In commit bc43417b, a loading attribute is set on any submit button. The
problem is that this attribute is the first thing to be set. Therefore,
we cannot prevent its propagation.
Since Bootstrap sets this 'loading' attribute in a setTimeout, we need
to remove it in a setTimeout as well.
This merge is a large refactoring of the chat/channel code (client side
code). A goal is to simplify the logic of updating chat windows,
chatter and channels.
A notable change is that it also disable the livechat js code, because
it was not updated on time.
At least, when someone mentions a user in a message posted in a channel, a
notification is sent by the server that a new message just arrived in that
channel. Client side, we then decide whether or not this message should appear
in the Inbox as well. In the positive case, we can increase the needaction
counter.
Problem remains for messages sent from chatters and by using the mail icon in
the systray, as for those ones, no notification at all is sent by the server.
In test mode, only one cursor is available, and longpolling will take
it, and not give it back before 60s, causing a phantomjs timeout. This
commit simply return an error when the server is in test mode.
Sadly, I had to patch the web client to prevent logging the error in
this case, because that's the way phantomjs detect if there is a
problem.
It was hidding it because the method that removes a message from the thread
didn't pass the options for the thread rendering, and the flag specifiying
whether or not the 'load more' button should be displayed is in this options
object.
boot loader waited for only 100 ms before logging failed modules.
However, modules can now wait for deferred before completing their
loading, so this delay is increasingly getting too short.
in systray and in client action. This is only a client side fix. A
problem persists: the server does not notify the client when a new
message arrives in the inbox, to the client can not possibly increase
the counter.
The problem was that the bus didn't listen to new channels when they were
registered until the end of the current longpoll. This allows mail to manually
restart the polling.
On website page, in debug mode, error 'web.session already defined' appears in the console. This was due to the fact the namespace web.session was redefined a second time to bind the session on the server_url param for the livechat to work. On website page, this is already done by the native web.session (session_instance.js). Define a session in the bundle is required when livechat is intergrated on external page, so fetching the bundle is done through /im_livechat/loader/, and generating a web.session can be conditional.
Update the cookie after changing conversation state
Deleting the conversation cookie when closing the conversation window
Force open the conversation if a cookie is found (even if the state is closed)
To display author avatar to public user, using the /web/image url with res.partner returns the placeholder since public doesn't have access. Using the url on mail.message will display the avatar according to the access right defined on res_model/res_id of mail.message. However this executes mush query to fetch the avatar image (1 per message, against 1 per partner).
Maybe this wasn't a bug, but since it is a regression, this deserves to be fixed ...
The commit 6327cda0a7 introduce mock_attachment object, replacing ir.attachment. This new object doesn't not have id attribute : accessing it crashes. livechat controller needs to search on the mock url to generate the status, headers and content of the response via binary_content() method.
Use case: create a new tag, change its color and create another new tag. The m2m field was rendered again but the dataset was not aware of the color change on the first new tag. We need to invalidate the cache after changing the color in a tag in edit mode.
- Remove _check_communication method which was a complex way to achieve
what extension classes can do with a simple @api.constraint
- Proper default values for partners created through the payment form.
- In res.partner.bank, store the 'acc_type' computed field so that it can
trigger constraint check (base_iban adds one)
- Misc
* make CSRF protection the default on all non-SAFE methods
(any method besides GET, HEAD, TRACE and OPTIONS )
note: there currently is no way to call a CSRF-protected endpoint
without a form-encoded entity-body as that's the only place we get
the CSRF token from.
* simple CSRF token generation: just use the HMAC'd session id, no
generating a new random token per session then HMAC it
* use constant-time equal function to avoid timing attacks
* assert that a database secret is configured before
hashing/validating the CSRF token
* opt-out database manager from CSRF: the super-admin password
serves the purpose of a CSRF token in the database manager screens.
Implementation by xmo@odoo.com and chs@odoo.com
Only used by web tests (which rely on a module they don't depend on to
run, bad!) and altering the test session directly should work, so this
endpoint seems completely unnecessary.
* add CSRF token as core.csrf_token
* add CSRF tokens to client-generated and/or JS-submitted forms
* remove broken "compatibility" mode of web.ajax.post
/cc @dmo-odoo I've no idea how that was supposed to work, from looking
things up all modern browsers seem to support FormData, and old IEs
which don't don't support fallbacks either and would require
submitting an actual form as fallback so...
* make CSRF protection the default on all non-SAFE methods
note: there currently is no way to call a CSRF-protected endpoint
without a form-encoded entity-body as that's the only place we get the
CSRF token from.
* simple CSRF token generation: just use the HMAC'd session id, no
generating a new random token per session then HMAC it
* use constant-time equal function to avoid timing attacks
* assert that a database secret is configured before hashing/validating
the CSRF token
* opt-out database manager from CSRF: The super-admin password serves
the purpose of a CSRF token in the database manager screens.
There is no request database to obtain the
secret and generate a CSRF token.
Nicolas Martinelli