Commit Graph
72 Commits
Author SHA1 Message Date
Thibault Delavallée 14bbac3f35 [FIX] base: temporary files were not correctly attached 2021-12-23 12:50:14 +01:00
Yannick TivisseandVictor Feyens 18952cdc76 [IMP] *: Convert single create method into multi
Taskid: 2703085
Part-of: odoo/odoo#80824
Co-authored-by: Victor Feyens <vfe@odoo.com>
2021-12-14 19:13:18 +00:00
Nicolas Martinelli 7bbe15bc15 [FIX] base: GC files progressively
- Get a database with millions of files in the checklist (do not ask how
  this happened)
- Set a cron timeout low enough so that `autovacuum_job` times out

The file GC will endlessly timeout without being able to delete any
file.

This is due to how the `_file_gc` method is built: we first build the
whole whitelist, then we perform the deletion. With millions of
checklist files, the loop which builds the `whitelist` takes ages. It
ultimately leads to a timeout of the scheduled action, and therefore no
file is deleted.

To avoid this, we delete the files progressively. The checklist is split
in chunks, and we check which files must be GC'd in a given checklist
chunk. This way the files are removed even in case of timeout, meaning
that there will be less files to check during the next run. Eventually
the GC won't timeout anymore.

closes odoo/odoo#79834

X-original-commit: dbae52479062ace9e2b2d376ec2d601d86482f86
Signed-off-by: Nicolas Martinelli (nim) <nim@odoo.com>
2021-11-16 12:20:02 +00:00
Jeremy Kersten 300954d8c4 [IMP] base: auto resize attachment to 1080p
After some analyze on a lot of customer databases, seems like most of the time
their are performance probleme, and big store, it is due to  a lot of big file
uploaded without reason. E.g. barcode, photo, ... a small one will be enough.

Now, we decided (in stable) to auto resize these pictures to 1920x1920px
by default and compress it with a quality of 80 when the source is bigger.

You can bypass this behaviour in your specific use case,
using a context key: 'image_no_postprocess' set to True.

You can disable the resize (and quality implicitely)
using an icp: 'base.image_autoresize_max_px' set to '0'.

You can change the default resize (1920x1920) format using an icp:
'base.image_autoresize_max_px' set to '<width>x<height>' (e.g. '1024x768')

You can change the default quality (80) using an icp:
'base.image_autoresize_quality' with a value between 0 and 100 where 0 skip it.

You can change the type of file that will be post process using icp:
'base.image_autoresize_extensions' (subtype of the mimetype comma separated).

Api of image has not be changed in this commit, only refactored to allow to
work with image directly without the need to encode/Decode in base64 the raw.

We decide to keep 1920x1920 by default instead of 1080p to avoid to resize
portrait picture in 1080px and stay consistent with field image_1920 that
return a 1920px image for width or height whatever the orientation.

+ fix some lint diff for ci style in master

closes odoo/odoo#78556

X-original-commit: d9ce0507960f247e1187baf7bd8399f90be237aa
Signed-off-by: Jérémy Kersten (jke) <jke@openerp.com>
2021-10-22 17:34:29 +00:00
Philémon van Helden 85cb19b294 [IMP] web_editor, base: allow parameters in image URLs
When adding an image to the library from an URL, if the URL contains
parameters (e.g. ?width=200&height=200), the link will not be accepted.

In this commit, we remove these parameters from the URL before checking
the image, so that the URL is considered valid.
We also remove these parameters before computing the mimetype of the
image, since it is computed based on the end part of the URL.

task-2618494

Part-of: odoo/odoo#75205
2021-09-16 18:14:54 +00:00
Alvaro Fuentes d766744b1c [FIX] base: fix ir_attachment read_group
When called with a `srt` as readgroup parameter we get a traceback.
Example:
`read_group([('partner_id', 'in', self.ids)], 'partner_id', 'partner_id')`
TB:
```
 Traceback (most recent call last):
   File "/home/odoo/src/odoo/14.0/odoo/tools/safe_eval.py", line 330, in safe_eval
    return unsafe_eval(c, globals_dict, locals_dict)
   File "", line 2, in <module>
   File "/home/odoo/src/odoo/14.0/odoo/addons/base/models/ir_attachment.py", line 420, in read_group
    if any('(' in field for field in fields + groupby):
 TypeError: can only concatenate list (not "str") to list
 ```

