Since [1] when the translations were converted to jsonb, when
translations are saved, the actual `ir.ui.view` is saved (instead of a
translation record like before). Because of this, the copy-on-write
mechanism of `website` kicks in and unneeded website-specific views are
created.
This commit disables the copy-on-write mechanism during the update of
translations in views.
Steps to reproduce:
- Install `website_sale`.
- Install a second language (e.g. French).
- Go to a single product's website page in the second language.
- Translate the "ADD TO CART" button.
=> Many website-specific views were created.
[1]: https://github.com/odoo/odoo/commit/4e82c45abdb0b420edead2bd1d0ba9ff4bb4a224
task-3225622
closesodoo/odoo#117256
X-original-commit: 1bf7e2322d22aeef30097a1d19848ff351bc83f9
Signed-off-by: Quentin Smetz (qsm) <qsm@odoo.com>
Prior to this commit, when using a background video on the cover of the
website_slides homepage (/slides), after saving, a traceback would
occur and the video would not be displayed.
Steps to reproduce:
- Install website_slide
- Go to /slides
- Enter edit mode
- Change the cover of the page by a video
- Save
- Traceback
The reason for that is that the cover snippet used on the homepage of
elearning is the root of an XPath instead of its own oe_structure. (This
was changed in 16.0)
[1] made it so that the style and class attributes are saved but did not
save any data attributes needed for the background-video widget to work.
This commit adds those data attributes.
[1]: https://github.com/odoo/odoo/commit/5b252215dc375526af87c31a32256dd1a9582f02
opw-3063043
closesodoo/odoo#107577
X-original-commit: 86dc4d4349d033c95c0e04e8c173f63e5e2044ed
Signed-off-by: Romain Derie (rde) <rde@odoo.com>
Before this commit, `view_hierarchy` extended the QWeb view to see
the hierarchy of views.
With the evolution of the javascript framework, this use case has
now more sense in a client action rather than an extension of a
QWeb view.
This commit refactors `view_hierarchy` into a client action.
Part-of: odoo/odoo#103477
Just a nice to have. It will prevent those errors to be replicated when
copy pasted and will help reading the files in the IDE.
closesodoo/odoo#97282
Signed-off-by: Romain Derie (rde) <rde@odoo.com>
When both a specific inheriting view and a non-specific base view are
written simultaneously, the specific inheriting base view must be
updated even though its id will change during the COW of the base view.
This commit sorts the list of written views in order to first handle the
website-specific ones then the base ones which might change some of the
ids of the already updated view.
Steps to reproduce in 14.0+ (no scenario found in 13.0):
- Create a new website.
- Configure the language selector layout to "Inline".
- Configure the language selector layout to "None".
=> Error notification was displayed and change was not applied.
task-2885882
closesodoo/odoo#96248
X-original-commit: 317eea48186c948009399daedf70dd407f6a9ca8
Signed-off-by: Romain Derie (rde) <rde@odoo.com>
The goal of this commit is to add options to manage website pages as in
frontend page manager using list view.
- The click on list view item will redirect iframe to the targeted page.
- The Page Properties dialogs (DuplicatePageDialog, DeletePageDialog)
are used to clone/remove pages.
- The pages listView is loaded using the current website domain.
See merge commit for more information.
task-2687506
Using lazy values allows you to not do query when the content is not
displayed or if it is already cached. Adding `t-cache` only reduces
render time, but combining it with lazy values saves browses, computes
and query.
Thus for the `/shop` page the page is displayed in 60ms (before: 250ms).
Part-of: odoo/odoo#88276
Refactor the `load_views` API so it no longer sends multiple times the same
fields description.
e.g.
When `load_views` is called to get the kanban, tree and form views,
the list of fields of the model was sent 4 times:
- Once for each view, with only the fields used in the view,
in `['fields_views']['kanban']['fields']` for instance
- Once globally, with all the fields of the model, in `['fields']`
The goal of this revision is to change that so it sends the list of all fields
only once.
In addition, if a view contains x2many fields,
the fields description of the comodel is also sent.
