From now, you need to explicitely add sitemap=True if you want your controller
into the sitemap.
It's the default value, but if you forgot it, it will raise a Warning on runbot.
It will avoid wrong controller in sitemap and duplicate (empty) content.
From now, if your model contains a field website_id, the modelConverter for
sitemap will automatically add the domain:
"[('website_id', 'in', (False, current_website_id))]"
It avoid redundant declaration and ugly url in redirect/rewrite view.
Migration: need to remove it from url_from in website.rewrite
task-2065018
closesodoo/odoo#39427
Signed-off-by: Jérémy Kersten (jke) <jke@openerp.com>
You need to provide a small part of the code, because to avoid fraud, google
make several request to be sure that you don't allow all codes :)
So the 'WPS' solution was dropped, now we take the first request from google
that match the part provided, as the good one, and refuse all others requests.
task-2086915
closesodoo/odoo#39186
Signed-off-by: Jérémy Kersten (jke) <jke@openerp.com>
The XML file homepage view record is not supposed to be deleted as it is used
to bootstrap newly created website.
If that view is deleted, everything's fine. But if that view's page is not
found (m2o link broken somehow), then the code would crash.
This would only appear if the user is playing in the backend in technical but
it seems to happen more than it should.
This commit will prevent the code to crash in such a case.
Step to reproduce:
1. Go to settings > technical > views (debug)
2. Find the xml homepage view (with xml_id)
3. Go to its website.page and break the m2o view_id
4. Try to create a new website, it will crash
opw-2081894
closesodoo/odoo#39149
X-original-commit: 1d4dd200c664b99dbdb3e65e3950be1cb5e79a0a
Signed-off-by: Romain Derie (rde) <rde@odoo.com>
Since 62c9dedafd, when accessing a website
connected as portal or public user, the themes images are not showed. An
error is arose 'Sorry, you are not allowed to access documents of type
'Attachment' (ir.attachment)'.
Now, the portal and public user have access to the themes images.
opw-2082468
closesodoo/odoo#39025
X-original-commit: 9b8c390cd5526556346356f260a9cfe1b90cd510
Signed-off-by: Jorge Pinna Puissant (jpp) <jpp@odoo.com>
Co-authored-by: Lucas Perais <lpe@odoo.com>
A 404 will take 3 to 5 seconds to be resolved and execute +- 1900 query, to return
a rendered page which is quite expensive, especially when multiple missing images
are rendered in a view.
Catching static route and marking them as not frontend will help to avoid to handle miss
on static resources. In this case server returns a standard 404.
This commit also fix a iframe src in order to avoid a 404 on
/web/(test )/report/html/some_report (thx to aab-odoo)
X-original-commit: 818d0cb59fbae78d0edf06318082981f318e4db7
Before this commit launch a server with --db-filter that match at least 2 dbs name
Try to authenticate
You will have an error request is unbound when you try to access request.env
Now we retrieve the user from self instead of the request.
New test to ensure rpc authentication is tested.
Related to commit 245ef4b1
closesodoo/odoo#38969
X-original-commit: 4b3400c430bec7539aada0619fd203978daca2d8
Signed-off-by: Jérémy Kersten (jke) <jke@openerp.com>
When you try to create two users with the same login, the shown error message is
the Postgresql integrity error instead of a nice (translated) validation error.
This happens since bf88f3e which changed the way error messages are translated.
The reason is the manually created unique index `res_users_login_key_unique_website_index`.
The error handling and translation mechanisms don't know it exists.
The index was created for performance reasons in commit b5a12b4 where the
original python constraint was replaced with this custom SQL index.
In this commit, the python constraint is re-introduced to remove the index hack,
but the implementation now uses a single SQL query, which should be quite fast.
closesodoo/odoo#38737
X-original-commit: 817a811ec98b0c313b12e6464b5e98ca432cb3fc
Signed-off-by: Christophe Simonis <chs@odoo.com>
This is necessary when writing view fields from a page record because the
generic page will put the given values on its cache but in reality the values
were only meant to go on the specific page. Invalidate all fields and not only
those in vals because other fields could have been changed implicitly too.
Pr: #37363
X-original-commit: 83f9a3e2608db34a319b985271d73f7de5bc73a1
Install the website, install a second language.
Switch the language on the website: error 500.
The function opened a new cursor, to update website_visitor.
It did so at the end of the query dispatch.