 Observed on the upgrade request 22627.

closes odoo/odoo#75416

X-original-commit: 8e7990dd5c069f7b0dba9f3d27f620f0fcad5441
Signed-off-by: Christophe Simonis <chs@odoo.com>
2021-08-20 18:52:19 +00:00
Xavier Morel b4bfb2a0d2 [ADD] base: missing raw preprocessing
makes raw a bit more expensive than necessary on creation

closes odoo/odoo#74132

X-original-commit: f9b12a59ea618fa598f0ffb6869f027c6a39bc2d
Signed-off-by: Xavier Morel (xmo) <xmo@odoo.com>
2021-07-22 15:56:08 +00:00
Andrea Grazioso (agr-odoo) 42478e3e88 [FIX] base: avoid infinite recursion on attachments search
Have a large number of attachments with res_field set
Then go to Settings -> Technical -> Attachments -> add a filter "Res
Field" is set.

You will have traceback. This occur because the `_search` function will
omit from results records with res_field set, forcing recursive calls
until either we scan the whole table (80 records at a time) or we hit
max recursion limit

opw-2463634

closes odoo/odoo#69459

X-original-commit: 08fb44a1f8af9684c28c0dd5e82121193d9bef9a
Signed-off-by: Raphael Collet (rco) <rco@openerp.com>
2021-04-19 10:12:10 +00:00
Mathias Markl 543f0a26d3 [FIX] base: force_storage on every attachment
When searching on attachment a (res_field, =, False) domain is
automatically added in the domain in the _search override.
The force_storage method was skipping the attachments linked to a
field and was also applying on fields of type url

closes odoo/odoo#58086

Signed-off-by: Martin Trigaux (mat) <mat@odoo.com>
2021-04-09 13:27:10 +00:00
Andrea Grazioso (agr-odoo) 92816d9ea1 [FIX] base: avoid infinite recursion on attachments search
Steps to reproduce:

Create a new local Odoo DB
Create another company on the DB
install the CRM module
Create an opportunity on the CRM app for each company.
Execute This server action (CHANGE THE res_id TO THE IDs OF THE OPPORTUNITY CREATED):
```
for _ in range(0, 300):
  for _ in range (0, 75):
    env['ir.attachment'].sudo().create({'name': 'test','res_model': 'crm.lead', 'res_id': 31, 'type': 'binary'})
  for _ in range (0, 75):
    env['ir.attachment'].sudo().create({'name': 'test','res_model': 'crm.lead', 'res_id': 45, 'type': 'binary'})
```
go to the Settings / Technical / Database Structure / Attachments.

Server will look in endless call because the search try to retrieve
`limit` records, but after applying company record rule we have
`limit - e`, so it begin a second search for e records.
Even the second search will look for limit and possibly will find less,
starting a third...

If the sub call is aware of how much records we actually need after
checking permission, we can return the recordset if we have collected
enough

opw-2369722

closes odoo/odoo#62456

X-original-commit: 6a8f28c4d0f9df7cd8451f4caf4f3bf7d64330da
Signed-off-by: agr-odoo <agr-odoo@users.noreply.github.com>
2020-11-26 17:15:28 +00:00
Raphael Collet 8de95a3fb4 [FIX] core: validation of field parameters
The feature was actually not working as expected.  It has been fixed,
and a test now ensures it does work as expected.  This commit also fixes
some invalid parameters, hopefully nothing critical.

closes odoo/odoo#60429

X-original-commit: 231bdca3f26d96f578503694e5aec062de2317ed
Related: odoo/enterprise#14285
Signed-off-by: Raphael Collet (rco) <rco@openerp.com>
2020-10-21 10:18:36 +00:00
Herbert Riess b5b50848a1 [FIX] base: reference attach, not self in _compute_raw()
Current behavior:
call to _file_read() within "for attach in self:" loop references self
rather than attach

Expected behavior:
execute _file_read() individually for every record in self (via "for
attach in self:" loop)

This is not an issue in standard where _file_read is an api.model
method but in case of overwrite (e.g. issue reported at
odoo/odoo#60016 has implemented an AWS integration) it makes sense

closes odoo/odoo#60342

X-original-commit: 160043a4f6aa76010aa77ead7cace9a688c17ae8
Signed-off-by: Martin Trigaux (mat) <mat@odoo.com>
2020-10-20 09:13:40 +00:00
Nicolas Galler 757a4c7b55 [FIX] base: preserve mime type for uploaded Word documents
Behavior before the fix:

- When uploading an office 2007 attachment (.xlsx / .docx) as a regular
(non admin) user, the preview shows it as text, and the download option
by default saves it as a text document (in certain browsers, at least).
This stems from an over-aggressive check on mime type (anything that
contains 'xml' **anywhere** in the mime type is taken to be XML, but the
mime type for an Office document is
`application/vnd.openxmlformats-officedocument.wordprocessingml.document`
so it falls in the XML case.

