Before this commit:
1. If the website's homepage is unpublished and a public user naviguate on it,
it will log an access read error in the server. The user won't see the error
though.
2. If the user can't access '/', we serve the first menu's page instead.
This first menu's page can be an unpublished page, resulting in a 403, which is
not convenient.
3. Menus are sorted by sequence, then the ORM sort them by write_date.
Menu with same sequence will be sorted differently every time you edit one of
them. (This issue get hidden/solved if user edit and save the menus with
"Edit Menu" since it will recompute every sequence.)
- Create 3 pages 'A', 'B', 'C', with 'Add page in menu' enabled
- Menu is now 'A B C'
- Edit website.page B (in property dialog), it will write on the page's menu
aswell
- Menu is now 'A C B'
Now:
1. We prevent this error by ensuring the page is published and so can be read
by anyone before accessing its properties.
2. We serve the first menu's page that is published
3. We sort menu by id after sequence to keep original order
This closes#21259
This reverts partially commit ab2283ef83.
This commit clean and clarify some code.
It also secure the call to specific page extension's template to avoid somehow
calling unexisting tempalte
Before this commit:
1. You could create a page with supported extension in the path (eg: myfile.js)
You would then be redirected to the webeditor (myfile.js?enable_editor..)
But in this case, it would just redirect you to a plain text page without odoo
layout because supported extension are rendered with a specific mimetype.
(is it is a .js page, it will just render the page content as a js file)
2. These kind of page would still call t-layout that you should be removed in
backend in order to make it work
Now:
1. You will be automatically redirected to the back end to edit your file
instead of landing on a text-only page.
2. Supported extension now have their own template (eg: .js file now have
<script text=..> tag added automatically in their content)
- labelling and screen redesign (update labels, hide labels, hide fields, ...)
- make UI more mobile friendly (icon biggest, color using less variables,...)
- Page & Redirection menu are for visible only in debug mode
- Add meta noindex for website.page not shown in sitemap
- Add mechanism to be able to edit in backend a broken view
(Needed for - Internal Error 500, css, js file, ...)
- website pagemanager dedicated to website_publisher only
website.page = old ir.ui.view with page=True
website.redirect is a new mechanism to replace in the futur the ir.attachment
mechanism of redirect.
From now, we don't have a specific /page controller to serve 'page'.
We use a new model website.page which is rendered if none route matches the url
and that the field 'url' on website.page matches the request.httprequest.path.
The order to serve a path is:
- Routes defines in controllers (/shop, /blog, ...)
- ir.attachment with name matching the path
- website.page with url matching the path
- website.redirect with url_from matching the path
- 404
To improve:
- allow regexp in website.redirect model
- allow to edit the view_arch from the page.management via redirect backend
(needed when traceback in the page, or when modifying a js/css/less/...)
In a multiwebsite environment, (de)activating some theme views produces
undesired results if the same view exists in different ways for different
websites.
With this patch, we search before for a website-specific view with the provided
key, and fall back to the XMLID-found one if there is no specific view.
This commit closesodoo/odoo#17970
Now that we're closer to switching to P3 for good, these helpers have
outlived their usefulness, and mostly add noise.
All remaining dict.iter*() or dict.view*() must be converted to the
normal keys(), values() or items() calls.
Whenever the result is likely to be used for more than the scope of a
loop, or when the dict needs to be modified during iteration, the calls
must be wrapped in a ``list()``, to protect the new P3 semantics.
Those cases are very exceptional.
Also removed some dead code or improved the API to remove unnecessary
conversions.
* remove references to basestring & unicode (use relevant pycompat
helpers)
* remove some str calls (either entirely or replaced by relevant
helper, either text or native)
* use better API to avoid unnecessary conversions
* remove some XML declarations in views
* StringIO removed from stdlib, replace with io
* try to correctly handle BytesIO/StringIO (one is for bytes the other
is for text)
* fix base64: Python 3 removed bytes-encoding and bytes-bytes
codecs (via #encode) so replace all calls to str.encode('base64'),
also b64encode is a bytes->bytes conversion so attempt to properly
handle that
issue #8530
Code managing language in URLs and redirection is moved from website
to http_routing. Override of _dispatch in website now consists in adding
website to the request.
url_for and is_multilang_url tools methods are also moved from website
to http_routing.ir_http as those are required for the moved code.
