*: im_livechat, website_livechat
Access right should be based on channel type and membership instead.
Chat always private, group always private, channel private should
disapear and be a group instead (migration needed), and other channel
always public (but they can still be further restricted with
the "allowed groups" feature)
task-2632861
closesodoo/odoo#90415
Related: odoo/enterprise#30980
Related: odoo/upgrade#3850
Signed-off-by: Sébastien Theys (seb) <seb@odoo.com>
* = bus, hr_holidays, test_discuss_full
- use channel member instead of partner for typing
- use channel member instead of partner for all other return values from server
- remove temporary partner hack in livechat and keep public partner
- remove some obsolete convert data
- adapt format methods accordingly
task-2664853
closesodoo/odoo#98923
Related: odoo/enterprise#30760
Signed-off-by: Alexandre Kühn (aku) <aku@odoo.com>
Purpose
=======
Move the code which updates the mail message from the message model to mail
thread. Most other thread methods (like `_message_update_content_after_hook`)
are defined at record model level. It makes sense to delegate the update to
documents and not to the message. Message is a low-level technical object
that should not really hold business code.
While modifying this code, an update is done in the update content. We now
also allow to update the body without removing all attachments.
Finally tests are added as this feature was added without really testing
model code.
Task-2207626 (Rating: Delay rating notification to ease feedback)
Part-of: odoo/odoo#95623
Co-authored-by: Thibault Delavallée <tde@odoo.com>
*: hr_presence, web_editor.
This commit is part of the websocket integration in Odoo.
It focuses on adapting the bus to support websockets:
- last notification id is now kept on the server
- channel list is built by overriding the `_build_bus_channel_list`
method of the `ir_websocket` model instead of overriding the `_poll`
method of the bus controller.
- The bus presence was updated during polls, since there is no more poll,
bus presence update will be the responsability of the client.
- The `/websocket/peek_notifications`, `/websocket/update_bus_presence`
routes will be available so that odoo sh can access notifications/update presence
from http requests.
- /longpolling routes are now prefixed with /bus thus won't be redirected to the
gevent worker anymore except for `/longpolling/health` which is the
health check route of the gevent server.
Since websocket now handle incoming messages, a way to manage authentication
have been introduced :
- The session is retrieved from the HTTP handshake.
- When a websocket message comes/leaves the session is retrieved
on the file system so that we're sure it still exists and that
it is up to date.
- The session is checked
- If no session is found on the file system or `check_session`
fails, the websocket connection is closed with the `SESSION_EXPIRED`
close code (which is a custom close code: 4001).
- Note that websocket connections are closed every `KEEP_ALIVE_TIMEOUT`
seconds to ensure no websocket connection will stay open if the user
clears its cookies.
- Note that a wsrequest object is available when processing incoming
messages. It is similar to the http request and contains various
useful informations (session, env, ...).
Part-of: odoo/odoo#75510
* = calendar, im_livechat, rating, snailmail, test_discuss_full, test_mail,
website_livechat
Distinction between "replace" and "insert-and-replace" can be guessed based on
the type of the provided data.
task-2957295
closesodoo/odoo#98404
Related: odoo/enterprise#30580
Signed-off-by: Alexandre Kühn (aku) <aku@odoo.com>
This removes an extra request, targets fetched messages more reliably and
simplifies the code.
task-2847909
closesodoo/odoo#96840
Signed-off-by: Alexandre Kühn (aku) <aku@odoo.com>
* test_discuss_full
channel invitation to rtc calls are now using the `ChannelMember` and
`mail.channel.partner` models instead of the `partner` and `guest`
models.
part of task-2692836
closesodoo/odoo#95898
Signed-off-by: Sébastien Theys (seb) <seb@odoo.com>
Steps to follow:
On a runbot,
- Login as Mitchell Admin
- Set the Administration permission of Marc Demo to Access Rights
- Login as Mark Demo
- Go to the Discuss App
- Edit a message from someone else by clicking on the pencil
-> A Traceback occurs
Cause of the issue:
- The pencil button is only displayed for another user if the logged in user
is admin. This is done by checking if the user is superUser or if he
has the group `base.group_erp_manager`
This is the case here
- When editing the message, the `base.group_system` is checked.