It was sent in the `views` key of the view fields dict.
e.g.
When calling `load_views` of `res.partner` to get the kanban,
tree and form views,
the `res.partner` fields description was actually sent 6 times:
- Once for each view
- Once globally
- Once for each view of the many2many field `child_ids` of the form view, in
- `['fields_views']['form']['fields']['child_ids']['views']['kanban']['fields']`
- `['fields_views']['form']['fields']['child_ids']['views']['form']['fields']`
The change suggested in this revision is to:
- Remove the fields description for each view in `['fields_views']`.
As it no longer contains the fields,
the key becomes `['views']` instead of `['fields_views']`.
- Replace the dict key `['fields']` by `['models']`,
which is a dict with as key the model name and as values
the model fields description. It contains the fields description
for all models implied in the view:
the model of the main view and the model of all one2many and many2many fields.
With this change, the fields description will only be sent once by model
implied in the view.
In addition, the web client was getting the information about the fields
sometimes in the global fields description list (e.g. `['fields']`),
sometimes in the fields description list of the view type
(e.g. `['fields_views']['form']['fields']`),
making it a pain to try to make changes / performance gain
in these field description dictionaries, because you never knew in which dict
the web client was getting its info.
Now, as there is only one place to get the fields description from,
it's clearer and cleaner.
- one2many and many2many fields views are passed directly in the main view
architecture rather than being put in the `views` key
of the field description.
This is actually easier to treat by the web client,
and this will allow in a future work to cache an entire view in one block
of text rather than having to combine multiple cached blocks of text
to return one view.
- one2many and many2many fields which do not have directly embedded views
have their views directly injected in the architecture,
so the web client doesn't have to do RPC calls to `load_views`
for each one2many and many2many fields not having embedded views.
For instance, this allow to reduce the number of RPC calls to `load_views`
from 8 to 1 when loading the form of `product.product`.
Currently, this behavior is limited to 1 level deep but we consider making it
go all the way down in future works. We did not do it for the moment because
in certain cases it rises the processing time and the size (bytes) too much.
e.g. the sale.order view can be 5 levels deep,
meaning you can reach 4 dialogs on top the main view.
```
sale.order form > order_line > sale.order.line form > invoice_lines >
account.move.line form > asset_ids > account.asset form >
depreciation_move_ids > account.move form.
```
This will also benefit in future works to cache an entire view in one block
of text rather to having to combine multiple cached block of text
to get one view.
- `fields_view_get` becomes `get_view`.
As it no longer returns the fields description,
keeping the `fields` in the name `fields_view_get` no longer makes sense.
Hence removing `fields` from the method name, it becomes `view_get`.
As it gets renamed anyway, we take the opportunity to rename it `get_view`,
which is more in line with the general getter/setter guidelines
in the model object world.
- `_fields_view_get` becomes `_get_view`. For the same reasons than above.
- `load_views` becomes `get_views`.
This is not mandatory, there is no technical reason to rename `load_views` as
it practically sends the same info as before,
the view architectures and their fields description. Just in another way.
We just take the opportunity of this pull request to suggest a cleaner API:
`_get_view`, `get_view` and `get_views`.
- Arguments `toolbar=False, submenu=False` fo the methods
`_fields_view_get` and `fields_view_get` are converted to a kwargs `**options`
in `_get_view` and `get_view`.
The rationale is that submenu was already no longer used (deprecated)
and the mobile options is introduced.
The mobile options is necessary to tell the server to send the mobile views
for x2many fields (kanban instead of tree).
Instead of adding a new argument each time we add a new option to
`fields_view_get`, it seems wiser to have a kwargs `**options` to avoid
to re-write all overrides each time a new option is introduced.
- `_fields_view_get` returned a dict containing the arch in text and some of the
view information. Now, `get_view` returns a tuple with the view architecture
as an `etree` node, and the view as a browse record. The rationale is that all
overrides of `_fields_view_get` were about modifying the arch only
(e.g. changing the address format/re-organizing the address related field
nodes of the partner according to the company country).
