Modern browser implement the autofill specs as described at
https://html.spec.whatwg.org/multipage/forms.html#autofill
This means that there is now a way to tell the browser when a password
field is supposed to be filled with the user's own password (e.g. on a
login field), and when it's supposed to be used to input a new secret
value (e.g. when changing someone else's password).
This can be distinguished by setting the autocomplete attribute
to `current-password` or `new-password`.
In addition, many browsers have decided to entirely disregard the
autocomplete='off' attribute value, because it is felt that using
a secure password manager (as provided by those browsers) is a net
gain for security, allowing users to pick stron passwords.
See also https://developer.mozilla.org/en-US/docs/Web/Security/Securing_your_site/Turning_off_form_autocompletion
Based on this, the framework should generally consider that
password fields in the backend are meant to be used for *setting*
new values (autocomplete="new-password", i.e. no autocompletion!),
whereas the password field on the login page can indeed be autofilled
with the user's current password (autocomplete="current-password").
In addition to making the above changes, this patch also
lets developer specify their own `autocomplete` attribute on
text input fields.
If the user writes a password larger than 4096 characters at the login
screen, it causes a crash instead of displaying the "Wrong
login/password" message.
The Python library used to hash password (passlib) is by default limited
to 4096 characters. Above this limit, it raises an error (source:
https://pythonhosted.org/passlib/lib/passlib.exc.html).
Allowing a password larger than 4096 is not necessary, we just limit the
field maximum length since such a situation should happen because of an
incorrect copy/paste.
opw-704110
Before this commit, the DomainSelector had to be instanciated with an
array-typed value which forced the user to use (and import) the pyeval
module. Now, the conversion to array is done in the DomainSelector.
This commit introduces a web.domainUtils module allowing to do the
convertion array -> string and string -> array of a domain.
* base_action_rule, gamification, mass_mailing
1) Create the independant DomainSelector widget
- Allow to build a prefix char domain
2) Replace old FieldCharDomain with a new FieldDomain which uses the
new DomainSelector widget
3) Create the independant ModelFieldSelector widget
- Allow to build a valid field chain for a specific model
(e.g 'partner_id.name' for a 'res.users')
- Used by DomainSelector widget
---
The DomainSelector widget uses a tree-like representation with
user-friendly buttons (ALL/ANY/+/-/...). Any domain can be built,
except those containing the "!" (not) operator or some operators
like "like", "child_of" (@see DomainSelector). However, if the
user enters these in the debug input, the widget can handle them.
Note: these widgets had to do unusual stuff the widget API does not
allow to handle efficiently right now but it will be adapted to the
new widget/field API in a further update.
Note2: the widgets also have possibility of other improvements like
supporting m2o input instantiation in DomainLeaf, etc.
---
This work is an adaptation of the original code made by @pga-odoo.
* Do not assault the user with a full traceback on bug, but indicates
an error occured and allow him to toggle the traceback
* Automatically scroll the traceback to the end (better for python
errors)
* Propose the user to report the traceback by using a new "Copy"
button which correctly copies the full error + traceback
The web modules defines a "layout" template which is only used by the
login default page. Now the backend template "web.webclient_bootstrap"
and the frontend template "website.layout" both use the "web.layout"
template as base.
Some parameters can be passed to customize the default "web.layout"
template:
- "head": content will be placed at the end of the <head> tag of the
page
- "title": to set the title of the page (the <title> tag should not be
placed "by hand")
- "x_icon": the url for the page icon
- "html_data": dictionnary whose key-value pairs will be placed as
attribute-value for the <html> tag
- "body_classname": the classname to set on the <body> tag
Note: xpath expression on the website.layout template can now only find
the #wrapwrap element and its children. An expression "//body" will not
have any result. If something has to be added in the body element but
not in the #wrapwrap element, simply change the xpath
<xpath expr="//body" position="inside"> with
<xpath expr="//div[@id='wrapwrap']" position="after">
Commit 977db823c7 refactored the web module so that it gathers
common features of community and enterprise. The problem is that the
web.webclient_bootstrap template content lost its groups attributes.
This had the effect to make the client crash when accessing the
template for calendar invitation for example, as the template was
trying to render menus without menu data.
Private browsing in Safari doesn't allow to store anything in the localStorage,
and it throws an error when you try to do so. This new JS module is a connector
to the browser's localStorage if it is enabled, and if not, it simply keeps its
own storage in RAM.
Mobile virtual keyboards will often capitalize the first letter of
an input text field, which is annoying as odoo logins are case-sensitive.
This will no longer happen thanks to this new attribute.
X-port of commit odoo/enterprise@b8632f8bb6
This commit introduces a mechanism to add information into the session
from a different module, without having to fetch it manually with a rpc.
This is intended to be used with small pieces of info required at the
start of the web client, such as currency informations.
To add information to the session, one can simply inherit from ir.http
and modify the session_info method.
session_instance.js moved from framework/ to services/ and renamed into
session.js, which required to change the bundles in report and web_editor
addons.
A fonts.less file which contains the definition of Lato was created
in saas-11 and placed in the backend assets. It should have replaced
the lato/stylesheet.css in the common assets.
Also adapt point_of_sale assets to use the same file.
Avoid duplicating web addon in enterprise by extracting a common basis.
Enterprise features stay in enterprise, but use that common basis.
Mainly:
- JS refactoring and linting
- Conversion of .sass into .less split into multiple files
- Templates cleaning and DOM simplification
- Re-generation of web.pot, and update of .po files
Introduction of 'data_manager' service which handles meta-data related to
actions and views (fields_views, fields and filters). Ideally, all RPCs to
get that kind of information should go through data_manager, as it holds an
internal cache.
* Remove recursive assets inclusions (i.e. assets_editor was including
assets_common, summernote, ...)
* Better construct the assets (link, then script + type attribute)
* Better include the assets (split js / css, always use t-call-assets)
* Simplifies the number of assets
* Move bootstrap js to assets common
* assets_frontend is now created by web module to allow using it on the
connexion page but also in the web_editor, where colors have to be
bootstrap/theme ones. Note: if a module depends on website, then keep
using the inherit_id="WEBSITE.assets_frontend"
If the user has multicompany rights and more than one allowed
companies, the full company name is displayed in the topbar. When you
click on it, there is a dropdown with the name of the other companies.
Clicking on another company name makes you switch on it and reload the page
qsm-odoo