View creation/edition represent a important part of an install and a lot
of possible view errors are not detected, like fields used in domain
filters. Some part of the code a difficult to maintain, and view checks
are splitted in multiple places.
This commit aims at refactoring view validation by regrouping most part
of the logic in ir_ui_view and trying to optimize the overall process.
Since most of the lines were touched, this task was also an opportunity
to modernize the API.
Main changes on method `check_xml`:
- extract node processign and validation to individual postprocessor
- add validation for filter node, buttons, ...
- fix accessibility checks (and improve their performance)
- move xpath check to specific Python node validator
- clarify error messages (wip to continue)
Main changes on method `read_combined`:
- optimize the search for inheriting views in a single query doing the
whole recursive search
Indeed, after removing xpath validations, `get_inheriting_views_arch`
was the most expensive method in `check_xml`, spending most of the time
in `search` because of recursive calls to retrieve children views.
The view Backend Assets is a good example of the latter point, since a
line is added in the view for almost every module. 70 views (community)
are added at first level, `get_inheriting_views_arch` is efficient and
returns all 70 views. Then at the second level, the method
`get_inheriting_views_arch` is called 70 times for nothing. 70 calls to
`search` (squared/2 since each view is checked independently) are almost
useless. The same case applies to the settings view.
As a result, the average module installation time is 25% faster, and the
average time spent in `read_combined` is almost divided by 2.
- Create 2 companies A & B
- Create a website A
- Create a user U with access to company B only
- Connect as U and go to the website
An internal server error is raised.
This is due to 7bfcb53db37f385a99 which verifies if the user isn't
granted access to companies he is not supposed to access.
This is exactly what was done before this commit: the website is in a
company not allowed to the user.
opw-2116539
closesodoo/odoo#40004
X-original-commit: debc516c47b522bd9b4b9fef365ad11462916174
Signed-off-by: Nicolas Martinelli (nim) <nim@odoo.com>
When computing time statistics, we need to look for
archived website visitors also to avoid a KeyError
if we use the default 'Archived' filter.
closesodoo/odoo#39970
X-original-commit: fe4d9bd25de45f1748ea010c51c8871bb3d14b9a
Signed-off-by: Nicolas Martinelli (nim) <nim@odoo.com>
Before this commit, if you had a page_id set on a menu, and that you
fork this page, the page_id from the menu was always pointing to the
previous one, so you see old page, but edit new page.
> Reproduce:
> Fork Contactus (Page_id on menu become wrong)
> Refresh contact us (done on save btw)
> You see old content
> Edit with Html Editor, you sill see that forked view exists!
Bug was hidden before that we set page_id on menu, but it is needed if
we want to support the groups visibility on the menu item.
closesodoo/odoo#39472
Signed-off-by: Jérémy Kersten (jke) <jke@openerp.com>
Now, you can define a Visibility mode between:
Public (All poeple)
Connected (Portal or Employee)
Restricted Group (Has this group or is Employee)
With Password (Know password or is Employee)
Internal Users (Is Employee)
It is a 'fair' feature, but without really warranty that the content is
really unreadable via others methods, ...
It is more for frontend display, that real secret. Dont use this like
a keychain ;)
We only catch the visibility on the main view and not the t-call inside.
Even if it should work on controller too, it is only display now on the
page property menu. (Or on the view directly in backend)
task-2091365
From now, you need to explicitely add sitemap=True if you want your controller
into the sitemap.
It's the default value, but if you forgot it, it will raise a Warning on runbot.
It will avoid wrong controller in sitemap and duplicate (empty) content.
From now, if your model contains a field website_id, the modelConverter for
sitemap will automatically add the domain:
"[('website_id', 'in', (False, current_website_id))]"
It avoid redundant declaration and ugly url in redirect/rewrite view.
Migration: need to remove it from url_from in website.rewrite
task-2065018
closesodoo/odoo#39427
Signed-off-by: Jérémy Kersten (jke) <jke@openerp.com>
You need to provide a small part of the code, because to avoid fraud, google
make several request to be sure that you don't allow all codes :)
So the 'WPS' solution was dropped, now we take the first request from google
that match the part provided, as the good one, and refuse all others requests.
task-2086915
closesodoo/odoo#39186
Signed-off-by: Jérémy Kersten (jke) <jke@openerp.com>
The XML file homepage view record is not supposed to be deleted as it is used
to bootstrap newly created website.