To do so, all these overrides were doing `etree.fromstring` to parse the arch
which was sent in text to convert it to an `etree`,
then operations were done on the `etree`,
and then `etree.tostring` was called to convert back the arch to string.
With this change of signature to send the arch as an `etree`,
all these back and forth `etree.fromstring` -> `etree.tostring` are avoided,
allowing some performance gain and less code in the end.
- A cleanup of the keys returned in the dict of `fields_view_get`
has been performed in `get_view`:
- `fields` is removed, as explained above,
- `view_id` is renamed `id`,
- `name` is removed, it was unused by the web client,
- `type` is removed, it was unused by the web client,
- `field_parent` is removed, it was unused by the web client,
- `base_model` is removed, it was unused by the web client.
- `filters` is moved from the global dict returned by `load_views`
(now `get_views`) to the dict returned by `fields_view_get` (now `get_view`)
as it applies only to the `search` view type.
- Retro-compatible methods for the 3 methods
`fields_view_get`, `_fields_view_get` and `load_views` are provided,
with deprecation warnings in them.
- The web client could cache the model fields description
(as it already caches the views),
so it doesn't need to fetch them again if it asks for another view of a model
for which he already has the fields description.
If we do so, `get_views` could return only the list of models used by
the views, without the fields description as of now,
and the web client would then call `fields_get` independently only for
the models for which it doesn't have yet the fields description.
This would avoid the server to return the fields description
and to call `fields_get`, which is costly, for each `get_views`,
therefore gaining performances.
- Inject the views of the one2many and many2many fields all the way down,
unlimited depth level, as explained above.
- Cache with `ormcache` the architecture of back-end views.
This is already done for qweb views, it's not done for back-end views.
Therefore the postprocessing of the views is performed for each `get_views`,
which is costly, while the view architecture doesn't change for users
belonging to the same groups, according to the groups implied by the view.
This pull request is co-authored by
Aaron Bohy (aab) for the web client part and
Denis Ledoux (dle) for the server part.
Part-of: odoo/odoo#87522
There were inconsistencies in the calls to `_render`.
* the view context could contain information that misled developers.
Indeed, the context and value of the view are not supposed to be found
in the rendering. Thus by calling `ir.qweb` with the name of the
template, we ensure that there is no unwanted information and in
addition the cache key is that of the name of the template which saves
a query.
* the context used for rendering was modified by a method on
`ir.ui.view`, except this is not information used by this model. There
is now a `_prepare_environment` method residing on `ir.qweb`. This
method allows to modify the value dictionary as well as the context in
which the rendering will be done. This preparation of the data as well
as my security check is done only once per rendering. This also saves
some queries
* Freeze options for rendering were inconsistent. It could be that
options on which rendering depends were not part of the cache key. Thus,
depending on the user who generated the generation of the rendering
function, there was or was not information in the template. For example
for automatic branding. This is no longer possible, because it is the
context that is used. The options serving as a cache key are only
recorded for information (for the profiling system for example). A
simplification of the `ir.qweb.field` models could be made.
The report rendering and call `ir.qweb` instead of `ir.ui.view`.
Part-of: odoo/odoo#85110
Issue
-----
When website is installed, the rendering of template uses a side effect
of the ORM cache (cache shared between sudoed env vs non-sudoed env) and
the fields prefetching feature to work correctly.
The `self.visibility` in (`_handle_visibility`, website/ir_ui_view.py)
is done in sudo mode, then it will fetch all prefetchable fields and put
them in the cache (that will be read in non-sudo mode in the render of
the template). Another example of issue related to this:
https://github.com/odoo/odoo/pull/83341.
Because of this, the fields of mixin `website.seo.metadata` were forced
to be prefetchable (the default for translate is to be not prefetchable
since https://github.com/odoo/odoo/pull/82896), which causes a useless
LEFT JOIN on "ir_translation" in most of business flow.
Fix
---
Remove the `prefetch=True` on mixin fields, and add a extra read to fill
the cache in case of website rendering. It also allows to read these
fields at the same time.
Part-of: odoo/odoo#85220
Getting the `res.company` record by browsing the `company_id` cached
value from `website` instead of reading it directly on the website
record will avoid a read on the website table.