However when switching the language of the website, the lang is written on the
website visitor. This is done at the flush, done at the end (exit) of the query.
This is done on the cursor that was used for all the transaction.
Therefore that write would systemically fail on a
ERROR: could not serialize access due to concurrent update
opw 2080986
closesodoo/odoo#38453
X-original-commit: cc88a36744dc3c2949c47e8b163e1de98f5dbd95
Signed-off-by: Nans Lefebvre (len) <len@odoo.com>
*base, website_blog, website_event, website_forum, website_slides
With this commit:
1. It is now possible to add the 'Edit in backend' entry in the frontend navbar
for any desired model, not only the ones which have the published mixin.
It will simply redirect to the main_object form view.
This commit add it to Forum and Blog.
2. When clicking on 'Edit in backend', it is now possible to land on another
module than Website.
That's especially useful for events and slides which are not directly
related to the website module as they have their own module.
3. Remove the custom Edit in backend from the forum homepage (fa-cog).
Opportunity was also taken to remove the 'edit welcome message'.
It will now be editable through the editor (welcome message will appear in
edit mode). Thus we got rid of the custom edit welcome message controller
and views.
Closes#36325
Without this commit, connection with mobile app crash
since there are no uid set on the env.
_is_public_user expecting singleton.
closesodoo/odoo#37756
Signed-off-by: Jérémy Kersten (jke) <jke@openerp.com>
* = portal, website, test_website, account, sms
Portal an Survey error pages were ugly default pages.
Now the error pages will be the same as the website ones.
Also fixing single module builds tests
task-2059969
closesodoo/odoo#35535
Signed-off-by: Jérémy Kersten (jke) <jke@openerp.com>
Redirect_type was renamed from 3xx to redirect_3xx, but name is used as http
status code. It is better a redirect(301) instead of redirect(redirect_301)
Re-add the bind_to_environ, it was removed because it seems not useful, but
once you are behind a proxy, werkzeug need the environ to find the correct
hostname and more ... Transformed relative url into absolute by werkzeug was
wrong.
closesodoo/odoo#37733
Signed-off-by: Jérémy Kersten (jke) <jke@openerp.com>
The update of visit_count now uses website_track instead of
website_visitor_lastconnection for less complex query and better
precision.
The name of a visitor is now changed only if it has no partner linked
and the # is removed
The cookie was not reset when a new partner connects or if a partner
disconnects. Now a check is performed to ensure the cookie belongs to
the partner/public user.
Now website visitors that log in will be added to the previous
website visitor of the partner. This way we have a full history and only
one visitor per partner.
Now a partner is able to delete a recently viewed product from his
recently viewed product list.
task-2072877
After this commit, you will be able (in technical mode) to update the url for
the python controllers.
Eg.
You can now rename /shop in /garden and /shop/product/ in /garden/vegetable/
Most of urls will be replaced at fly in the renderd qweb, with the function
url_for but all old urls will keep available. So if you access url /shop you
will be automatically redirected to /garden (308 Permanent Redirect).
As for cdn and other post-process of att, the automatically replacement in the
rendered qweb is only done when you will be not website editor. But the new
dispatch of URL will be applied in all cases.
For developper, since it is Permanent Redirect, don't forget to clear cache or
open chrome debug tool (with option 'Disable cache while DevTools is Open) to
see your lasts changes.
closesodoo/odoo#36555
Signed-off-by: Jérémy Kersten (jke) <jke@openerp.com>
Before this commit, if one would introduce a scheme or a port in his website
domain, it would make the website selector to crash JS side.
Indeed, it would replace the current url hostname by the website domain.
If the website domain was introduced with `http://` it would lead to
`http://http://mysite.com`.
If port was introduced, `http://mysite:8069:8069`.
Also, by fixing those 2, it also make `localhost` and `127.0.0.1` to work.
(which would not work without `http://`.
Related to #36390
See 'Webiste Visitor (date)' as display name
Remove default value as a way to easily detect if somebody has already
a name or not
Note using the id in the display name is a bad (may not be set yet)
but is used knowlingly as a short way to differentiate 2 visitors.
Linked to task id: 2073714
closesodoo/odoo#37230
Signed-off-by: Martin Trigaux (mat) <mat@odoo.com>
This commit review the design of the visitor kanban view.
There is now two style for kanban card.
Ungrouped : the card takes all the width of the screen. It's simulate a nice tree view.