In this case, it is not present.
Solution:
Check the `base.group_erp_manager` in both cases
opw-2892740
closesodoo/odoo#95502
X-original-commit: bd8ed439d1d9342b24926eee332e8c26c6f0cd7c
Signed-off-by: Sébastien Theys (seb) <seb@odoo.com>
Signed-off-by: Hubert Van De Walle <huvw@odoo.com>
Observed Behaviour
When assigning someone to a task (in project), the employee
will receive a link be email. If he opens this link in a
browser where he isn't already logged, he will be redirected
to the logging page and, after have successfully logged in,
he will be redirected to the Odoo mail module
Expected Behaviour
After a successful loggin, the user should be redirected to
the task view
Reproducibility
This issue can be reproduced with the following steps:
1. Connect as Mitchell Admin
2. Go to the project module
3. Create a new task and assign it to Marc Demo
4. Go to Mark Demo's email and open the related mail
5. Open the link in the mail in an incognito window
6. Log in as Marc Demo
Fix Description
The issue is coming from the fact that, when no user is
logged in and if the url isn't public, we redirect the
url to the connection page without ensuring we have the
correct redirection after the loggin. This is fixed by
editing the url to web/login?redirect= + target url
Related Issues/PR
opw-2802439
closesodoo/odoo#93091
X-original-commit: 0b9d49f33713fc2d5a76f25523f2d4bb5ddb3b44
Signed-off-by: Thibault Delavallee (tde) <tde@openerp.com>
Access `/web/image/82303?height=16`, traceback because the placeholder
image cannot be resized to `"16"`.
closesodoo/odoo#92891
Signed-off-by: Julien Castiaux <juc@odoo.com>
Purpose: Before it was hard to view expense attachments from sheet record.
To do so, the user should have gone through clicking on each expense first and
checking attachments, or could have clicked on a attachments smart button on embedded
expense table, which is redirecting to another view that only displays attachments for the one expense only.
Thus, checking all the attachments from sheet was an tedious task.
After this commit, the user can see in the sheet attachment preview all the associated expenses' attachments.
To make it possible, we ovveride 'mail.thread' method that is called to
fetch the data for the chatter. In the override, we fetch extra, associated expenses' attachments.
task - 2320177
closesodoo/odoo#92724
Signed-off-by: Kevin Baptiste <kba@odoo.com>
Rationnals
----------
Web servers can serve some resources (e.g. static files) right away
without any interaction with the web application. The network model of
most web servers makes them capable of handling thousands of
simultaneous requests when it comes to intensive IO operations such as
streaming data from a file. The network model of Odoo is different: it
is capable of a lot of processing power but can only serve a handful of
requests at a time, i.e. Odoo (with some help from postgres) is
optimized for CPU operations, not IO.
Some users don't configure their web server, they use a basic
configuration that relay all requests to Odoo. The result is that many
Odoo HTTP Workers can be busy streaming static files instead of
processing other requests. This can lead to a worker starvation, i.e.
all workers are busy streaming files and cannot process new requests.
X-Sendfile
----------
In this work, we add the support for the [X-Sendfile] header family,
they are multiples http headers that can be used by the web application
to communicate with the web server in order to delegate the delivery of
files stored on the file system. Odoo still receives the request but it
does no more stream the file content from within its HTTP worker,
instead it skips the response body altogether and sets the `X-Sendfile`
special header with the path of the file on the filesystem. The web
server intercepts that special header, open the file and stream it.
Using those headers, we can use the best of both the web application and
the web server. The web application is still responsible to locate the
resource and verify the access rights, the web server is still
responsible of streaming the content.
Using X-Sendfile is opt-in via the `--x-sendfile` CLI flag. We set both
`X-Sendfile` (apache) and `X-Accel-Redirect` (nginx). If you are using
apache, make sure `mod_xsendfile` is enabled. If you are using NGINX
you have to add the following location block:
location /web/filestore { # custom path, hardcoded within Odoo
# Prevent access from the outside world, i.e. makes this
# route only accessible via X-Accel. MANDATORY!!!
internal;
# Give access to the filestore using this server's
# permissions. Odoo is in charge of verifying the access
# rights.
alias /path/to/odoo/data-dir/filestore;
}
The Odoo [deployment documentation] has been updated accordingly.
