An ir.attachment record can be served as a request's reponse if:
- a request triggers a 404
- the ir.attachment record has its url field matching the url of
the failed and is of binary type
Following rev[1], portal users have the right to create these kind of
records, and it is a security concern.
This patch restrict the ability to create and write on the ir.attachment
records that may be served through the dispatch's exception mechanism to
settings users.
As the asset bundles files are served through the use of these special
ir.attachment, we make sure to retrieve only ir.attachment records
created by the superuser in the `get_attachment` method.
As website administrators often need to play with these special
ir.attachment, we also let to this group the permission to manage them.
[1] 61065b6d04
Some IPs (like google-proxy ones) are not bound to a specific country.
Legacy Database used to set country_code to 'EU' for these one. geoip2,
on contrary, does not set the country. Read information from `continent`
attribute in this case.
opw-1844888
Urls like `/page/website.XXX` are redirected to `/page/XXX`.
Before this commit, the redirection would not keep query strings:
`/page/website.XXX?rde=1` would redirect to `/page/XXX`.
Now, we keep the query strings:
`/page/website.XXX?rde=1` will redirect to `/page/XXX?rde=1`
Closes#24140
Courtesy of @MTantin
Before this commit, if you or a lib uses Glyphicons, the font was loaded from
/web/content/fonts/ (or /web/static/src/less/fonts/ in debug=assets)
It is because bootstrap is imported from /web/static/src/less/import_boostrap.less
not directly from /web/static/lib/bootstrap/less/bootstrap.less
Now, we use absolute path to load font, overriding the variable define in
variables.less from bootstrap.
This commit https://github.com/odoo/odoo/commit/965f49201812cc3cca319a3b5b93331272dd2288 removed empty meta-description and meta-keywords from
the DOM for SEO audit reasons (these tags when empty are considered as
duplicates at a SEO point of view).
By doing so it prevent the 'Optimize SEO' to work correctly since it can't
retrieve the DOM elements that are used to store the user modifications until
he saves.
Now, even when these meta-tags are empty, we display them to people having the
rights to 'Optimize SEO'.
This closes#23659
Odoo Translation Bot