Behavior after the fix:

- The mime type is preserved
- Mime type for XML-like documents (including HTML and SVG) continues to
be validated

opw-2352712

closes odoo/odoo#60164

X-original-commit: 2820ec7d5763a5856274709a4d2024267313106b
Related: odoo/enterprise#14168
Signed-off-by: Nicolas Lempereur (nle) <nle@odoo.com>
Signed-off-by: Nicolas Galler <nicocrm@users.noreply.github.com>
2020-10-16 11:24:15 +00:00
Martin Trigaux d5c1649239 [IMP] base,web: _for_xml_id as a safe access point
/web/action/load is the public controller that Should be used by the
webclient to fetch actions
_for_xml_id is the default access method on actions that implements
fields filtering to avoid leaking server action code or other
information not needed by the webclient

Implementing whitelist of fields that can be access per model
2020-08-17 09:08:23 +00:00
Victor Feyens fdb23e282b [IMP] *: wrong any() usage
Replace wrong usages of any(list|recordset), by any(generator)
to speed up computations, avoiding list creations and/or looping twice on a recordset
for nothing.

any([generator]) => any(generator)
any(filtered) => any(generator)

closes odoo/odoo#55768

Related: odoo/enterprise#12360
Signed-off-by: Victor Feyens (vfe) <vfe@odoo.com>
2020-08-14 09:56:10 +00:00
Samuel Degueldre c2de755bc6 [IMP] web_editor, *: change image cropping from modal to inline widget
*: base

Previously, cropping an image was done inside of a modal window, turning
it into an inline widget makes the editor feel more integrated and
allows you to better see the result of cropping directly in the page,
it's also less intrusive to the user's edition workflow.

At the same time, the way cropped images are saved was refactored to use
the new original_id field on ir_attachment, as the old system was
creating problems.

Part of https://github.com/odoo/odoo/pull/51517
task-2192755
2020-06-05 18:11:42 +00:00
c5d3a109f5 [REF] ir.autovacuum: declarative garbage collector registration
The ir.autovacuum model purpose is to run several garbage collecting
operations like removing files from the filestore when no attachment
references them anymore.

The precedent strategy to register new garbage collection tasks was to
override the `power_on` method and to imperatively execute a vacuum
cleaning method on a given model. All calls were executed in a single
SQL transaction without any error handling, meaning a single fail during
any call resulted in a complete failure of the entire vacuum cleaning
chain.

We introduce a new `@autovacuum` api decorator, its purpose it to
register garbage collecting methods that will be safely executed in
their own transaction by the vacuum cleaner. In order to ensure this
new strategy is used, we deprecate `power_on` extensions.

By the way, garbage-collecting methods can be quite heavy and we don't
want users to directly call them. We now ensure they are private.

closes odoo/odoo#47842

Task: 2154079
Signed-off-by: Raphael Collet (rco) <rco@openerp.com>
Co-authored-by: Raphael Collet <rco@odoo.com>
Co-authored-by: Olivier Dony <odo@odoo.com>
2020-05-19 13:38:19 +00:00
Nicolas Martinelli baf1c1406b [FIX] base: do not skip ACL and record rules
- Create 2 companies C1 and C2
- Install any module with access rules, e.g. `account`
- Create an invoice in C1, attach a document
- Switch to C2
- Go to Settings > Technical > Attachments

An `AccessError` is raised.

