In a multiwebsite environment, (de)activating some theme views produces
undesired results if the same view exists in different ways for different
websites.
With this patch, we search before for a website-specific view with the provided
key, and fall back to the XMLID-found one if there is no specific view.
This commit closesodoo/odoo#17970
About a `sudo` on ir.ui.menu, this commit (3649b7f359) removed it,
this commit (3d0cc2d6d2) re-added it.
Since portal user can not go on /web anymore, I think portal does not need to read ir.ui.menu.
Here some news scenario:
- if website is not installed, portal can log in, but will be redirected to login page
with an error message 'only employee can access'. Indeed, there is no page to display for
such user.
- if website is installed, but not website_portal, portal user can log in and will be
redirected to homepage. If he tries to manually access to /web, he will be redirect to
login page with access error (even if he will still be logged).
- if website_portal is installed, the portal user can fully enjoy its features.
This reverts commit 2d10c5eb43.
The fix was only needed up to saas-14. In saas-15 and over there is
another fix which adds the `uid` parameter back: 65ac6b8ae
The current user was used to generate the sitemap. So if a user with
more permissions than `public user` goes on the sitemap, he could
generate it (if he is the first to see it or the last generation was
more than 12 hours ago (by default)) and have pages unavailables for
a user with lower permission in the sitemap (until the sitemap is
generated again).
The issue was solved in 8.0 with d08facdcb but was introduced back in
10.0 with fd09ddb6f because the `uid` argument was dropped from
`generate` method on `ModelConverter`.
From 10.0 up to saas-14 the fix introduced is to use a `use_public_user`
key in `request.context` but in master we will keep the fd09ddb6f fix
by adding uid to the `generate` method.
opw-708456
note: to forward-port only up to saas-14
Template "sitemap_index_xml":
<loc><t t-esc="url_root"/>sitemap-<t t-esc="page"/>.xml</loc>
should be:
<loc><t t-esc="url_root"/>sitemap-<t t-esc="website_id"/>-<t t-esc="page"/>.xml</loc>
The fix in python is not elegant but allow to fix without -u of website.
Commit a2ae219d4e fixed the customize_template_get
function(s) which had been modified for the 10.0 web_studio release.
While the fix also reorganized the structure to make it more efficient
and understandable, it promised that the function would be refactored
in master. This is what this commit does.
The customize_template_get route of the website module was also removed
with commit 5a030db3eb as it was an useless
duplicate of the web_editor customize_template_get route.
The old route handled two totally different features of odoo: getting
all the page-related views to allow their edition with the HTML editor
and getting the "toggable views" which appear in the "Customize"
website menu. The parameter "full" allowed to determine which one the
route was supposed to do and was useless until website was installed to
add its feature (by extending the route behavior). In both cases, views
informations are returned, only the number of views differs. The
above-mentionned fix already did part of the refactoring by returning
the same info structure for each view in both cases.
Now, the function has been split. The web_editor customize_template_get
route is renamed as get_assets_editor_resources and returns the info the
HTML editor needs to work (the "assets" term is in prevision of the
new LESS editor).
A new website route "get_switchable_related_views" has been created to
return the info the "Customize" website menu needs.
Both use the renamed ir.ui.view function "get_related_views" (old
ir.ui.view customize_template_get function) which now returns a
recordset and not a list of dictionnaries.
Stop using ugly code for ace editor.
* Really close the ace editor by changing its display property thanks
to the dedicated do_show and do_hide method.
* Make the common part of ace editors (website, web_studio) consistent
so that the extensions are really small.
* Do not do RPC to retrieve data already retrieved (now, there is only
one unique RPC when the editor starts an one RPC per view changed
on save).
* Fix born-dead code so that the website editor starts automatically
if the URL contains its associated hash and loads the correct view
* Better handle errors (previous behavior only worked partially and
only on chrome):
- Jump to the error line and make it red.
- Do not open a Dialog with mostly incomprehensible message but
allow to open it on click of the error marker.
- Do not save any changed file if one contains an error.
- Do not allow formatting a file if it contains an error (show the
error instead).
* Do not use different routes to get the same content (remove the
/website/customize_template_get route as it returns the same
content as /web_editor/customize_template_get route). Note: in
a further commit this route will be refactored.
* In a general way, use consistent method names and behaviors /
comment the code / lint files / ...
* Open the code to extensions (so that it may later load other data
than XML).
Note: this refactoring allowed to fix bugs in previous odoo versions
but this commit message will not detail them.
Commit e11f23b701 split the website
customize_template_get into web_editor and website ones. This split
was not perfect and commit 20861b482a
tried to make it work... but did not made it totally and added an
indirect dependency to website module in web_editor...