[X-Sendfile]: https://www.nginx.com/resources/wiki/start/topics/examples/xsendfile/
[deployment documentation]: https://www.odoo.com/documentation/master/administration/install/deploy.html#serving-static-files-and-attachments
Changes to the API
------------------
To benefit most from X-Sendfile, all APIs related to streaming content
over HTTP has to be adapted. They are: (1) `request._serve_static`,
(2) `ir.http._serve_fallback`, (3) `/web/content` and (4) `/web/image`.
Each used it own way to deliver content: (1) `_serve_static` was using
`send_file` (flask's send_file that as been vendored with odoo 10
years ago and not maintenained since then), (2) _serve_fallback was
handcrafting a `werkzeug.wrappers.Response`, (3) /web/content-image were
using the "binary server" `ir.http.binary_content` API.
I has been decided to remove all 3 APIs and to merge the code inside of
the new `http.Stream` object and the `ir.binary` helper model.
A Stream wraps what is going to be sent to the browser, it can be a path
to a file on the locale filesystem, a blob of raw data or an URL to an
external resource. The Stream also holds various metadata that are
mainly used for caching. The preferred way to create a Stream is via one
of its three factories so that all the metadata are set. The factories
are: `from_path`, `from_attachment` and `from_binary_field`. A stream
instance exposes a single method `get_response()` used to create the
corresponding HTTP response object out of the stream.
Inside of `ir.http` were a few methods that were not related to the http
routing and formed what was called the "binary server". All those
methods have been removed and the feature have been refactored inside of
the new `ir.binary` model. The removed methods are:
- `_xmlid_to_obj`
- `_get_record_and_check`
- `_binary_ir_attachment_redirect_content`
- `_binary_record_content`
- `_binary_set_headers`
- `binary_content`
- `_response_by_status`
- `_get_content_common`
- `_content_image`
- `_content_image_get_response`
- `_placeholder_image_get_response`
The new `ir.binary` abstract model exposes the following utilities:
**`_find_record`**
Find an attachment or a record with a binary-field out of an xmlid or
out of a pair record-model/record-id. Check the access rights and the
access token.
**`_get_stream_from`**
Create a Stream from an attachment or a record with a binary-field.
**`_get_image_stream_from`**
Same as `_get_stream_from` but adapted for images. It sets a sensible
ETag on the stream and has image resizing support.
**`_placeholder`**
Get the image placeholder blob.
Testing
-------
It is possible to test the web server configuration using the
`test_http` module. Install the module then run the unittest using the
`webserver` test-tag. By default it attempts to connect to a web-server
running on `http://localhost:80`, you can change this URL by setting the
`WEB_SERVER_URL` environment variable.
odoo-bin -i test_http --stop-after-init
WEB_SERVER_URL='http://localhost:80' odoo-bin --test-tags webserver --stop-after-init
closesodoo/odoo#88134
Task: 2801675
Related: odoo/documentation#2083
Related: odoo/enterprise#26191
Signed-off-by: Julien Castiaux <juc@odoo.com>
Purpose
=======
Change all masculine nouns in Odoo's code to neutral nouns (when
possible), making sure that demo data is correctly handled. This is
particularly important since our code is open source, and nowadays lots
of machine learning models are trained on open source repositories.
With this small change we contribute to training more "fair" models, and
teaching models that "employee" or "user" != "he".
This also affects some text visible by the user, hence making it more
inclusive for Odoo users.
Task-2853046
closesodoo/odoo#91292
Related: odoo/enterprise#27302
Signed-off-by: Thibault Delavallee (tde) <tde@openerp.com>
Fix errors when adding attachment to records with read only permission:
Current behavior:
1. Error adding attachment to records with read only permission.
2. The message is not as clear as version 13.0
closesodoo/odoo#88036
Expect: Only display the message "You are not allowed to upload an attachment here." if you do not have permission to upload files.