This happens because the `_search` skips the ACL and record rules for a
system user, while they should only be skipped for the superuser.

opw-2236561

closes odoo/odoo#50067

X-original-commit: 9a71d60c25804bc4bae8c2c680c537f8a7a0900f
Signed-off-by: Nicolas Martinelli (nim) <nim@odoo.com>
2020-04-23 11:50:59 +00:00
Xavier Morel 172722c4d2 [IMP] base: remove redundant base64 back and forth in attachments
* add a `raw` computed field, though only update some of base to use
  it (addons for which that makes sense can be migrated progressively)
* avoid working with base64 data when it's possible to work with the
  actual data
* improve datas (base64 encoded content): should depend on bin_size

closes odoo/odoo#47212

Signed-off-by: Raphael Collet (rco) <rco@openerp.com>
2020-04-08 06:03:28 +00:00
Nicolas Lempereur 26fac9a834 [FIX] base: attachment check linked record 'write'
When an attachment is linked to a record (res_id and res_model are set)
we check the access rights and access rules of that record.

The access we check on linked record has changed as follow:

- 15905e78 (2013) => we check `write` access right/rule for `create`
- f5ebc509 (2014) => we check `write` access right for all mode
- 66644e85 (2015) => we check write access right for all but create mode

So currently we check on the linked record for each mode:

- create: write access right / write access rule
- read:   read access right  / read access rule
- write:  write access right / write access rule
- unlink: write access right / unlink access rule

The behavior is not expected for `unlink`, we should check if we have
write access through access rules instead of checking unlink access.

Without the change, the added test failed with a `unlink` access rule
AccessError on the linked record.

opw-2154448
closes #41814

closes odoo/odoo#42264

X-original-commit: 2b3fc2e3b80f191b4cd126abccf6f94b1302ac11
Signed-off-by: Nicolas Lempereur (nle) <nle@odoo.com>
2019-12-20 14:14:12 +00:00
Olivier Dony e63fd04b51 [FIX] ir.attachment: make filestore GC yield to other transactions
If a long-running transaction holds a write-lock on any row in
ir.attachment, the GC job can wait an indefinite amount of time to
acquire its table-wise SHARE LOCK.

While sitting in the queue for this lock, it will conflict with any
future transaction that tries to acquire a write-lock on any row [1].
So the GC transaction, which would normally execute very fast and
immediately release its lock, will start to block other transactions and
cause severe delays in response time. It basically depends on how long
the tx holding the lock takes to complete... which is unknown.

As a workaround, we force an arbitrary (but short) lock_timeout in the
GC tx before attempting the lock. If it fails to acquire it, it will
fail and raise, causing the whole operation to abort. The cron job will
be rescheduled quickly because it failed to complete, giving the GC
another chance to complete.

10 seconds seems a reasonable compromise, as it gives the blocking
transaction(s) some time to complete before bailing out, yet should
not be long enough to bring the system to a halt due to other
transactions blocked by the GC one. I have no hard data to back this
claim, though.

[1] See the LOCK conflict table in the documentation:
      https://www.postgresql.org/docs/10/explicit-locking.html

closes odoo/odoo#42128

X-original-commit: 8a093c74c209d492f066c927cc4ac61325aee3ae
Signed-off-by: Olivier Dony (odo) <odo@openerp.com>
2019-12-12 18:44:32 +00:00
ryv-odoo 90fa3e3c60 [REF] base: simplify check method attachments now always requiring employee rights
Since commit 62c9dedafd attachments almost always require employee
user access, unless some specific flow grants super user rights. Moreover
other flows like portal checks user rights before going into attachments
management with superuser rights.

In this commit we simplify code by directly checking current user belongs
to internal employee group (or is a superuser / admin).

We consider tt is the role of controller/model using attachments to check
and grants access to attachments.

Some history of attachments management improvement (not complete, just
an overview of discussed points)

  * 3620cb68a0: improve attachment management in portal;
  * de7c119e66: improve message_post and its attachments management;
  * 62c9dedafd: clean ACLs;

Task ID 2004031
PR #38358

closes odoo/odoo#39869

Signed-off-by: Xavier Morel (xmo) <xmo@odoo.com>
2019-11-06 10:00:04 +00:00
Christophe Simonis d74b451805 [MERGE] forward port branch 13.0 up to f4105eb9c7 2019-10-09 02:08:17 +02:00
Ivan Yelizariev 5f9c8ced24 [FIX] base: keep mimetypes after force_storage
The write override recomputed the mimetype when changing the datas
It may give a different result

closes odoo/odoo#24397

Signed-off-by: Martin Trigaux (mat) <mat@odoo.com>
2019-10-03 11:04:57 +00:00
Raphael Collet 5d97c47e54 [IMP] base: use many2one_reference for res_id on ir.attachment
This helps for updating inverse fields without making queries.

