Now having
* sanitize: run the sanitizer to clean the html (removing javascripts,
unwanted tags, ...)
* sanitize_tags: only a subset of tags is allowed in html content.
Unwelcomed tags are remove dand their content stripped.
* sanitize_attributes: only a subset of attributes is allowed.
* sanitize_style: only a subset of style attributes is allowed. Style
attributes are parsed to keep only a white list.
* strip_style: all style is removed. It bypasses sanitize_style as there
is no need to sanitize something that is removed.
* strip_classes: remove class attributes
Fields parameters have also been updated to match the sanitize options. Html
fields by default are sanitized with sanitize_tags activated but without any
further options. All addons have been updated to match the new options
according to their previous behavior.
As we will soon improve the sanitizer we will be able to sanitize email
templates body. However this implies some cleaning in the templates to
be sure mako is not considered as invalid html / xml and therefore removed
from the template body.
If you create a task directly, the key `default_project_id` is not set
in the context. This key is used to compute the default stage of the
created task. It is done by creating a domain. Unfortunately, the
domain is always filled with `[('fold', '=', False)]` and thus it
always returns a result that makes no sense when `default_project_id`
is not set. Worse, if you actually create the task, the found stage
that was not in your project is now a part of it.
The fix is to return no result if the `default_project_id` is not set
in the context.
When the routing of the phantom bom is the same as the parent BoM,
the phantom BoM should not recreate the work orders, but use the same
work orders as the parent BoM. That way, you can create one master
routing and the "consumed in operation" of the phantom bom can be used
linking to the master routing.
If the phantom bom has no routing or the same, it can also use
the "consumed in operation" of his parent bom line if none is defined.
The web modules defines a "layout" template which is only used by the
login default page. Now the backend template "web.webclient_bootstrap"
and the frontend template "website.layout" both use the "web.layout"
template as base.
Some parameters can be passed to customize the default "web.layout"
template:
- "head": content will be placed at the end of the <head> tag of the
page
- "title": to set the title of the page (the <title> tag should not be
placed "by hand")
- "x_icon": the url for the page icon
- "html_data": dictionnary whose key-value pairs will be placed as
attribute-value for the <html> tag
- "body_classname": the classname to set on the <body> tag
Note: xpath expression on the website.layout template can now only find
the #wrapwrap element and its children. An expression "//body" will not
have any result. If something has to be added in the body element but
not in the #wrapwrap element, simply change the xpath
<xpath expr="//body" position="inside"> with
<xpath expr="//div[@id='wrapwrap']" position="after">
SPECIFICATION:
==============
- hide income account in invoicing wizard (if user is not a accounting accountant at least)
- hide Inventory tab in products form if no access to Inventory app
- in internal category form, hide accounts if user is not an accounting accountant
- hide Vendors if no access to purchase (as well as Description for Vendors in Notes)
- remove Warranty or hide it with related access rights
- tax cloud config is not userfriendly (product form, what is TIC category? what does it imply?)
- rename Accounting tab (in products) into "Invoicing" and move Invoicing Policy and Taxcloud Config there. Make tax field visible for sales
- reset Internal notes field on product (under Notes). Used by many companies and useful for search on website.
- invoice: validate button should be for billing users only
- a sales user can't see Configuration menu (with salesteams)
- a sales user should not see Invoicing report link &nd settings link in salesteam dashboard
- a sales user should not see the field for invoicing target in dashboard (in invoicing if activated for salesteam)
- In sales team, quotations and invoices should be only one option -> that way invoicing fields & targets show up to the admin
- SO status: sale order -> Sales Order
- Everywhere: Payment Term -> Payment Terms
By the way, move the group 'Vendors' on the inventory tab, it doesn't. It
doesn't make sense to display this information if you don't actually buy
the product
[FIX] website_project: override get_access_action to redirect to my/tasks,projects
[FIX] project_issue: Don't send notif template to portal customers if no website
[FIX] website_project: Portal users can receive notif template
[FIX] sale: Don't display 'View quotation' button on email if no website
If the website module is not installed, the button 'View Quotation' will lead to the backend chatter page, which is not very useful in our case.
As the quotation is already attached in the mail as a pdf, just don't display the button if the website module is not installed
[FIX] account,sale: Don't send notif template to portal customers if no website
[FIX] account: Don't display 'View Invoice' button on email if no website
If the website module is not installed, the button 'View Invoice' will lead to the backend chatter page, which is not very useful in our case.
As the invoice is already attached in the mail as a pdf, just don't display the button if the website module is not installed
[FIX] website_sale: override get_access_action to redirect to my/invoices
Previous implementation was checking if the element we want to click
on is a link and if this is the case, only forced a redirection. This
had been done because the redirection was not working by simulating a
click, but in fact it works, the click simulation only had to be
improved.
Also, only forcing a redirection is wrong as some links have both a
real redirection link and a event handler binded to them.
Currently as no portal backend view exists anymore, the method 'get_access_action' will return a url to the backend.
For example, if you have only sale installed (with portal_sale in auto install mode), you'll get access rights to sales orders in read mode in backend. The correct way to handle this is to return an access error and give the access rights to these documents only in website_portal_sale is installed, i.e. when the portal view is accessible in frontend under my/orders/ controller.
Before this commit, the focus point the user can move on the image in
the background position configuration dialog was only following the
mouse as we want if the image original width was larger than the dialog
one. This is because the javascript relies on the fact the image takes
100% width of its container. To fix this, the container now does not
take 100% of modal width but the size of its internal image (with a
max-width of 100%).
In details:
* account.operation.template object renamed into account.reconcile.model
* account.reconcile.model.template object created
* added some records for l10n_be
Was PR 11230
It might happen that a price is strike through in the shopping cart
although it has the same value than the discounted price. This can be
due to differences in decimals smaller than 0.01.
The fix is to apply the same logic than in other places: strike through
if the difference is larger than 0.1.
opw-685109
This is needed to avoid the scheduler to stop suddenly as the scheduler
takes a bunch of moves to reserve without looking if all moves of
a picking are taken. That way, it is possible that a certain key
is not there in this dictionary and the solution is to simply
filter them out.
Closes#13286
In some snippets, the parent hierarchy has many elements. So, when
selecting a deep child of one of those, the customize dropdown had
many dropdown headers showing the parent hierarchy but without any
option for many of them.
Commit de0d9fd666 already fixed the case
where the dropdown only contains dropdown headers. This commit is an
adaptation to hide these headers one by one.
In psql, use LIMIT and OFFSET together without a fully specified and uniq sort order
will generate unexpected behaviour.
Eg:
> id id_dept name
> -------------------
> 1 1 Tom
> 2 1 Mike
> 3 2 Meggie
> 4 2 Marge
> 5 3 Bart
> 6 3 Lisa
> using LIMITed selects like:
> SELECT * FROM employee ORDER BY id_dept LIMIT 3
> SELECT * FROM employee ORDER BY id_dept LIMIT 3 OFFSET 3
> SELECT * FROM employee ORDER BY id_dept LIMIT 3 OFFSET 6
> You can have some result missings from the 3 requests, and others duplicated.
> Because id_dept is not a uniq order.
opw-686639
note: backport of saas-12 4dce8616
Jignesh Rathod