X-original-commit: 8385f192873cfd33f311e00d9074571f1b3810a7
Signed-off-by: Sébastien Theys (seb) <seb@odoo.com>
Commit "[IMP] core: don't save visitor default session" moved the geoip
from the session to the request with a deprecation warning. This commit
adapts the remaining modules to use `request.geoip` instead of
`request.session.geoip`.
Geoip is always set on the request but it can be an empty dictionnary in
case the geolocalization failed.
closesodoo/odoo#86015
Task: 2789035
Related: odoo/enterprise#25192
Signed-off-by: Julien Castiaux <juc@odoo.com>
The odoo.addons.web.controllers.main python module have been splitted
over multiple files on the basis 1 controller = 1 file. In this work we
adapt all modules to use the new imports.
A non-exhaustive list of where stuff have been moved:
* main.Home --> home.Home
* main.Session --> session.Session
* main.WebClient --> webclient.WebClient
* main.clean_action --> action.clean_action
* main.ensure_db --> home.ensure_db
The complete list is accessible in odoo.addons.web.controllers.main.
closesodoo/odoo#87571
Related: odoo/enterprise#25746
Signed-off-by: Raphael Collet <rco@odoo.com>
Before this commit, if the user has read only access to a record:
- User could see 'Add Followers' button, which raised AccessError
- User could see edit and remove icons but performing these actions
for followers other than one related to logged in user, it also
raised AccessError.
With this commit, we are restricting it based on the user rights, if
the user has read only access to a record:
- 'Add Followers', subtype edition(pencil icon) and follwer removal
buttons will be visible only for the follower related to logged in
user, not for others. This way we can avoid the unexpected
AccessErrors.
Note that if user is having write access for the record, nothing
changes.
task-id-2447776
closesodoo/odoo#70575
Signed-off-by: Thibault Delavallee (tde) <tde@openerp.com>
Before this commit:
When user shares the invitation link of the channel(groups restricted), guests
are allowed to access it.
After this commit:
Guests will not be allowed to access channels that are restricted to groups.
Task-2679184
closesodoo/odoo#87004
X-original-commit: ea3232c111546ec636f543db912bf0e2a7ed345b
Signed-off-by: Sébastien Theys (seb) <seb@odoo.com>
Before this PR, only author of the message and admin could delete attachments
inside the chatter.
This behavior is now restricted to the channels and allow users to delete
attachments inside the chatter.
task-2753295
closesodoo/odoo#86302
X-original-commit: 5934dc08b32b422a11324743148083d4daa34350
Signed-off-by: Sébastien Theys (seb) <seb@odoo.com>
*: hr, hr_holidays, im_livechat, mail, snailmail, test_mail, website_livechat,
website_slides.
This commit will remove the need to duplicate models definition for
test purposes. Indeed, for now, we need to mock the model definitions
on the client side. Those models definitions are often very different
from the ones found on the server.
This approach will allow us :
- to ease model definitions during tests
- to get closer from the real models
task-2767820
closesodoo/odoo#84828
Related: odoo/enterprise#24486
Signed-off-by: Sébastien Theys (seb) <seb@odoo.com>
When chatter information is retrieved but current user has no access to website visitors, an access error is raised and chatter messages are not displayed.
To replicate:
- Enable livechat for current website
- Set user A as member of the livechat
- Log-in with user B, who doesn't have access to website visitors
- Visit any page that automatically opens the livechat with user B (no
need to input anything, as a livechat is created when the chat window
pops up)
- Go to backend with user B
To solve the above, visitor information is included only if current user
has enough right to access it.
closesodoo/odoo#84823
X-original-commit: 7fb23842ef2e2950466f44b18005d27443d292f9
Signed-off-by: Sébastien Theys (seb) <seb@odoo.com>
With a recent commit[1], we now gather the chatter related data with a
single controller ('/mail/thread/data') which was a bit scattered
previously. With this controller, instead of searching in dedicated
model, we now simply use the main document/record itself and it's
fields whenever possible. For example, previously for the followers,
we used to search data from 'mail.followers' model, but now we simply
use `message_follower_ids` field of the record itself.
The problem with this approach is, if the record is archived, we won't
be able to fetch the related data. That leads to empty follower list/
activities and a trackback while getting suggested recipients.