Grouped : Same design as before. ('normal' kanban card)
Apply visitor kanban views redesign also in :
- website_livechat
- website_crm
- website_sms
Task ID: 2073714
PR #37081
Signed-off-by: Thibault Delavallee (tde) <tde@openerp.com>
This commit aims to rename the visitor that has no lead and no res.partner
to 'Website Visitor #id'.
So that the visitors can be identified when, for example,
an operator talk with multiple visitors.
Task ID: 2073714
PR #37081
In order to be able to send push notifications using recipients timezone,
the visitor timezone is now stored in DB.
The visitor timezone is only updated once, when found_visitor_timezone
cannot be found in localstorage. Once the timezone is updated,
found_visitor_timezone is added to localstorage.
Task ID : 1936643
PR #34973
This commit allows to send an email to a visitor
directly from the visitor form view if the visitor is linked a
res.partner that a valid email address
Task ID: 2056080
PR #36290
Applies various improvements:
- Remove welcome message if chat request usecase.
- If a visitor is online: line is green / if offline: line is red (in the list view)
- Visitors list view: add first / last connection fields and remove time_since_last_action
- Avoid useless leave notification if the livechat channel is empty
Fix
- ACLS on website_visitor_page model (for im_livechat_group_user)
- ACLS on website_visitor and website_visitor_page model (for sales_team.group_sale_salesman)
- Update visitor lang if visitor change the website lang.
- Create visitor twice when translated website (due to rerouting)
- Avatar for visitor banner in discuss. (image_64 instead of old image_small)
Task ID: 2056080
PR #36290
*= website, website_livechat, website_rating
///// Tracking Product /////
Now when a user browse products in eCommerce, we keep track of the
products he looked at. We use the website_visitor
to store the products viewed. A cookie is added with a TTl of 30 min it
will prevent the RPC for that time. We track the page only if the
product view is tracked.
The recently viewed products are displayed as a snippet but also
with the customize option in product pages of website_sale.
Products that are in cart will not be returned as recently viewed.
It is possible to add a recently viewed product to the cart directly
from the carousel, it will not redirect to the cart. If we are on the
cart page, the product is displayed in the cart.
The Visitor page in website now references products viewed
///// Tracking Page /////
Feature to track a view was remove in: https://github.com/odoo/enterprise/pull/4834
That feature is now reintroduced and will use website_track instead of
leads to be stored.
The track field is now on the view instead of the page.
url field is added to website.track, it will store the url for pages and
views
The Visitor page in website now references urls viewed
Add some tests
task-1984575
closesodoo/odoo#35810
Signed-off-by: Jérémy Kersten (jke) <jke@openerp.com>
In order to keep all the visitors from all the leads to merge,
the relation between leads and visitors becomes a many2many.
So that after the lead merge, a lead can have multiple visitors.
This commit re-add the page view stat button that were removed
during website_visitor introduction and page tracking refactoring.
This button counts all the pages views from all the visitors linked
tho the current lead. Clicking on it redirect to the complete
navigation history, from all visitors linked to the lead.
Task ID : 2057428
PR #36180
Those values are only used on the website navbar when the user is in both groups
so the vast majority of the time they are done for no reason.
This reduces the number of queries by 2 on every page when the user is not admin
and/or multi website is not enabled.
Part of task-2061122
closesodoo/odoo#36483
Signed-off-by: Jérémy Kersten (jke) <jke@openerp.com>
Commit 54d30d5194 introduced `lastmod` and `priority` on sitemap locs.
This was broken with 4ecbacaf59 which introduced `website.page` model as it
removed the `PageConverter`.
Before website.page:
1. PageConverter returned records with `__lastmod`
2. `enumerate_pages` loop on converters would remove the prefixed `__`
After website.page:
1. code to remove `__` was still there but the pages would be found and looped
on after that code, making it useless.
With this commit:
1. The code to remove the `__` is moved after searching the pages.
Following #36090
Related to #35464
Signed-off-by: Jérémy Kersten (jke) <jke@openerp.com>
SHA-1 is a cryptographic hash function that have weaknesses known since
2005, it has been deprecated by the NIST [1] about 10 years ago in 2011
and Google [2] have been able to perform a collision attack in 2017.
We use SHA-1 in order to generate unique URL for resources that can be
cached by the browser: assets bundle, translations, qweb templates and
qweb images.
Although practical attacks still requires quite a lot of computational
resources, it is time to upgrade SHA-1 to SHA-2.