As the final result is wrong and inconsistent and that the previous
9.0 implementation was already ugly, this was not possible to make
a consistent full-stable fix.
This commit tries to make a fix as stable as possible (the main method
name did not change, the arguments did not change, their purpose is
the same, ...) which makes the code work and be less ugly. However,
the function returns are now slightly different (and JS depends on it).
It returns only valid view information (not header stuff which is not
related to anything and the inherit_id value is now a combination of
the inherit view id and name). Also, a new private method has been
created.
Also, the method contained code which was deprecated since saas-6 but
was never removed (and never broke anything "by chance").
In master these methods will be refactored to make more sense.
The commit e59a7fe3ff has moved
the ACE editor from website to web_editor. As some code on ir_ui_view
was used for this widget, the code has also been moved to web_editor.
The dashboard must be visible for non-'group system' users, hence
the sudo call + only display the link to modify the client id
if the user has sufficient access rights.
Small visual correction for live users counter in the dashboard.
The Website Admin dashboard displays graphs for sales, analytics,etc.
using a (somewhat easily) extensible js framework.
Unfortunately, this framework is ACL unaware, meaning that it will
completely and silently crash if you are missing any of the required
access rights.
To solve this, extensions must now specify not just a graph name
but a necessary group for it and set the value for this group in
the extension of the backend controller.
This commit also
- make the icon visible for the group 'Website Designer and Editor'
(not juste the Settings group, which is extremely restrictive)
- make the button to set the Google API key only visible to people
with sufficient access rights
When logged in a user was redirected to the website instead of the backend.
This was due to a wrong group verification, at that point:
- request.uid = ID of the user authenticating (e.g. admin)
- request.env.uid = ID of the user that rendered the page (public)
As public does not belong to `base.group_user` group, the user was redirected to
the website.
Introduced at fd09ddb6 during migration.
Fixes#13203Closes#13204
Since saas-3, website controllers use `request.website.render`
to render the template of a web page. This was kept for retro
compatibility. It's time to stop using deprecated stuff.
Same for `_render` method on website.
'json' route don't use `request.render` since
`JsonRequest` has no `render` method.
Migration of website module to new API.
The tricky phase is ir_http.py : we need to use `request.env`
only when the authenfication phase is done. Normally by
calling `super` of `_dispatch` method, but website module
required it to be done before. This is important since
`env`is a lazy property of `request` object.
Some hack were kept since this commit is a migration ('RequestUID'
in ir.http, ...)
Some docstrings were added.
Some address have required state.
We add by default moreover 500 new states.
We try also to merge duplicated states
wich have the same country and code.
Once merge is done, we try to had the unicity constraint
to avoid futur duplicates.
Merge code, should be removed in v11.
Before this revision, it was possible to use the
`/website/image` controller using kwargs only
e.g.
`/website/image?field=datas&model=ir.attachment&id=718207`
After, it's no longer possible.
It was assumed `/website/image` without any argument
in the route itself (`<xmlid>`, `<field>`, ...)
could simply never be called,
but this is not the case.
We therefore restore it by retro-compability purposes.
Multiple technical routes were listed in the sitemap,
and it's pointless to list them in the sitemap.
There is currently no way to exclude routes
from the sitemap using a specifc argument
(e.g. sitemap=False on the route).
Therefore, in order to remove them from the sitemap,
we play with the current conditions to exclude
these routes from the sitemap:
- routes with `auth` other than `none` and 'public`
are excluded. Technical routes marked as `auth="public"`
for no reasons are changed to `auth="user" so they
are excluded from the sitemap
- routes with required arguments are excluded as well.
the route `website/image` cannot work without any argument,
`website/image` has therefore been removed from the possible
routes for the method `website_image`, so it's no longer
listed in the sitemap.
For an exhaustive list of the conditions to exclude
a route from the sitemap, check the method
`rule_is_enumerable` in `website/models/website.py`
opw-670865
- add or fix decorators on methods
- fix most compute methods (wrong dependencies)
- revert changes in `eval_context` of `ir.actions`
- various code simplifications and improvements
- migrate methods that were not
- ir_qweb: modify `QWebContext` to take an environment instead of `cr`, `uid`, `context`
- ir_qweb: convert `AssetsBundle` to use new API `env`
- ir_ui_view: use decorator `multi` on method `read_combined`
- ir_ui_view: ensure that method `render` is never called with an xml_id
- ir_ui_view: factor out part of the `ormcache` key of method `_read_template`
Christophe Simonis