If that view is deleted, everything's fine. But if that view's page is not
found (m2o link broken somehow), then the code would crash.
This would only appear if the user is playing in the backend in technical but
it seems to happen more than it should.
This commit will prevent the code to crash in such a case.
Step to reproduce:
1. Go to settings > technical > views (debug)
2. Find the xml homepage view (with xml_id)
3. Go to its website.page and break the m2o view_id
4. Try to create a new website, it will crash
opw-2081894
closesodoo/odoo#39149
X-original-commit: 1d4dd200c664b99dbdb3e65e3950be1cb5e79a0a
Signed-off-by: Romain Derie (rde) <rde@odoo.com>
Since 62c9dedafd, when accessing a website
connected as portal or public user, the themes images are not showed. An
error is arose 'Sorry, you are not allowed to access documents of type
'Attachment' (ir.attachment)'.
Now, the portal and public user have access to the themes images.
opw-2082468
closesodoo/odoo#39025
X-original-commit: 9b8c390cd5526556346356f260a9cfe1b90cd510
Signed-off-by: Jorge Pinna Puissant (jpp) <jpp@odoo.com>
Co-authored-by: Lucas Perais <lpe@odoo.com>
A 404 will take 3 to 5 seconds to be resolved and execute +- 1900 query, to return
a rendered page which is quite expensive, especially when multiple missing images
are rendered in a view.
Catching static route and marking them as not frontend will help to avoid to handle miss
on static resources. In this case server returns a standard 404.
This commit also fix a iframe src in order to avoid a 404 on
/web/(test )/report/html/some_report (thx to aab-odoo)
X-original-commit: 818d0cb59fbae78d0edf06318082981f318e4db7
Before this commit launch a server with --db-filter that match at least 2 dbs name
Try to authenticate
You will have an error request is unbound when you try to access request.env
Now we retrieve the user from self instead of the request.
New test to ensure rpc authentication is tested.
Related to commit 245ef4b1
closesodoo/odoo#38969
X-original-commit: 4b3400c430bec7539aada0619fd203978daca2d8
Signed-off-by: Jérémy Kersten (jke) <jke@openerp.com>
When you try to create two users with the same login, the shown error message is
the Postgresql integrity error instead of a nice (translated) validation error.
This happens since bf88f3e which changed the way error messages are translated.
The reason is the manually created unique index `res_users_login_key_unique_website_index`.
The error handling and translation mechanisms don't know it exists.
The index was created for performance reasons in commit b5a12b4 where the
original python constraint was replaced with this custom SQL index.
In this commit, the python constraint is re-introduced to remove the index hack,
but the implementation now uses a single SQL query, which should be quite fast.
closesodoo/odoo#38737
X-original-commit: 817a811ec98b0c313b12e6464b5e98ca432cb3fc
Signed-off-by: Christophe Simonis <chs@odoo.com>
This is necessary when writing view fields from a page record because the
generic page will put the given values on its cache but in reality the values
were only meant to go on the specific page. Invalidate all fields and not only
those in vals because other fields could have been changed implicitly too.
Pr: #37363
X-original-commit: 83f9a3e2608db34a319b985271d73f7de5bc73a1
Install the website, install a second language.
Switch the language on the website: error 500.
The function opened a new cursor, to update website_visitor.
It did so at the end of the query dispatch.
However when switching the language of the website, the lang is written on the
website visitor. This is done at the flush, done at the end (exit) of the query.
This is done on the cursor that was used for all the transaction.
Therefore that write would systemically fail on a
ERROR: could not serialize access due to concurrent update
opw 2080986
closesodoo/odoo#38453
X-original-commit: cc88a36744dc3c2949c47e8b163e1de98f5dbd95
Signed-off-by: Nans Lefebvre (len) <len@odoo.com>
*base, website_blog, website_event, website_forum, website_slides
With this commit:
1. It is now possible to add the 'Edit in backend' entry in the frontend navbar
for any desired model, not only the ones which have the published mixin.
It will simply redirect to the main_object form view.
This commit add it to Forum and Blog.
2. When clicking on 'Edit in backend', it is now possible to land on another
module than Website.
That's especially useful for events and slides which are not directly
related to the website module as they have their own module.
3. Remove the custom Edit in backend from the forum homepage (fa-cog).
Opportunity was also taken to remove the 'edit welcome message'.
