Today, Odoo is really tricky to use without seeing the screen, it must be improved to be usable.
This PR forbid to use labels without a "for" attribute, add some title, rule and aria attributes in HTML. With that, Odoo will be fully usable with a screen reader.
* [IMP] Labels must have a for attribute. Improve accessibility.
* [IMP] Better error message when trying to read a missing cached value
* [FIX] Add some aria-label and title attributes for screen readers.
* [FIX] Template name is not included in the error message in case of SyntaxError in QWeb
* [FIX] Improve the Tour failed at step error message to be more explicit.
* [IMP] Add aria-labels
* [FIX] Add missing aria-label on failing test
* [IMP] aria-hidden means hidden. Fix all bad aria-hidden and hide aria-hidden for all.
* [IMP] Color names on kanban views and many2many tags
* [IMP] Add some checks on views for accessibility.
* [IMP] Add `alt` attribute on `img` tags.
* [IMP] Add aria-label and title on non-described icons
* [IMP] Add button role to widgets with btn class
* [IMP] Translate aria and formatted attributes.
* [IMP] Remove wrong aria-labelledby
* [IMP] Add menu role on dropdowns
* [IMP] Buttons must be focusable
* [IMP] Add aria attributes on progress bars
* [IMP] Improve accessibility of basic widgets
* [IMP] Change main layout to more semantic tags
* [IMP] Add menuitem role when missing
* [IMP] Remove wrong role='presentation'
* [IMP] Improve accessibility of tab panels
* [IMP] Add aria-invalid on invalid fields
* [IMP] Add aria-sort on ordered columns
* [IMP] Add role on alerts
* [IMP] Use dialog role, header, main and footer tags for modals
* [IMP] Add labels on o_status
* [IMP] Improve accessibility of kanban view with feeds and articles
* [IMP] Add alerts in case of new messages
* [IMP] Add widget, navigation or img role to aria-labelled items
This revision follows revisions
- 9cd982bcc8
- df4072b0b4
We noticed modules implementing multi-websites features
override `_get_asset` to be able to provide their
own overriden `AssetsBunble` class.
Private methods are meant for internal usage of the code/module,
overriding is never a good idea given the fact their signature
can change. As this is the case in commit
9cd982bcc8.
That said, we understand their was no other way to go.
We therefore decide to provide one,
by adding a method that can be overriden to pass
their own AssetsBunble class instance.
opw-1860136
Return of _get_assets has been altered with commit 9cd982bcc8
We keep it for retro compatibility, but devs that override it before need to
override now _get_asset_node to be called correctly by t-call-asset.
The context is send to qweb as option, the options are converted into a
frozen dict, the browse records can have a closer cursor, takes the place
in the cache, and raise and exception in qweb (because contact try to
json.dumps options for multi-edition feature in web_editor.
opw-1859848
The dateutil package uses lazy import to selectively expose its
features: `parser`, `relativedelta`, `rrule`, `tz`.
Depending on installed modules and order of initialization, there was no
guarantee that a given feature was already loaded during the preparation
of the action context.
This patch ensures that we always preload the feature set we need, and
only that feature set. This way we have a consistent `dateutil` lib in
the action context at all times.
An ir.attachment record can be served as a request's reponse if:
- a request triggers a 404
- the ir.attachment record has its url field matching the url of
the failed and is of binary type
Following rev[1], portal users have the right to create these kind of
records, and it is a security concern.
This patch restrict the ability to create and write on the ir.attachment
records that may be served through the dispatch's exception mechanism to
settings users.
As the asset bundles files are served through the use of these special
ir.attachment, we make sure to retrieve only ir.attachment records
created by the superuser in the `get_attachment` method.
As website administrators often need to play with these special
ir.attachment, we also let to this group the permission to manage them.
[1] 61065b6d04
Make sure building reports using local resources are disabled.
This avoids get different report result based on the system if the
given resources are or not present (e.g. custom style)
The dateutil package uses lazy import to selectively expose its
features: `parser`, `relativedelta`, `rrule`, `tz`.
Depending on installed modules and order of initialization, there was no
guarantee that a given feature was already loaded during the preparation
of the action context.
This patch ensures that we always preload the feature set we need, and
only that feature set. This way we have a consistent `dateutil` lib in
the action context at all times.
An ir.attachment record can be served as a request's reponse if:
- a request triggers a 404
- the ir.attachment record has its url field matching the url of
the failed and is of binary type
Following rev[1], portal users have the right to create these kind of
records, and it is a security concern.
This patch restrict the ability to create and write on the ir.attachment
records that may be served through the dispatch's exception mechanism to
settings users.
As the asset bundles files are served through the use of these special
ir.attachment, we make sure to retrieve only ir.attachment records
created by the superuser in the `get_attachment` method.
As website administrators often need to play with these special
ir.attachment, we also let to this group the permission to manage them.
[1] 61065b6d04
Facing the following cases, only the database admin can merge res_partners:
1. The email addresses are different.
2. The origin contact(s) is (are) linked to some account move lines.
This commit adds a kwarg in the merge function. This argument allows to skip the two tests.
So they can be bypassed when overloading the function (depending of the current user access
rights for instance) in order to merge partners even if they have different email addresses
or with account move lines on the origin one.
It can also be called programatically and bypass the checks.
This commit also makes the merge wizard correct any inconsistence in the
allowed companies/currency company of the merged contacts and the
related user(s).
Closes#24376
Refactoring of qweb to call _post_processing_att for each nodes. This
change remove the crappy ovewrite in website module. The website overwrite
only the _post_processing_att to add the cdn parameters.
The static node (without t- attributes) can stay static (remove overwrite
of _is_static_node), the cdn is applied at the compile time for this
nodes instead of at the running time like the dynamic node.
- Each time we check if a session is valid we create a new cursor.
This could lead to issues with db_maxconn that limits the number of
connections to the postgresql server.
In a perfect world, a worker should use a single connection to
postgres to process the request.
The only known side effect is that the cursor is created earlier in
the execution of the code.
- This commit fixes issues with the longpolling raising
Psycopg2.PoolError exceptions on databases with a lot of clients.
With saas-11.2's 3fbd86b some trigger towards other fields are improved
but this caused an issue when a inherited field towards a custom
computed field had no depends.
When we created a computed field x_custo on res.partner, we have a
inherited x_custo on res.users automatically created.
Both these fields have a depends computed to `('',)`, this caused an
error for the one on res.partner: but this was ignored with dd048ae7.
Since saas-11.2's 3fbd86b this also caused an error on the inherited
field but since an inherited field is not "manual" the error was not
ignored. Thus it was not possible to create custom field on a model
inheriting of another model if the fields had no depends.
opw-1854786
closes#25146
Co-authored-by: Raphael Collet <rco@odoo.com>
The field was already declared in base but added in the view in point_of_sale
only.
Remove the duplicated field definition on the model.
Closes#25070Fixes#13544
Before this commit, if a SyntaxError or any other exception occurs in a
qweb attribute, and the path to the node contains at least one
namespaced tag, e.g.:
<mynode:node xmlns:mynode="http://example.com/mynode">
<field t-att-value="'This is a TypeError' + []"/>
</mynode:node>
the following exception is raised, instead of the actual one:
lxml.etree.XPathEvalError: Undefined namespace prefix
After this commit, if the path to the failing node contains a namespaced
tag, the node is not retrieved, to avoid the above exception, So this
one will be raised:
Error to render compiling AST
TypeError: Can't convert 'list' object to str implicitly
Template: module.template_name
Path: /templates/mynode:node/field
In addition, a test case was included, to ensure this works as expected
Closes#24824
opw-1853232
kujiu