While this might seems unusual and not elegant, since this is a very
low level method used to render every view, it seems fine.
task-2774979
X-original-commit: bc643a573a7339c82661cbcff2cc59bdd0eec3e3
Part-of: odoo/odoo#85456
Issue
-----
When website is installed, the rendering of template uses a side effect
of the ORM cache (cache shared between sudoed env vs non-sudoed env) and
the fields prefetching feature to work correctly.
The `self.visibility` in (`_handle_visibility`, website/ir_ui_view.py)
is done in sudo mode, then it will fetch all prefetchable fields and put
them in the cache (that will be read in non-sudo mode in the render of
the template). Another example of issue related to this:
https://github.com/odoo/odoo/pull/83341.
Because of this, the fields of mixin `website.seo.metadata` were forced
to be prefetchable (the default for translate is to be not prefetchable
since https://github.com/odoo/odoo/pull/82896), which causes a useless
LEFT JOIN on "ir_translation" in most of business flow.
Fix
---
Remove the `prefetch=True` on mixin fields, and add a extra read to fill
the cache in case of website rendering. It also allows to read these
fields at the same time.
Part-of: odoo/odoo#83818
Before Odoo saas-14.4, one should call `_get_http_domain()` on website to get
its domain. Indeed, that method was in charge of cleaning that domain, as it
was done with commit [1].
Since Odoo saas-14.4, that cleaning is automatically performed on domain before
saving it into database, thanks to commit [2].
Thus, we can now remove the `_get_http_domain()` and use directly the domain as
it is considered clean.
Note that migrated databases coming from version older than Odoo saas-14.4
could still have an incorrect domain (trailing slash, no scheme..).
This will be handled during migration with [3].
[1]: https://github.com/odoo/odoo/commit/3ad775aab717b395a5d11527aeb3596af66afa99
[2]: https://github.com/odoo/odoo/commit/042c95b0219bb0aa13e73385e092fa76ff1a1b0a
[3]: https://github.com/odoo/upgrade/pull/2951closesodoo/odoo#78766
Signed-off-by: Quentin Smetz (qsm) <qsm@odoo.com>
In some case, we know that page will contains dynamic content and that cache
should be ignored.
E.g. as soon as a s_snippet_form will be present in page, we know that we need
the real csrf, and so we cannot use the cached response from another user.
Now, we disable the cache (cache_time=0)
closesodoo/odoo#77935
X-original-commit: 262499a91cc9f2365cf2ff131796d9b61b438f9b
Signed-off-by: Jérémy Kersten (jke) <jke@openerp.com>
The view methods `get_inheriting_views_arch`, `apply_view_inheritance`,
`_apply_view_inheritance` and (previously `read_combined`)
`_get_combined_arch` were complicated and not optimal performance-wise.
The previous approach to retrieve views and combine them was to perform
it recursively, one primary view at a time. This new approach retrieves
in a single SQL query the whole tree of views to combine. The order of
view combination has been reproduced to be fully backward-compatible.
We also introduced various optimisations such as pre-fetching and
caching.
**get_inheriting_view_arch**
The method have been renamed `get_inheriting_views` as it returns a
recordset of views instead of the xml architecture of each view.
During an upgrade, only the views that have been fully upgrade already
are safe to be used. The views returned by the query are filtered to
remove any not-upgrade-yet view. Because this part is highly specific,
it has been isolated in a dedicated private method.
View extensions can be discarded according to user groups. The
retrieval of groups on views is also made by the same query. This
reduces the number of SQL queries, and makes the filtering faster.
**apply_view_inheritance**, **apply_view_inheritance**
The functions were responsible to build a hierarchy of views and to
iterate it to combine the views.
The hierarchy building have been moved to `_get_combined_view` and the
actual combination have been moved to a new method `_combine` and
documented.
Task: 2541579
Meta task: 2463632
Co-authored-by: Fabien Pinckaers <fp@odoo.com>
Co-authored-by: Raphael Collet <rco@odoo.com>
The core website behavior is the COW (copy on write) which makes it possible to
handle multiple websites on a single database.
