now shared in frontend and backend (mixin in common)
Avoid 'Uncaught TypeError: t.value.trim is not a function'
When t.value is empty / false, trim crash and so it's impossible
for end user to make translation.
Fix for saas-6 only, don't forward port.
If the user translate a record html field like product... and add block after in English version, the translation doesn't have the new blocks.
In version >= 9.0 the translations contain only textual contents (with font, bold, color...). If a user add a block in english the block appear in all translations (with new text marked to translate).
jQuery has a special behaviour when using .contents() over an iframe
object. This caused an error for escaping when saving the page with an
iframe content of an external domain.
introduced by 8c77c711
opw-649570
For some strange reason, two CSS rules had different priorities between
firefox and chrome (which forced chrome to always display published and
unpublished at the same time).
The chosen solution is to change the value of the button in published/
unpublished instead of toggling and relying on CSS classes (with this
method, the DOM looks better too).
There was also duplicated code in website for assets_backend.
Each theme was duplicating this file.
Now we need to improve this file to be re-usable by others themes.
This fix is only to catch input, in case of the selector is an image.
In 7d40a7d, f820c07, 3ed0628 the way the mobile preview iframe is set
was altered several times. This left an inconsistent needless page load.
This page load was cancelled, but as a side effect in a given set of
conditions:
- an ajax request is done early in current (and so iframe) page,
- phantomjs is used for the test,
- server response time
this could lead to a false positive caused by a cancelled xhr request
throwing the error: "Can't load template, http status 0".
Force fa size to 14px, to avoid that themes which change body size,
change the fa snippet icon size and display it on severals lines.
Add text 'Snippets are loading' while snippets template is downloading.
Escape text nodes changed via the web editor before sending the content
it to the server controller.
It is done since the content is unescaped one time when being displayed,
and it is not done for inline style and script tags (which may be
injected by dropping a snippet) since that would break them.
replacing the solution in cdb900044.
Called by click or changes with enable or disable.
Called only one time by selection.
Receive all changed inputs.
For e.g.: allow to the designer to use this method to open modal or other option.
Xavier Morel