Due to this change, a `flush` has to be added in the portal attachment test to
actually compute the inverse after the change of `res_id`.
2019-09-23 20:55:39 +00:00
Raphael Collet afdfdbfa5b [IMP] base: inverse datas of ir.attachment during create
Before this commit, the inverse of `datas` would be computed after the `create`,
which would lead to unnecessary queries, not only for writing the new values,
but also because of the re-computation of fields that depend on these values.
2019-09-23 20:55:39 +00:00
Julien Castiaux 7c47eb1854 [IMP] module.py: deprecate openerp
[PEP-594] is deprecating the `imp` module, that module is used in
`module.py` in order to dynamically import addons using any of the
`odoo.addons` or `openerp.addons` import anchor.

We are deprecating `openerp` module/addons imports in v13 in order to
remove the support in v14 and greatly simplify how modules/addons are
loaded. If you are still using the old `import openerp` or `import
openerp.addons`, `import odoo` and `import odoo.addons` are drop-in
replacements.

The `odoo.modules.module.ad_paths` addon paths list has been deprecated
too. The list is now accessible on `odoo.addons.__path__` where they
are now directly loaded [2].

See also:

[PEP-594]: https://python.org/dev/peps/pep-0594/
[2]: https://packaging.python.org/guides/packaging-namespace-packages/

closes odoo/odoo#36597

Task: 2003936
Signed-off-by: Raphael Collet (rco) <rco@openerp.com>
2019-09-16 09:31:38 +00:00
Jeremy Kersten 34db511c8d [FIX] base: compute name for all ir_attachments
Before this commit, and since the new orm, we cannot open a record that have
no res_model and res_id.

With new orm, we should return a value for all records.
Now, we can open attachement form view without the error:

    ir.attachement(<id>).res_name traceback

closes odoo/odoo#36446

Signed-off-by: Jérémy Kersten (jke) <jke@openerp.com>
2019-09-05 07:52:15 +00:00
Julien Castiaux 944891ced0 [IMP] base: prevent SHA-1 collision
SHA-1 is a cryptographic hash function that have weaknesses known since
2005, it has been deprecated by the NIST [1] about 10 years ago in 2011
and Google [2] have been able to perform a collision attack in 2017.

We use SHA-1 as filename for the attachments stored in our filestore.

Although practical attacks still requires quite a lot of computational
resources, it is time to prevent SHA-1 collisions on our filestore.

To prevent such attacks, when uploading a file that has the same SHA-1
as a stored file, we perform a SHA-2 computation on both files to verify
their signature. If their SHA-2 signature is different, an error is
raised.

We have selected the SHA-512 variant of the SHA-2 algorithm because on
64 bits platform, SHA-512 is the fastest SHA-2 variant, it is only ~1.5x
slower than SHA-1. [3]

We have not used SHA-3 because at the moment of writing, it is too slow
(~3x slower than SHA-1) [3] and it is not guaranteed to be available
with the Python 3.5 `hashlib` module.

[1]: https://csrc.nist.gov/projects/hash-functions/nist-policy-on-hash-functions
[2]: https://shattered.io/
[3]: http://bench.cr.yp.to/results-hash.html
[4]: http://www.commitstrip.com/en/2017/02/27/the-sha-1-alternative/

closes odoo/odoo#36430

Signed-off-by: Raphael Collet (rco) <rco@openerp.com>
2019-09-19 14:13:31 +00:00
Julien Castiaux d47083e6d2 [IMP] module.py: deprecate openerp
[PEP-594] is deprecating the `imp` module, that module is used in
`module.py` in order to dynamically import addons using any of the
`odoo.addons` or `openerp.addons` import anchor.

We are deprecating `openerp` module/addons imports in v13 in order to
remove the support in v14 and greatly simplify how modules/addons are
loaded. If you are still using the old `import openerp` or `import
openerp.addons`, `import odoo` and `import odoo.addons` are drop-in
replacements.

The `odoo.modules.module.ad_paths` addon paths list has been deprecated
too. The list is now accessible on `odoo.addons.__path__` where they
are now directly loaded [2].