It will now be editable through the editor (welcome message will appear in
edit mode). Thus we got rid of the custom edit welcome message controller
and views.
Closes#36325
Without this commit, connection with mobile app crash
since there are no uid set on the env.
_is_public_user expecting singleton.
closesodoo/odoo#37756
Signed-off-by: Jérémy Kersten (jke) <jke@openerp.com>
* = portal, website, test_website, account, sms
Portal an Survey error pages were ugly default pages.
Now the error pages will be the same as the website ones.
Also fixing single module builds tests
task-2059969
closesodoo/odoo#35535
Signed-off-by: Jérémy Kersten (jke) <jke@openerp.com>
Redirect_type was renamed from 3xx to redirect_3xx, but name is used as http
status code. It is better a redirect(301) instead of redirect(redirect_301)
Re-add the bind_to_environ, it was removed because it seems not useful, but
once you are behind a proxy, werkzeug need the environ to find the correct
hostname and more ... Transformed relative url into absolute by werkzeug was
wrong.
closesodoo/odoo#37733
Signed-off-by: Jérémy Kersten (jke) <jke@openerp.com>
The update of visit_count now uses website_track instead of
website_visitor_lastconnection for less complex query and better
precision.
The name of a visitor is now changed only if it has no partner linked
and the # is removed
The cookie was not reset when a new partner connects or if a partner
disconnects. Now a check is performed to ensure the cookie belongs to
the partner/public user.
Now website visitors that log in will be added to the previous
website visitor of the partner. This way we have a full history and only
one visitor per partner.
Now a partner is able to delete a recently viewed product from his
recently viewed product list.
task-2072877
After this commit, you will be able (in technical mode) to update the url for
the python controllers.
Eg.
You can now rename /shop in /garden and /shop/product/ in /garden/vegetable/
Most of urls will be replaced at fly in the renderd qweb, with the function
url_for but all old urls will keep available. So if you access url /shop you
will be automatically redirected to /garden (308 Permanent Redirect).
As for cdn and other post-process of att, the automatically replacement in the
rendered qweb is only done when you will be not website editor. But the new
dispatch of URL will be applied in all cases.
For developper, since it is Permanent Redirect, don't forget to clear cache or
open chrome debug tool (with option 'Disable cache while DevTools is Open) to
see your lasts changes.
closesodoo/odoo#36555
Signed-off-by: Jérémy Kersten (jke) <jke@openerp.com>
Before this commit, if one would introduce a scheme or a port in his website
domain, it would make the website selector to crash JS side.
Indeed, it would replace the current url hostname by the website domain.
If the website domain was introduced with `http://` it would lead to
`http://http://mysite.com`.
If port was introduced, `http://mysite:8069:8069`.
Also, by fixing those 2, it also make `localhost` and `127.0.0.1` to work.
(which would not work without `http://`.
Related to #36390
See 'Webiste Visitor (date)' as display name
Remove default value as a way to easily detect if somebody has already
a name or not
Note using the id in the display name is a bad (may not be set yet)
but is used knowlingly as a short way to differentiate 2 visitors.
Linked to task id: 2073714
closesodoo/odoo#37230
Signed-off-by: Martin Trigaux (mat) <mat@odoo.com>
This commit review the design of the visitor kanban view.
There is now two style for kanban card.
Ungrouped : the card takes all the width of the screen. It's simulate a nice tree view.
Grouped : Same design as before. ('normal' kanban card)
Apply visitor kanban views redesign also in :
- website_livechat
- website_crm
- website_sms
Task ID: 2073714
PR #37081
Signed-off-by: Thibault Delavallee (tde) <tde@openerp.com>
This commit aims to rename the visitor that has no lead and no res.partner
to 'Website Visitor #id'.
So that the visitors can be identified when, for example,
an operator talk with multiple visitors.
Task ID: 2073714
PR #37081
In order to be able to send push notifications using recipients timezone,
the visitor timezone is now stored in DB.
The visitor timezone is only updated once, when found_visitor_timezone
cannot be found in localstorage. Once the timezone is updated,
found_visitor_timezone is added to localstorage.
Task ID : 1936643
PR #34973
This commit allows to send an email to a visitor
directly from the visitor form view if the visitor is linked a
res.partner that a valid email address
Task ID: 2056080
PR #36290
Applies various improvements:
- Remove welcome message if chat request usecase.