This commit fixes the issue by loading the record even if it's
archived, and thus fetching the data required by chatter.
commit[1] - https://github.com/odoo/odoo/commit/e0913197ac84b25b40e7599a6432362141d104c9
TaskID-2748030
closesodoo/odoo#83731
Signed-off-by: Sébastien Theys (seb) <seb@odoo.com>
Purpose of this commit is to make ``get_access_action`` private as it is not
necessary to expose it directly. Website management is also made explicit
using a ``force_website`` parameter instead of relying on context key of the
same name. This allows to better understand the method code flow.
Contains also some code fix / improvements :
* Website forum: update code to better skip the frontend redirection if the
forum is not active and frontend is not forced;
* Website slides: respect force website parameter in redirection;
Task-2710804 (Mail: Clean Mail.Thread API)
Part-of: odoo/odoo#82167
Before this commit:
Attachment viewer not working for other types than the image for guest.
After this commit:
Attachment viewer will work for guest.
Task-2664816
closesodoo/odoo#80686
X-original-commit: 7bb5776d2108a20d248f98f2741be92e1bc9de50
Signed-off-by: Sébastien Theys (seb) <seb@odoo.com>
Since https://github.com/odoo/odoo/pull/73689 all internal users are no longer
known at init. Unlike what was stated in the corresponding PR, the code of
mentions wasn't actually good enough to allow it without any drawback.
This PR fixes the issue by prioritizing internal users on the result of the RPC.
As a bonus the internal user state is immediately returned when fetching
followers, which allows mentions to be accurate even before the RPC is done.
task-2695224
closesodoo/odoo#80645
X-original-commit: 86de2f231be87b289deb85c3b20b93d890cce918
Signed-off-by: Alexandre Kühn (aku) <aku@odoo.com>
* = auth_signup, calendar, im_livechat, snailmail_account, survey, test_mail,
web_editor, website_crm_iap_reveal, website_livechat
The aim of this PR is to improve/fix various flaws and limitation of the current
API, to make it easier to use and more efficient.
Notification are now defined with 3 distinct parts:
- the channel determines which client(s) should receive it
- the type determines how it should be handled
- the payload determines any extra information helpful for handling it
Channel
=======
Business code
-------------
- Record channel is introduced for ease of subscribing to and sending
notifications to specific partners, channels, documents, ...
- String channel is still supported (but it is converted internally to the tuple
channel).
- Tuple channel is still supported without any change (but should be avoided
whenever possible due to its complex syntax).
The channel is no longer sent to the client. When the channel was used for
business purpose, the information it contained has been moved into either the
new type, or the payload itself.
Technical note
--------------
All channels are now internally converted to the tuple (db, ...) channel, which
is necessary for the platform code (saas/sh).
Internally, the bus.bus table is not changed, type and payload are grouped
together into what was (and still is) called message.
Type
====
Type is introduced to uniformize the way notifications are sent and handled.
All existing notifications already had some kind of manually-built type in them.
This is now officially supported at the bus API.
In client code this will allow (to be done in future commits) to register one
handler per specific type, instead of having to iterate and to filter all
received notifications on every handler.
Payload
=======
Payload (ex message) did not change, it can still be anything depending on
business needs.
Few adaptations:
- When the type was included on the payload, the type has been moved to the new
type parameter.
- When the channel was used in business code, its data has been copied into the
payload.
task-1891151
closesodoo/odoo#79201
X-original-commit: 543af27c7d6836ffac9e80ff8490b6ddbd849221
Related: odoo/enterprise#21998
Signed-off-by: Sébastien Theys (seb) <seb@odoo.com>
Before this commit, the server could return outdated information to the
client about the state of their own rtc session.
The server should not return information about the client's own rtc
session as the source of truth is the client-side state.
A case in which this was causing an issue was when a user toggled their
mute state right before their client pinged the server and received
outdated session information before their most recent state could be
sent to the server.