See also:

[PEP-594]: https://python.org/dev/peps/pep-0594/
[2]: https://packaging.python.org/guides/packaging-namespace-packages/

closes odoo/odoo#36597

Task: 2003936
Signed-off-by: Raphael Collet (rco) <rco@openerp.com>
2019-09-20 05:58:16 +00:00
Raphael Collet 9920f20e4c [IMP] models: ORM speedup
This branch is the combination of several optimizations in the ORM:

* store field values once in the cache: the cache reflects more
faithfully the database, only fields that explicitly depend on the
context have an extra indirection in the cache;

* delay recomputations by default: use method `recompute` to explicitly
flush out pending recomputations;

* delay updates in method `write`: updates are stored in a data
structure that can be flushed efficiently to the database with method
`flush` (which also flush out recomputations);

* make method `modified` take advantage of inverse fields to inverse
dependencies;

* filter records by evaluating a domain on records in Python;

* a computed field with `readonly=False` behaves like a normal field
with an onchange method;

* computed fields are computed in superuser mode by default.

Work done by Toufik Ben Jaa, Raphael Collet, Denis Ledoux and Fabien
Pinckaers.

closes odoo/odoo#35659

Signed-off-by: Denis Ledoux <beledouxdenis@users.noreply.github.com>
2019-08-20 12:43:59 +00:00
mreficent 355a5dfc36 [IMP] *: fix typos in comments
closes odoo/odoo#35404

Signed-off-by: Martin Trigaux (mat) <mat@odoo.com>
2019-08-07 10:28:33 +00:00
Thanh Dodeur 8a8126126e [IMP] base: removes storing of res_name from ir.attachment
This commit removes the store property of `res_name` from `ir.attachment`
as it doesn't need to be stored and could contain outdated information
if the record name was changed after the computation.

Task: #1943295

closes odoo/odoo#34930

Signed-off-by: Martin Geubelle (mge) <mge@openerp.com>
2019-08-05 13:11:33 +00:00
Adrian Torres 4b38cc6590 [REM] *: calls to @api.multi
Multi is the default api for methods, it is not necessary to explicitly
decorate methods with it, adds clutter and most people use it because
they see that the rest of the code uses it.

Done with `find . -type f -name '*.py' | xargs sed -i '/@api.multi/d'`
2019-07-17 14:13:12 +02:00
Martin Trigaux fd15ca1918 [MERGE] Forward port of saas-12.4 to master up to 1f5a4649a6
closes odoo/odoo#34850

Signed-off-by: Martin Trigaux (mat) <mat@odoo.com>
2019-07-15 08:12:26 +00:00
Martin Trigaux 1f5a4649a6 [MERGE] Forward port of saas-12.3 to saas-12.4 up to 87fc1554d6
closes odoo/odoo#34820

Signed-off-by: Martin Trigaux (mat) <mat@odoo.com>
2019-07-12 13:59:35 +00:00
Christophe Simonis 66bb578ac9 [MERGE] forward port branch saas-12.2 up to be5e8fdab8 2019-07-05 16:14:48 +02:00
Raphael Collet c552fb7a61 [IMP] api: remove deprecated decorators 2019-07-08 13:51:35 +00:00
Adrian Torres 9e71d57d11 [REM] *: remove calls to api.one and adapt code
Adapt all code that was using `api.one` to recordset-style method and
remove any and all calls to `api.one` in preparation for its removal.
2019-07-05 09:04:45 +00:00
Raphael Collet 368e9530f4 [REF] *: record.env.user._is_XXX() -> record.env.is_XXX()
Superuser mode implies `record.env.is_XXX()`.
2019-07-04 11:32:22 +00:00
Christophe Simonis 039e6bae99 [MERGE] forward port branch 12.0 up to 9c742d0c65 2019-07-05 11:13:53 +02:00
Julien Castiaux 1882c24195 [FIX] base: respect attachment search limit
Configure two companies, add a bunch of attachments to each company so
at least one has more attachments than the default 80 search limit. List
the attachments of that company, only the 7à-ish firsts are displayed
and the pager is disabled.

The `_search` method is override in `ir.attachment` to filter the
original record set. If the original record set had reached the limit,
the filter may only return a subset whose length is lower than the
limit, this trick the different JS views making them think there are no
more records to return and disable the pager.