We have selected the SHA-512/256 variant of the SHA-2 algorithm as
replacement for SHA-1 for the following reasons:
* On 64 bits platform, SHA-512 is the fastest SHA-2 variant, it is only
~1.5x slower than SHA-1. [3]
* Keeping only the 256 foremost bits protects against both collision
attacks and length extension attacks.
* The hexadecimal digest is only 24 chars longer than SHA-1 which is
nice to have somewhat short URLs.
We have not used SHA-3 because:
* At the moment of writing, it is too slow (~3x slower than SHA-1) [3]
* It is not guaranteed to be available with the Python 3.5 `hashlib`
module.
* One of the author of SHA-3 is Belgian.
[1] https://csrc.nist.gov/projects/hash-functions/nist-policy-on-hash-functions
[2] https://shattered.io/
[3] http://bench.cr.yp.to/results-hash.html
[4] http://www.commitstrip.com/en/2017/02/27/the-sha-1-alternative/
Before this commit, every model having website_id would have the default
`set null` as ondelete value for that field. Exception for `ir.ui.view` and
`website.redirect` which are set to `cascade`.
This meant that deleting a website would basically transform all its specific
records into generic ones.
That would lead to unwanted behavior, such as multiple `ir.attachment` with
same URL, when 2 websites had been theme-customized. Deleting one of the
website would result in later crashes when trying to open theme customization
in the remaining website(s), since those website would find their specific scss
custom attachment as well as the generic one from the deleted website.
Probably more behavior might be problematic when deleting a website before this
commit.
To summarize the choice of this commit implementation, every model not existing
outside website module are set to `cascade` (website.redirect, website.menu,
product.wishlist..).
The rest should be in restrict, as we don't want to delete a whole forum, blog
or job, which should probably be managed case by case to decide what to do.
Thus, restrict is a good choice to notify user of what should be handled.
Some exception remains, ir.ui.view should be delete on cascade while sale.order
should be set to null.
opw-2038414
opw-2035249
closesodoo/odoo#35398
Signed-off-by: Jérémy Kersten (jke) <jke@openerp.com>
Allow users to create complex website menus, also known as "mega menus".
Mega menus are enabled individually via the edit menu dialog, then their
content can be customized by dragging snippets in them like any other
snippets area in edit mode.
task-1925319
closesodoo/odoo#36097
Signed-off-by: Quentin Smetz (qsm) <qsm@odoo.com>
Co-authored-by: Andrea Ulliana <aul@odoo.com>
The canonical tag is important for SEO, indeed it prevents search engines from
indexing duplicate content.
Reasoning
=========
The choice has been made to create the canonical tag automatically depending on
the request path, ignoring the query string, and manually prefixing the
appropriate domain and language code.
Indeed creating it manually for each resource would create a lot of code and
potential mistakes.
It is more dangerous to do it the generic way, but after investigation it
appears that it is an acceptable trade-off since the vast majority of our routes
are well built and already ready for this:
- using query string only for minor features that do not change the main content
- having the models, the ids, the pager and other important features in the path
Override
========
It is still possible to override the default behavior by passing
`canonical_params` manually to the view or to the different methods.
This is done for `/event` because the only way to display Past Events is to add
`date=old`.
Languages
=========
Fix an issue where it was possible for a bot to be on the URL without language
code but to use a language that is not the default language.
Adapt hreflang, because it:
- must only be present on canonical pages
- must always lead to canonical pages
- should not be set if there is no alternate language
Misc
====
task-1958075
closes#12532
Inspired by OCA module `website_canonical_url` courtesy of Jairo Llopis.
closesodoo/odoo#35852
Signed-off-by: Jérémy Kersten (jke) <jke@openerp.com>
Co-authored-by: Jairo Llopis <jairo.llopis@tecnativa.com>
Co-authored-by: Sébastien Theys <seb@odoo.com>
Since saas-12.5, with recent ORM changes, writing on non-existing fields
does not trigger a warning anymore but instead crashes. This revealed
that the 12.0 "Edit Menu" dialog was doing some of that. Indeed,
depending on what was edited, we ended up writing on the 'is_homepage'
field, the 'text' field, the 'isNewWindow' field, ... which do not
exist.
This commit takes advantage of the fix to also lint the dialog code and
convert some of it to ES6.
Discovered while working on task-1925319
closesodoo/odoo#36204
Signed-off-by: Quentin Smetz (qsm) <qsm@odoo.com>
Jeremy Kersten