When you do a CRUD operation on an `ir.ui.view` in a website context, the ORM
normal behavior is bypass to perform special stuff, such as:
- Write: if the view is generic (no `website_id`), we bifurcate the write on
the specific view (same `key` but with `website_id` set). If that
view doesn't exist, we create it and fork its whole descending
hierarchy. This write behavior is known as COW.
- Create: we ensure that view is created only for the website and no other.
Basically we just add a `website_id` to that view, but it might
also be about setting the correct `inherit_id` by finding the
specific view among multiple views with the same `key`.
- Unlink: if the view is generic, we will unlink that view but also create a
copy of that view for every other websites so they remain
unmodified: this is known as COU (copy on unlink).
All those behavior aims to satisfy to the multi website holy grail:
-- Any modification in a website context should never impact another website --
Because of those uncommon behaviors, it is sometimes hard to understand or
investigate a database, as views might be copied, up to the point where there
is multiple whole view hierarchies.
This commit attempts to create an user interface to easily figure what's going
on in a database at an `ir.ui.view` level.
The mains advantages of that new `ir.ui.view` Qweb view is to:
- easily figure which views are COW'd on which website
- easily detect which views have a real `arch` modification
- easily see that `arch` change
Closes#63040
Signed-off-by: Jérémy Kersten (jke) <jke@openerp.com>
Before this commit, only whitelisted fields would be updated on cow views
during a module update.
A field would be whitelisted if he had the same value than the original view,
see it as a heuristic to not write on modified fields.
But `inherit_id` is not that simple, even if the cow view has a different value
than its original view, it doesn't mean it was modified by the user, it is just
because of the cow mechanism that assigned a copied view as inherit_id, which
is just a copy ofthe original one.
We can thus consider `inherit_id` as unchanged and whitelist it if the `key` is
the same.
In practice, it means that cow'd views did not receive the `inherit_id` updates
as in commit https://github.com/odoo/odoo/commit/c8577568a1e39f6692889b3e21652fa3b8df06b2#diff-823e5db841dca1798ff1300e243059a4e1c93343598d2be5a1d1dcd1d2d0c273R537
where `portal.my_account_link` had its `inherit_id` changed from
`portal.frontend_layout` to `portal.user_dropdow`, see https://github.com/odoo/upgrade/pull/2059:
Considering a module update changing `inherit_id` of D from A to B, the
following use cases are expected. Without this fix, D' never move:
CASE 1
A A' B A A' B
| | => / \
D D' D D'
CASE 2
A A' B B' A A' B B'
| | => | |
D D' D D'
CASE 3
A B A B
/ \ => / \
D D' D D'
CASE 4
A B B' A B B'
/ \ => | |
D D' D D'
Opw: 2422773
Opw: 2422727
Opw: 2422770
Opw: 2423406
Opw: 2423859
X-original-commit: ff69f11e9c97d63d9319a8094a87af93984aba38
Steps:
- As admin, go to "Contact us" or any other page on the website (1)
- Go to Pages > Page Properties > Publish
- Change the visibility to Signed In
- Save
- As demo, go to (1)
Bug:
The user "demo" is signed in but is returned a 403 Forbidden
Explanation:
When landing on a page with visibility: 'connected', the only way to see
the page is to have a group matching the groups of the page as seen
here: https://github.com/odoo/odoo/blob/28b748a559e1ffb5fb7c3631bf77adba121b2ebf/odoo/addons/base/models/ir_ui_view.py#L625-L626
This fix lets any connected users see the page.
opw:2431700
closesodoo/odoo#64720
X-original-commit: b02a99bec709b5a6dc4dabb6cb81435dadc24e7e
Signed-off-by: backspac <backspac@users.noreply.github.com>
SOC for ir.ui.view creation. If a view is created without a website_id,
it should get one if one is present in the context. Also check that
an explicit website_id in create values matches the one in the context.