Some renaming is performed on request attributes previously added in
website. Indeed as website keyword may be misleading now a renaming
has been performed to better understand them :
* request.website_enabled -> request.is_frontend
* request.website_multilang -> request.is_frontend_multilang
* request.httprequest.cookies.get('website_lang') -> ('frontend_lang')
* first_pass variable in _dispatch is replaced by a new attribute of
request, routing_iteration, that is the number of routing iterations
currently done
Slug and unslug API is now available in http_routing. Indeed there is no
link to any website or any reason to not support slufigied URLs when
website is not installed. A new unslug_url method is added as a tool
coming from an embedded method from website. Doing it allows to have all
slug related methods defined at the same point.
Support of slug and unslug in qweb rendering is also moved directly in
http_routing version of ir_ui_view instead of website inheritance. This
is done in order to keep things coherent.
Some code from website about ModelConverter is also moved. Indeed both
versions of ir_http uses some kind of placeholder to store the uid
when converting urls to python. This commit unifies it by using the
website one directly in base to simplify the override.
This commit also updates all module importing slug. Enterprise modules
will have to be updated, see related commit.
Before this commit, the session object was responsible for loading the
translations in the backend only. There was then ugly code in web_editor
(which is also loaded in backend...) which was doing "if frontend then
load translations by myself". This code was also translating templates
while this is the qweb object's job. Now session is always responsible
for loading translation.
Note: the session object should be refactored/split.
``import odoo.addons.foo as bar`` doesn't seem to properly trigger the
import hook in Python 3 (it blows up on decimal_precision and
base). Thus convert *all* examples of that pattern to the more
sensible ``from odoo.addons import foo as bar``.
In Python 3, all of these were "consolidated" under urllib(.request,
.parse, .errors) which is inconvenient.
Since we already have hard dependencies on requests and
werkzeug(.urls, which is a backport of Python 3's unicode-aware
urllib.parse) migrate *everything* to that.
A sticking point is urllib2.URLError, those were (mostly) replaced by
the slightly more general IOError which URLError extends.
* cross-version metaclass spec
* more formally deprecate browse_record and browse_null since they
were using metaclasses anyway
* update docstrings referencing the latter
In Python 3:
* various builtins and dict methods were changed to return
view/iterable objects rather than lists
* and the separate Python 2 view/iterable builtins and methods were
removed altogether
This is problematic when using these items as list (which the happens
repeatedly in Odoo), but more viciously when iterating *multiple times*
over them (which also happens, which I've messed up multiple times while
writing this, and which is a pain to debug even when you've just created
the issue).
Convert all code using these to semantics-matching cross-version
helper functions to get the LCD behaviour between P2 and P3, and
forbid the builtins via lint.
issue #8530
About a `sudo` on ir.ui.menu, this commit (3649b7f359) removed it,
this commit (3d0cc2d6d2) re-added it.
Since portal user can not go on /web anymore, I think portal does not need to read ir.ui.menu.
Here some news scenario:
- if website is not installed, portal can log in, but will be redirected to login page
with an error message 'only employee can access'. Indeed, there is no page to display for
such user.
- if website is installed, but not website_portal, portal user can log in and will be
redirected to homepage. If he tries to manually access to /web, he will be redirect to
login page with access error (even if he will still be logged).
- if website_portal is installed, the portal user can fully enjoy its features.
This reverts commit 2d10c5eb43.
The fix was only needed up to saas-14. In saas-15 and over there is
another fix which adds the `uid` parameter back: 65ac6b8ae
The current user was used to generate the sitemap. So if a user with
more permissions than `public user` goes on the sitemap, he could
generate it (if he is the first to see it or the last generation was
more than 12 hours ago (by default)) and have pages unavailables for
a user with lower permission in the sitemap (until the sitemap is
generated again).
The issue was solved in 8.0 with d08facdcb but was introduced back in
10.0 with fd09ddb6f because the `uid` argument was dropped from
`generate` method on `ModelConverter`.
