Purpose
=======
display_name is equal to doing name_get()[0][1]
Replacing name_get()[0][1] by display_name could be good for 2 things:
- Uniformization of the code
- Probable optimization if name_get is used inside a for loop on a recordset (as the values will be prefetched and put in the cache).
TaskID: 1849250
closesodoo/odoo#26341
Since commit f7130556bb the compiled assets would be returned in a loop
before executing the rest of the `preprocess_css` method.
But every loop would override the previous one as it is `=` and not `+=`.
Fixes#27922closesodoo/odoo#29109
Steps to reproduce the bug:
- Go to Contact app
- click on Configuration > Bank accounts
- Create a new one
Bug:
It was impossible because the field partner_id was hidden.
The form view view_company_partner_bank_form was displayed instead
of view_partner_bank_form.
opw:1908114
closesodoo/odoo#28916
Writing on a parameter invalidates the ormcache and propagates the invalidation
to other workers. Setting a parameter to its current value should not trigger
ormcache invalidations.
Do not propagate cache invalidations to other workers when changes must be
discarded, because of an import error or a dry run, which are both handled as
successful transactions.
Instead of returning False directly when comparing a non-model, return
NotImplemented that will trigger the __eq__ test from the other side.
This allows third party objects (for instance a serialization/deserialization
scheme) that cannot be a Model to be considered equal is some scenarios.
closesodoo/odoo#19977
In case a report has no template defined, the fallback is on the first
body_parent that matched the xpath '//main'
xpath method returns a list
Fixes#27406closesodoo/odoo#27630
If no value is specified on the datefield, do not set a warnfuture message
Remove code comment that was referring the condition present at b51b0d66c2
but no longer present.
Add tests
Fixes#27551closesodoo/odoo#27593
If a deferred field, for example with auth_user_policy installed:
<field name="f" password="True" widget="password_meter"/>
is inside the res_config_settings view, the rendering will be deferred
which is not taken into account when initializing the content
(_initModules) or attaching to DOM (after start).
Thus we would would get an error and have no access to settings.
The issue that happened in 12.0 was solved with 23bec7fb7 and refactored
in between in 5bbbd25ed, but the heart of the issue was not solved in
the case of a customization.
With this commit, we do not lose the deferred when it is necessary to
keep them in the case of deferred while rendering.
Without fix, the added test fails with a traceback and message:
TypeError: Cannot read property 'settingView' of undefined
opw-1890343
closes#27589
* base, website
An image URL may be like "/web/image/<xml_id>" where <xml_id> is the
xml id of an ir.attachment. In fact, the route does not use the xml_id
but the 'key' field, which is normally equal to the xml_id for standard
attachment. In the context of themes + multi-website, the value used as
an xml_id may refer to a theme.ir.attachment instead of an ir.attachment
and this led to a bug as those must not be used the same way.
The crop route which gets image information is adapted by this commit to
always look for the *current website* *ir.attachment* related to the
given xml_id/key.
Thanks to @kig-odoo for spotting the issue.
Closes https://github.com/odoo/odoo/pull/27588closesodoo/odoo#27611
The test_tags is stored as None by default in the config file,
but 'None' is interpreted as a string when read.
This is a dirty fix in order to avoid to launch tests when using
a config file, we should do something cleaner in master and refactor
part of this code (substitute 'None' in the load method as it is
done for boolean)
closes#27498closesodoo/odoo#27564
In 7f29b31cf the modifed has been improved but there was a typo if a
column contained an uppercase letter (which happen easily with random
field name in Odoo Studio).
opw-1890248
closes#27546
Before the fix, routes using binary_content with access_mode
and access_token didn't work properly since access_token
was compared to the object's access token in all cases.
This commit:
-prevents the object's access_token check if
access_mode is truthy (since access_mode does its own access_token
check).
-changes check_access_mode so it now returns a boolean instead of
a record and is now private.
Closes#27401
- Add a method for generating an image data URI, and expose it in QWeb context
- Fix reports, website templates or mail templates with data hardcoded
data URIs, to use the helper (Python cases), or the existing
kanban_image helper (for JS cases)
This will gracefully handle SVG support in addition to classical image
formats.
Closes#26635
Introduce official support for SVG files in the framework, including the
following parts:
1. When client-side SVG images are uploaded, the content is displayed until
you save using data URI scheme according RFC 2397 [1]. This scheme requires
to specify content format. Using hardcoded "image/png" works for all images
types except SVG.
Type-sniffing is done using "magic byte" detection via the first base64
encode byte, so that the proper data URI scheme can be used.
This should not cause SVG-related security problems as the file is
displayed through `<img>` tag, which does not allow SVG scripting [2].
2. Make /web/image controller compatible with SVG
3. Add support for SVG files for company logo, which uses a dedicated
controller.
4. Resizing of SVG files is a no-op, as it makes little sense for a
vector-based format. We also want to avoid micro-alterations to the SVG
document (in "natural" viewport parameters) as we would store multiple
copies of the files in the filestore.
5. Because SVG files are inherently dangerous, upload of SVG files is
restricted to administrators, either by blocking it directly before
saving it in the database (binary fields with attachment=False), or by
neutering them to text/plain mimetype (for binary fields with
attachment=True)
6. Add tests for the SVG upload cases and for the non-admin uploads.
[1] https://tools.ietf.org/html/rfc2397
[2] https://www.w3.org/wiki/SVG_SecurityCloses#26635
Purpose
=======
They are a lot of places where we set an attribute 'groups' on a view element and:
- The group doesn't exist anymore
- The group xmlid is not correct
- The group xmlid exists but the modularity is not respected (example: group_stock_user
used in a view in the 'product' module).
Where it happens, nothing warns the user or the developer. The element is just never
rendered.
Specification
=============
In the method _check_xml, log a warning if a 'groups' attribute is set and if
a group doesn't not exist at that moment.
Introduced at 574f4c3d
model._module has for value of the last module extending the model.
This means that, when a module B inherit from a model defined in a module A (e.g
to add a field on the model), an external id, tagged with module B, will be
created for each field of the model, including the one defined only in A.
The intention of the patch at 574f4c3d was to include the automatic fields (i.e.
LOG_ACCESS_COLUMNS) into the condition.
Without that condition, the fields such as create_date were deleted when
upgrading a module (not defined in any module)
Session rotation was introduced a long time ago, but deactivated at
login due to obscure side-effects related to #6949 (aka the "BBQ" PR).
This commit reinstates the rotation, which is better from a security
standpoint.
In order to also prevent session ID reuse, we force the renewal of
deleted sessions, at the SessionStore level (via `renew_missing`).
Christophe Simonis