The fix has been to recursively re-search until the subset length is
equal to the limit.

opw-2025940

closes #34287

closes odoo/odoo#34450

Signed-off-by: Julien Castiaux <Julien00859@users.noreply.github.com>
2019-06-28 14:36:18 +00:00
Thanh Dodeur c212cfe899 [REF] *: removes datas_fname from ir.attachment
This commit removes the field `datas_fname` from `ir.attachment` as
it was unnecessary and most of the time the duplicate of `name` or
`url`.

Task #1909865

closes odoo/odoo#32976

Signed-off-by: Martin Geubelle (mge) <mge@openerp.com>
2019-06-05 09:12:13 +00:00
Xavier-Do de7c119e66 [IMP] mail: reduce message_post query count and clean code
Purpose of this commit is to improve performance of post and notify through
various code improvements.

Containing
  * making of _notify_customize_recipients a mail.thread method;
  * _message_auto_subscribe_followers optimized;
  * renaming and optimisation of _notify_partners;
  * message_post_attachements optization;
  * remove unused mail_post_autofollow_partner_ids context key;
  * minimize message create queries;
  * only check record related access right for thread messages not in pending
    moderation;
  * get attachements from values instead of db;
  * storing lang in ctx from the beginning;
  * don't track on write on attachments;

Related to task 1943901
Linked to PR #32404
2019-05-29 13:34:32 +00:00
Yannick Tivisse f5dfe4727c [IMP] api.py: Rename company_id/company_ids into company/companies
The goal is to be coherent with the user property.

Actually, company_id and company_ids on the environment are no fields.

Calling env.company_id returns a browse record, not an id.
2019-05-29 08:09:15 +00:00
Yannick Tivisse a5b6f31cf2 [IMP] base: Contextualize the multi company
Purpose
=======

Allow the user to select the allowed companies for which he wants to see records
on top of selecting his current company.

It is confusing for users to see the records from the company he is connected to
and the records of the children companies.

Instead of using the hierarchy of companies to access records across companies,
the user can now select (from his set of allowed companies) the companies for
which he wants to access records.

/!\ This means that the user will interact with records from company A when in
company B.
Example: a SO has been created and confirmed in A. When in B, I create the
invoice from it.

Specifications
==============

1/ Deprecate the parent/children hierarchy on the res.company model. The fields are
kept on the res.company model to ensure the retro-compatibility, but won't be used
accross the standard code anymore. The only functional usage for this mechanism
was to allow to see records from several companies by creating a virtual parent
company, which will be possible with the new mechanism.

2/ By default, a user will only see the records of the company he is connected
to (or records without a company). (It is still editable by the user if needed).
For that, put this information in the user context, to allow having different
configurations on different browser tabs. Instead of having domains like
['|',
('company_id', '=', False),
('company_id', 'child_of', user.company_id.id)]
you'll have something like
['|',
('company_id', '=', False),
('company_id', 'in', company_ids)]
Note that the 'company_ids' is a value that is passed in the evaluation
context on the record rule, as we already have user, or time.
company_ids is a list of the ids of all the enabled companies in the
user's context.

3/ Out of the generic improvements brought by this task, this will illustrate
issues that could exist since several versions. For example, it should not be
possible to create a scrap order for the company A with a package of the company
B, or it should not be possible to create an invoice on the company A with
payment terms from the company B. Before the version 12.0, it was easy to
encounter this kind of issues as the admin was the SUPERUSER_ID. A positive side
effect of the fact that the SUPERUSER_ID has become an inactive user was to
make it more difficult to introduce mismatch on the records, but haven't solved
the issue, as it was still possible to do it with parent companies
configuration. Some of these issues have been fixed in this commit, but all the
business flows should be re-tested to check if an ir.rule should be introduced
(eg: a multi company rule for stock.quand.package), if the company of a record
is correctly transfered to another record created from the first record (eg:
From a SO, create an invoice and a payment, the company of the sales order
should be transfered on the invoice and the payment, even if the company of the
sales order is A and I'm logged into the company B with the company A enabled.

4/ Currently, if I click on a button on a notification email (example 'View
Task'), I face a traceback if I'm not logged into the company of the record.
Now, if you click on a button and if you have access to the record, the correct
company will be automatically set.

5/ If I display a kanban view with several records from several companies (and
an image), all the images should be displayed.

6/ Currently if you copy paste an url, this will crash if you're not in the
correct company. This won't be fixed because it's quite impossible to do it in
a clean way. This task brings a workaround. Copy/Paste -> Traceback -> Log into
the correct company, re-copy/paste -> Ok.