- If a visitor is online: line is green / if offline: line is red (in the list view)
- Visitors list view: add first / last connection fields and remove time_since_last_action
- Avoid useless leave notification if the livechat channel is empty
Fix
- ACLS on website_visitor_page model (for im_livechat_group_user)
- ACLS on website_visitor and website_visitor_page model (for sales_team.group_sale_salesman)
- Update visitor lang if visitor change the website lang.
- Create visitor twice when translated website (due to rerouting)
- Avatar for visitor banner in discuss. (image_64 instead of old image_small)
Task ID: 2056080
PR #36290
*= website, website_livechat, website_rating
///// Tracking Product /////
Now when a user browse products in eCommerce, we keep track of the
products he looked at. We use the website_visitor
to store the products viewed. A cookie is added with a TTl of 30 min it
will prevent the RPC for that time. We track the page only if the
product view is tracked.
The recently viewed products are displayed as a snippet but also
with the customize option in product pages of website_sale.
Products that are in cart will not be returned as recently viewed.
It is possible to add a recently viewed product to the cart directly
from the carousel, it will not redirect to the cart. If we are on the
cart page, the product is displayed in the cart.
The Visitor page in website now references products viewed
///// Tracking Page /////
Feature to track a view was remove in: https://github.com/odoo/enterprise/pull/4834
That feature is now reintroduced and will use website_track instead of
leads to be stored.
The track field is now on the view instead of the page.
url field is added to website.track, it will store the url for pages and
views
The Visitor page in website now references urls viewed
Add some tests
task-1984575
closesodoo/odoo#35810
Signed-off-by: Jérémy Kersten (jke) <jke@openerp.com>
In order to keep all the visitors from all the leads to merge,
the relation between leads and visitors becomes a many2many.
So that after the lead merge, a lead can have multiple visitors.
This commit re-add the page view stat button that were removed
during website_visitor introduction and page tracking refactoring.
This button counts all the pages views from all the visitors linked
tho the current lead. Clicking on it redirect to the complete
navigation history, from all visitors linked to the lead.
Task ID : 2057428
PR #36180
Those values are only used on the website navbar when the user is in both groups
so the vast majority of the time they are done for no reason.
This reduces the number of queries by 2 on every page when the user is not admin
and/or multi website is not enabled.
Part of task-2061122
closesodoo/odoo#36483
Signed-off-by: Jérémy Kersten (jke) <jke@openerp.com>
Commit 54d30d5194 introduced `lastmod` and `priority` on sitemap locs.
This was broken with 4ecbacaf59 which introduced `website.page` model as it
removed the `PageConverter`.
Before website.page:
1. PageConverter returned records with `__lastmod`
2. `enumerate_pages` loop on converters would remove the prefixed `__`
After website.page:
1. code to remove `__` was still there but the pages would be found and looped
on after that code, making it useless.
With this commit:
1. The code to remove the `__` is moved after searching the pages.
Following #36090
Related to #35464
Signed-off-by: Jérémy Kersten (jke) <jke@openerp.com>
SHA-1 is a cryptographic hash function that have weaknesses known since
2005, it has been deprecated by the NIST [1] about 10 years ago in 2011
and Google [2] have been able to perform a collision attack in 2017.
We use SHA-1 in order to generate unique URL for resources that can be
cached by the browser: assets bundle, translations, qweb templates and
qweb images.
Although practical attacks still requires quite a lot of computational
resources, it is time to upgrade SHA-1 to SHA-2.
We have selected the SHA-512/256 variant of the SHA-2 algorithm as
replacement for SHA-1 for the following reasons:
* On 64 bits platform, SHA-512 is the fastest SHA-2 variant, it is only
~1.5x slower than SHA-1. [3]
* Keeping only the 256 foremost bits protects against both collision
attacks and length extension attacks.
* The hexadecimal digest is only 24 chars longer than SHA-1 which is
nice to have somewhat short URLs.
We have not used SHA-3 because:
* At the moment of writing, it is too slow (~3x slower than SHA-1) [3]
* It is not guaranteed to be available with the Python 3.5 `hashlib`
module.
* One of the author of SHA-3 is Belgian.
[1] https://csrc.nist.gov/projects/hash-functions/nist-policy-on-hash-functions
[2] https://shattered.io/
[3] http://bench.cr.yp.to/results-hash.html
[4] http://www.commitstrip.com/en/2017/02/27/the-sha-1-alternative/
Xavier-Do