This commit fixes this issue.
closesodoo/odoo#78028
X-original-commit: fe991edd2bca98b58fc5a49494871475c79bc22f
Signed-off-by: Sébastien Theys (seb) <seb@odoo.com>
This commit adds a feature where users can reply to messages of other
users, doing this will show a reduced version of the message that has
been replied to above the message once posted, clicking on this reduced
version will scroll to the original message and highlight it if that
message is already loaded.
task-2362251
closesodoo/odoo#77941
X-original-commit: cec2e69e832072dd699274187ddfa122e29d03f3
Signed-off-by: Sébastien Theys (seb) <seb@odoo.com>
Signed-off-by: Samuel Degueldre <sdegueldre@users.noreply.github.com>
Before this commit, when an attachment is deleted, there is no notification and
other client do not update the attachment status.
task-2635516
closesodoo/odoo#77937
X-original-commit: aa4d7920574852d0543e22a30fc686a7d41f9867
Signed-off-by: Sébastien Theys (seb) <seb@odoo.com>
This commit will display the name of the current guest in the thread
view top bar and make it editable.
closesodoo/odoo#77936
X-original-commit: 659c6a83245a396054cf26c204a7fc72fbbb971f
Signed-off-by: Sébastien Theys (seb) <seb@odoo.com>
Click on an attachment from a public thread view will now open it in an
attachment viewer.
closesodoo/odoo#77932
X-original-commit: 550dc40b022cd3b11440a1767df4d857d9fd12a9
Signed-off-by: Sébastien Theys (seb) <seb@odoo.com>
Post a message in the channel each time a guest is added to members of
the channel.
closesodoo/odoo#77915
X-original-commit: bf6af9b629a07d04bf582987b5144a37fa31729e
Signed-off-by: Sébastien Theys (seb) <seb@odoo.com>
* = test_discuss_full
Before this commit if 2 persons are joining the call at the exact same time, the
join RPC of each will return the list of RTC sessions without the other person
included.
In more general terms, the server should actually rarely send the full state to
the JS (in this case "use the replace command") because there is no guarantee
that a concurrent transaction is not changing the data at the same time. In
other words, even the python is actually working with partial knowledge
relatively to the database.
Using a DB lock would guarantee it, but we don't want to lock tables and wait on
locks if there are alternatives. In this case it is acceptable to keep obsolete
sessions for a little bit longer, as long as they are cleared eventually.
closesodoo/odoo#77656
X-original-commit: d3a84172fc78f5783f75aa1155f1a25e4f9614b7
Signed-off-by: Samuel Degueldre <sdegueldre@users.noreply.github.com>
Signed-off-by: Sébastien Theys (seb) <seb@odoo.com>
Update a specific flow to ensure the record on which session_info is
called has guest in its context. This is needed because session_info
performs some checks on guest to determine if it should add translations
data.
closesodoo/odoo#77433
X-original-commit: bd0940cdbf43131ed8436a5deb3f8afebfbc37ab
Signed-off-by: Sébastien Theys (seb) <seb@odoo.com>
This commit will merge welcome and thread views in the same route and
template. The aim is to make the user interacting with the page (by
landing them on the welcome view first) so that the browser allows the
page to play audio and to switch to full screen.
closesodoo/odoo#77381
X-original-commit: 97ed683e3e7cc6b340bb78c4faa01a703a573f32
Signed-off-by: Sébastien Theys (seb) <seb@odoo.com>
This commit allows anyone to create a new mail.channel by visiting the
URL /chat/<token>[/<channel_name>], providing that the
mail.chat_from_token system parameter is set. This is useful in some
situations where new channels need to be created quickly as needed by
anyone without special permissions (eg, during the Odoo experience)
task-2648580
closesodoo/odoo#77010
X-original-commit: 56ddc073213a148579dd72f4a9336bc4d6a11f22
Signed-off-by: Sébastien Theys (seb) <seb@odoo.com>
Signed-off-by: Samuel Degueldre <sdegueldre@users.noreply.github.com>
Before this PR, the RPC to notify peers was called too much time too quickly.
Reducing request overload significantly improves the overall connection time.
closesodoo/odoo#76625
X-original-commit: f4c1d974b5d55868f81cd3259c45e83d934686f5
Signed-off-by: Sébastien Theys (seb) <seb@odoo.com>
Zelong Lin