7/ 2 property methods have been added on the environment to retrieve the company
on which the user is logged in and the companies the user enabled, on a specific
tab.
That way, when creating a record, instead of doing
default=lambda self: self.env.user.company_id
do
default=lambda self: self.env.company_id
On the other hand, to retrieve the enabled companies, do
companies = self.env.company_ids

8/ Modify the Company Switcher widget to allow to log into another company
WITHOUT writing on the res.users (and thus bringing cache invalidation issues
and so on). Also allow to enable several companies and see records from several
companies, and independantly of the other browser's tabs.

9/ When focusing on a tab, save the current company configuration on the local
storage. That way, when doing 'CTRL+T' or a middle click, the context is
propagated to the new tab.

10/ Improve the error message in case of multi company access errors. Now, when
the user is in debug mode, display the related names of the records and the name
of the user who brings the issue.

11/ Remove the context erasing when writing on a res.users
This is probably coming from the migration to new API of the base module.
The context was not propagated at this moment, which was a common mistake at
that time. When migrating the module, probably by using the 'black box' method,
as the context was not propagated, it was erased on the new version. This is
now an issue because the context (i.e. the enabled companies) was erased when
writing on a res.users, leading to tracebacks.
See: https://github.com/odoo/odoo/commit/7eab8e26d3d46c53f4be924d6a34e80a66e74960#diff-4c2e738ee8f64f11806c889ea097b5e7R624

12/ Fix the crash manager on redirect warnings. The issue is the following
- Create an invoice on a company without a configured CoA.
- Set a partner
- On the onchange_partner_id, a redirect warning is raised to propose you
to configure a CoA
- Click on 'Go to the configuration panel'
- A generic warning says something like 'Do you want to discard your changes?'
- Click on yes, the page refreshes, but not on the redirect action.
Now, set correctly the action on the hash, and reload instead. The breadcrumb is
lost for example, but you reach the correct action at least.

13/ Introduce a res.group to enable/disable the multi company per tab
feature.

14/ To help the users to know which tab is in which company, add the
possibility to have a favicon per company. When creating a company,
the classical 'O' icon is colored by default in a random color.

15/ Remove the company switcher on the frontend. This was mainly there
to allow a user to swicth to the company linked to the website.
This behavior is now transparent to the user. If the website A is
activated, then the company set on the context is the company of the
website.

16/ Deprecated the _company_default_get method on the res.company
model. Remove the method _get_company on the res.users model.

17/ Add 'allowed_company_ids' and 'current_company_id' on the pyeval
context. You can now use those variables on domains in the views to
access directly to the activated company.ies on the current tab.

TaskID: 1960971

closes odoo/odoo#32341

Signed-off-by: Yannick Tivisse (yti) <yti@odoo.com>
2019-05-13 08:57:49 +00:00
Christophe Simonis bbedcdb190 [MERGE] forward port branch saas-12.1 up to ff1bca32f3 2019-03-14 19:44:55 +01:00
Christophe Simonis ff1bca32f3 [MERGE] forward port branch 12.0 up to a26496b6e7 2019-03-14 17:43:32 +01:00
Nans Lefebvre a26496b6e7 [FIX] mail: set message_main_attachment_id when the attachment is added via widget
Create a record.
Add an attachment, using the widget (aptly named 'add an attachment').
It is not set as message_main_attachment_id.
If you add the message through 'log note', then it is.

We add a hook to make sure that it is set as message_main_attachment_id
when added through the widget.

opw 1950403

closes odoo/odoo#31847

Signed-off-by: Nans Lefebvre (len) <len@odoo.com>
2019-03-14 12:50:51 +00:00
Yannick Tivisse 62c9dedafd [IMP] base: Remove useless ACL rules
Now that portal users don't have access to the backend, it doesn't make
sense to give the read access on attachments, as this is the role of
the specific controllers to provide this access according to the business
logic.

For the record, these rules have been introduced at:
https://github.com/odoo/odoo/commit/61065b6d04248aa496765e1035c4c90cbdc38de7
https://github.com/odoo/odoo/commit/f3fa266d115ac9d4723164af10f8dee40821b290

closes odoo/odoo#32134

Signed-off-by: Yannick Tivisse (yti) <yti@odoo.com>
2019-03-29 12:00:25 +00:00