Note: it was already the case but kinda by chance and not entirely
correct. Most of the time, the 'arch' field was specified as a creation
value... and as it is a computed field with an inverse method, a COW
was triggered. But this had also the inconvenient of creating an extra
generic view without any arch.
closesodoo/odoo#43245
Signed-off-by: Quentin Smetz (qsm) <qsm@odoo.com>
*: web_editor, website
In stable versions, [1] was made as a fix to allow access to read
the colorpicker template for mass mailing users when they do not have
the read access right on ir.ui.view records.
This commit, for master, remove the need of using the confusing
read_template method by using render_public_asset instead (thus turning
the read into a render, which is the same for our colorpicker but might
be a change for potential custo). At the same time, this allows to
remove the read_template public method entirely.
Related to task-2412544
[1]: 8af75e00bdcda3d5ff4facd2f5f146e1d6bf79e4
closesodoo/odoo#64100
Related: odoo/enterprise#15580
Signed-off-by: Quentin Smetz (qsm) <qsm@odoo.com>
Before this commit, the time to compute all counters was making the rendering
of the portal page slow.
Now the count is done in rpc after the loading of the page.
Now you can decide which part you want to show on the portal, and only compute
for these one.
It is not because you have purchase installed for your internal process, that
it means that your supplier use your portal and it avoid the computation for
all end users.
We parallelize the counters in arbitrary 3 rpcs.
closesodoo/odoo#55999
Related: odoo/enterprise#12456
Signed-off-by: Jérémy Kersten (jke) <jke@openerp.com>
Before this commit, the template to generate 'New' panel generates .exists()
queries for each env.ref, now only one by module.
We could still improve it, deferring this rendering on click only.
For now, each time you are editor, we render it, even if you don't plan to
create anything.
+ use some xmlid_to_res_id instead of ref to avoid useless exists query.
Courtesy of @Feyensv for the tips
*: website
Since [1], the thumbnails of the saved snippets were not right anymore,
all fallbacking to the default image. This is because snippets thumbs
now use svg files instead of png and the snippet saving feature did not
allow it. This commit fixes that and makes the feature more robust.
- Allow to use any original thumbnail, and not only for website app.
- Remove useless defaut image, a fallback for when the feature is broken
is useless.
- Identify snippets by key instead of by main class (possible since
the new `data-snippet` attribute on snippets).
[1]: https://github.com/odoo/odoo/commit/b7fe2bdae2f45372c0d538767a226a413b806f3fclosesodoo/odoo#55896
Signed-off-by: Quentin Smetz (qsm) <qsm@odoo.com>
When you create an ir_ui_view form the backend, the encrypt function
was called with a Falsy value and crash with error:
TypeError: secret must be unicode or bytes, not bool
Now, when you create view from backend, we only set password if it is a qweb
view. In case of update, the field is dirty, so if you don't update it, it
will be not write.
closesodoo/odoo#53348
X-original-commit: 3d9101db0f7cc0adc1f34721c38b4c2f7089566d
Signed-off-by: Jérémy Kersten (jke) <jke@openerp.com>
Things to know about specific views:
Since the introduction of website specific views, we can have multiple
views that are related to a website (specific views). These views have
no xml_id as it is only set on the original view (generic view).
We rely on the view's key to identify related views as it is the same
for all specific views of a generic view. Also the key is equals to the
xml_id.
When a generic view is updated, we will check if the specific views have
the same values as the generic view. If it is the case, the value that
are the same are considered updatable and are updated on both the
generic and specific view. Else these are considered as noupdate.
When a generic view is created we will check if the potential parent
generic view has specific views. If it is the case we will create a copy
of the created view for each specific view.
The issue:
The method that checks if a created/updated view has specific views is
located in website. When we update a module, each modules are
initialized and updated in a specific order. If a generic view that has
specific views located in a module loaded before website this view's
specific views will not be updated/created as the method does not exist.
This issue is mainly affecting portal views at the moment.
The solution:
For write:
We now COW(copy on write) the views in base module, meaning this will
apply to all qweb views that are duplicated and not only the website
specific ones.
For create:
We will create the generic view as before but wait until we have
updated all the modules to gather all generic views that are supposed
to have a specific view but don't and create the specific views.
