Commit 9676ceec02 removed/replaced image files in mass_mailing
module but two of them were still used by website_mass_mailing.
This commits adds these two images in website_mass_mailing module and
use a more standard convention to define associated snippets and
link them in the snippet panel. Also lint JS files.
mass_mailing snippets contained links to "/page/contactus", url which
only exists if website is installed. Also, t-if="website" which were
in snippets were unclean.
Now, the website_mass_mailing module which was already there to install
website snippet and which was already in auto-install with website and
mass_mailing is also in charge of extending mass_mailing features. It
extends the snippets to add the parts which were marked with t-if
website and add the links to "/page/contactus".
* event, website_event, website_forum,
* website_hr_recruitment, website_sale
Website access rights were buggy. The editor assets and website editor
assets have to be loaded together to work so the previous behavior
which only loaded one with the restricted access right was not right.
Also, people which had the "Manager" access right for model like event
or job only got access to creation and edition of those objects if they
had the full access to website access rights.
Now the website module creates the two same groups :
* group_website_publisher: load all editor assets, give access to
page creation for model the user has access (event, job, ...) and
edition of those pages
* group_website_designer: implies the first one and give access in
creation and edition of all pages + access of all website menus
The manager access rights for event, product, jobs, etc now implies
the group_website_publisher group for the user (so that the manager
have the editor assets and editor ui).
Note: some python codes use the group_website_publisher for no right
reason, this has to be adapted.
Several modules defines records with the external ID `base.foo_bar` while it is
created inside this module (typically menus and groups).
While there is no technical reasons to do so but this may introduce issues:
- these records will not be deleted during uninstall
- if a language is loaded before the installation of the module, it won't be
translated
The uninstallation will only remove the records with an external id linked to
this module (these would only be removed when removing base).
Installing a language before the module will drop the translations not linked
to an existing external id (as it can not be resolved).
This commit correct all the external ids tagged as from base or other incorrect
modules.
This group was defined in the mass_mailing module but is only working when
you install website_mass_mailing. What this group does is allowing to insert
a newsletter snippet in the page, thus it has nothing to do in the mass_mailing
module which doesn't depend on website. Also, the snippet itself was already
defined in website_mass_mailing.
Moved all the things to website_mass_mailing.
* make CSRF protection the default on all non-SAFE methods
note: there currently is no way to call a CSRF-protected endpoint
without a form-encoded entity-body as that's the only place we get the
CSRF token from.
* simple CSRF token generation: just use the HMAC'd session id, no
generating a new random token per session then HMAC it
* use constant-time equal function to avoid timing attacks
* assert that a database secret is configured before hashing/validating
the CSRF token
* opt-out database manager from CSRF: The super-admin password serves
the purpose of a CSRF token in the database manager screens.
There is no request database to obtain the
secret and generate a CSRF token.
qsm-odoo