[MERGE] auth_crypt: Upgrade to pbkdf2_sha512
replace handrolled KDF by passlib (& usage of passlib API)
* replace handrolled KDF by passlib (& usage of passlib API)
* replace md5crypt by pbkdf2(sha512)
- handle upgrade from an old database (rehash on login)
* forward-port encrypt-at-install from f29ff5e
Record values should not be passed by keyword to "Model.create": there
is no requirement or guarantee that overriding methods call the
parameter "vals".
Applies to new and yet-to-be-encrypted users, existing already-encrypted will
keep logging in as usual, their password storage will be upgraded on next
password *change*.
In t-field, datetime fields (formatted and not formatted versions) are
converted to the context/user's timezone (through
fields.datetime.context_timestamp) when displayed, but were saved without
converting back so the next display would go forward (or back) of the user's
tzoffset.
Fix that by applying context_timestamp's conversion backwards, from the
context/user's timezone back to UTC, before saving the field's value.
[IMP] hr_timesheet, hr_timesheet_sheet: merge timesheet and hr_timesheet reports; base report moved to hr_timesheet; hr_timesheet_sheet adds data to the report using inheritance.
Assuming access rights are correctly configured, this allows providing
downloads for any attachment type, not just to display images via
/website/image.
TODO: unify attachment querying, we've got stuff over both web/ and website/
The @groups attribute in qweb views was not rendered (even when matched by the
user), so editing a template with an @groups would either remove the whole
section (if the user didn't have the groups, fixed in previous commit) or only
removed the attribute itself making it visible to everybody (which ought be
fixed-ish by this commit).
If the current view uses @groups attributes (possibly in called templates),
the corresponding elements are rendered to a void (empty string in qweb). If
said user can edit the page, does so and saves a view section in which there's
a @groups to which he has no access, the element[@groups] is completely
removed from the template once saved, losing it.
If QWeb encounters an @groups to which the current user has no right during
rendering, have it request a no-RTE page, so the user can not RTE-edit the
page (or drop snippets in it).
Josse Colpaert