This will result in a change of behavior being that if a specific view
that have a parent is deleted it will be recreated on update
(same behavior as a generic view).
closesodoo/odoo#52629
X-original-commit: b1a90ee2bb441aa52e3cf4607c43fb464b55b1d7
Signed-off-by: Jérémy Kersten (jke) <jke@openerp.com>
Signed-off-by: fja-odoo <fja-odoo@users.noreply.github.com>
visibility_group was used for visibility, we now use the groups_id field.
groups_id is a M2M field while visibility_group was a M2O field resulting
in an issue to display the M2M field in the frontend. We decided to
allow editing the groups as a M2O in the frontend. If there is more
than one group the user will have to go through the backend to edit.
task-2264580
closesodoo/odoo#51846
Related: odoo/upgrade#1260
Signed-off-by: Jérémy Kersten (jke) <jke@openerp.com>
This restricts the attributes of a BaseModel instance to `env`, `_ids`
and `_prefetch_ids`. This way, one can only assign fields on a record;
other assignments are programming errors.
This also reduces the memory footprint of records from 168 to 64 bytes
(-62%), and makes their instanciation faster.
closesodoo/odoo#51075
Related: odoo/enterprise#10529
Signed-off-by: Raphael Collet (rco) <rco@openerp.com>
render, render_template, load, activity_schedule_with_view,
get_website_pages should all be private:
It should not be possible to render an aribtrary template only with
its name or id
Still need to render some qweb views from js so the method
render_template is kept public.
This explains why the website editor still need read access on
ir.ui.view as we want to allow any snippet to be rendered.
The method fields_view_get should be the only way to retrieve the view
content. This method is executed in a super-user context.
To avoid retrieving views for a model a user does not have access to
(as it may reveal some informations like name of fields), add a
verification of 'read' rights before retrieving the view content.
Execute _postprocess_access_rights with sudo(False) as this method is
used to evaluate which buttons should be displayed.
Remove the su flag to avoid misleading the user and displaying a
button they won't be able to use.
Retrieving the database id from an view key is not considered as a
sensitive information and get_view_id and viewref can be left as a
public methods.
Add missing sudo when needed
Change _handle_visibility in website to avoid increasing the query
count: Checking the visibility (to fail most of the time) to retry in
sudo was making unecessary queries.
Most of the website rendering process depends of customize_show views which are
part of a configuration setup.
Once it has been setup, it will most likely never change afterward.
It makes sense to orm cache those infos to avoid having to query ir.ui.view
table everytime we render something.
Note that just store basic and small infos used for customize_show case.
task-2211013
Co-authored-by: Romain Derie <rde@odoo.com>
Co-authored-by: Jeremy Kersten <jke@odoo.com>
This commit:
- make handle_visibility a private function (even if not
exploitable in rpc easily since it uses request.website)
- encrypt the password in db (even if not critic, since this
password could be shared on twitter, ... it doesn't cost anything
to secure it a bit more)
- remove useless sudo, since handle_visibility does a sudo itself.
In the future, this notion of visibility should be handled on controller layer,
and no more on the View layer (during rendering)
closesodoo/odoo#48145
X-original-commit: 06e0e48217f25f17dff23331111f5dcb98e8cecd
Signed-off-by: Martin Trigaux (mat) <mat@odoo.com>
Signed-off-by: Christophe Monniez (moc) <moc@odoo.com>
Before this commit, in all cases, we search the backend menu to open if you
click on edit backend menu.
But the backend menu edit is useless for non editor user.
This feature has been introduce in v13, since eLearning have his own apps, so
when you edit in backend, you want to see the slide form view, into the
elearning app and no website App.
Related to #47257
task-2211013
X-original-commit: 1da7e53f4cdd82574688eb62f7a1cb8ddca871e6
The function get_inheriting_views_arch, retrieves the architecture of
views that inherit from the given view. In the case of the module init
is currently in process only views from modules whose code is already
loaded are taken into account.