From 10.0 up to saas-14 the fix introduced is to use a `use_public_user`
key in `request.context` but in master we will keep the fd09ddb6f fix
by adding uid to the `generate` method.
opw-708456
note: to forward-port only up to saas-14
Template "sitemap_index_xml":
<loc><t t-esc="url_root"/>sitemap-<t t-esc="page"/>.xml</loc>
should be:
<loc><t t-esc="url_root"/>sitemap-<t t-esc="website_id"/>-<t t-esc="page"/>.xml</loc>
The fix in python is not elegant but allow to fix without -u of website.
Commit a2ae219d4e fixed the customize_template_get
function(s) which had been modified for the 10.0 web_studio release.
While the fix also reorganized the structure to make it more efficient
and understandable, it promised that the function would be refactored
in master. This is what this commit does.
The customize_template_get route of the website module was also removed
with commit 5a030db3eb as it was an useless
duplicate of the web_editor customize_template_get route.
The old route handled two totally different features of odoo: getting
all the page-related views to allow their edition with the HTML editor
and getting the "toggable views" which appear in the "Customize"
website menu. The parameter "full" allowed to determine which one the
route was supposed to do and was useless until website was installed to
add its feature (by extending the route behavior). In both cases, views
informations are returned, only the number of views differs. The
above-mentionned fix already did part of the refactoring by returning
the same info structure for each view in both cases.
Now, the function has been split. The web_editor customize_template_get
route is renamed as get_assets_editor_resources and returns the info the
HTML editor needs to work (the "assets" term is in prevision of the
new LESS editor).
A new website route "get_switchable_related_views" has been created to
return the info the "Customize" website menu needs.
Both use the renamed ir.ui.view function "get_related_views" (old
ir.ui.view customize_template_get function) which now returns a
recordset and not a list of dictionnaries.
Stop using ugly code for ace editor.
* Really close the ace editor by changing its display property thanks
to the dedicated do_show and do_hide method.
* Make the common part of ace editors (website, web_studio) consistent
so that the extensions are really small.
* Do not do RPC to retrieve data already retrieved (now, there is only
one unique RPC when the editor starts an one RPC per view changed
on save).
* Fix born-dead code so that the website editor starts automatically
if the URL contains its associated hash and loads the correct view
* Better handle errors (previous behavior only worked partially and
only on chrome):
- Jump to the error line and make it red.
- Do not open a Dialog with mostly incomprehensible message but
allow to open it on click of the error marker.
- Do not save any changed file if one contains an error.
- Do not allow formatting a file if it contains an error (show the
error instead).
* Do not use different routes to get the same content (remove the
/website/customize_template_get route as it returns the same
content as /web_editor/customize_template_get route). Note: in
a further commit this route will be refactored.
* In a general way, use consistent method names and behaviors /
comment the code / lint files / ...
* Open the code to extensions (so that it may later load other data
than XML).
Note: this refactoring allowed to fix bugs in previous odoo versions
but this commit message will not detail them.
Commit e11f23b701 split the website
customize_template_get into web_editor and website ones. This split
was not perfect and commit 20861b482a
tried to make it work... but did not made it totally and added an
indirect dependency to website module in web_editor...
As the final result is wrong and inconsistent and that the previous
9.0 implementation was already ugly, this was not possible to make
a consistent full-stable fix.
This commit tries to make a fix as stable as possible (the main method
name did not change, the arguments did not change, their purpose is
the same, ...) which makes the code work and be less ugly. However,
the function returns are now slightly different (and JS depends on it).
It returns only valid view information (not header stuff which is not
related to anything and the inherit_id value is now a combination of
the inherit view id and name). Also, a new private method has been
created.
Also, the method contained code which was deprecated since saas-6 but
was never removed (and never broke anything "by chance").
In master these methods will be refactored to make more sense.
The commit e59a7fe3ff has moved
the ACE editor from website to web_editor. As some code on ir_ui_view
was used for this widget, the code has also been moved to web_editor.
When logged in a user was redirected to the website instead of the backend.
This was due to a wrong group verification, at that point:
- request.uid = ID of the user authenticating (e.g. admin)
- request.env.uid = ID of the user that rendered the page (public)
As public does not belong to `base.group_user` group, the user was redirected to
the website.
Introduced at fd09ddb6 during migration.
Fixes#13203Closes#13204
Romain Derie