Before this commit, the function didn't process views that has been
copied (copy on write, web editor, customize show, manual copy, ...),
this raise an error when trying to install a module. For example,
install module website_sale, copy on write the view 'Main layout',
install module website_sale_wishlist.
Now, views that has been copied are also processed.
opw-2181968
closesodoo/odoo#47590
X-original-commit: d5a2890b30f869c9b4cf7aafed0e05aff9440360
Signed-off-by: Jorge Pinna Puissant (jpp) <jpp@odoo.com>
Co-authored-by: Nicolas Lempereur <nle@odoo.com>
Before this commit:
When logged in and navigating on a frontend page, the accessible `ir.ui.menu`
would be loaded in qcontext.
Loading those menus performs alot of SQL request, up to ~2.000 requests on big
databases such as Odoo.com for an user with a lot of access rights.
This is not a problem on low traffic website as this is ORM cached, but when
there is a lot of traffic, the cache is clear very often, thus this code only
is adding a lot of requests for no reason most of the time as the user is just
navigating without any intention of opening the application menu.
Note that this qcontext computation in frontend was pointless in enterprise as
the applications menu in frontend redirect to the backend without using it.
This commit removes that computation from the qcontext. The menus will be
computed and loaded only when the user really needs it, when he is about to
open the application menu.
closesodoo/odoo#46127
X-original-commit: 471ddf85ce619961e46fb281bf721968ff298d3b
Signed-off-by: Romain Derie <rdeodoo@users.noreply.github.com>
* website, mass_mailing, website_event, website_form,
website_mass_mailing, website_sale
Now the user can save snippets to use them on other pages.
task-2120409
closesodoo/odoo#40408
Signed-off-by: Quentin Smetz (qsm) <qsm@odoo.com>
Co-authored-by: qsm-odoo <qsm@odoo.com>
You can use has_group(employee) instead
+ fix enumerate_page: when you search a page with visibility constraints,
you never seen it even if force was set to True.
task-2091365 again
closesodoo/odoo#41483
X-original-commit: f1c7a34f0b8276895c18ca6c450a142f9a815e3b
Signed-off-by: Jérémy Kersten (jke) <jke@openerp.com>
View creation/edition represent a important part of an install and a lot
of possible view errors are not detected, like fields used in domain
filters. Some part of the code a difficult to maintain, and view checks
are splitted in multiple places.
This commit aims at refactoring view validation by regrouping most part
of the logic in ir_ui_view and trying to optimize the overall process.
Since most of the lines were touched, this task was also an opportunity
to modernize the API.
Main changes on method `check_xml`:
- extract node processign and validation to individual postprocessor
- add validation for filter node, buttons, ...
- fix accessibility checks (and improve their performance)
- move xpath check to specific Python node validator
- clarify error messages (wip to continue)
Main changes on method `read_combined`:
- optimize the search for inheriting views in a single query doing the
whole recursive search
Indeed, after removing xpath validations, `get_inheriting_views_arch`
was the most expensive method in `check_xml`, spending most of the time
in `search` because of recursive calls to retrieve children views.
The view Backend Assets is a good example of the latter point, since a
line is added in the view for almost every module. 70 views (community)
are added at first level, `get_inheriting_views_arch` is efficient and
returns all 70 views. Then at the second level, the method
`get_inheriting_views_arch` is called 70 times for nothing. 70 calls to
`search` (squared/2 since each view is checked independently) are almost
useless. The same case applies to the settings view.
As a result, the average module installation time is 25% faster, and the
average time spent in `read_combined` is almost divided by 2.
Before this commit, if you had a page_id set on a menu, and that you
fork this page, the page_id from the menu was always pointing to the
previous one, so you see old page, but edit new page.
> Reproduce:
> Fork Contactus (Page_id on menu become wrong)
> Refresh contact us (done on save btw)
> You see old content
> Edit with Html Editor, you sill see that forked view exists!
Bug was hidden before that we set page_id on menu, but it is needed if
we want to support the groups visibility on the menu item.
closesodoo/odoo#39472
Signed-off-by: Jérémy Kersten (jke) <jke@openerp.com>
Benoit Socias