On the event page and on the event list page on a website, add a
label "participating" for the logged users that are participating
to the event to avoid mistakenly double-subscribing. But we don't
hard-prevent it, because it should still be possible to subscribe someone else.
Small improvement: The portal group in general settings was hidden. We set it
visible because it contains some useful options like 'Allow external users to
sign up'
Basically, this apply what was done in 87090c1b8b
everywhere where the events begin & end dates are displayed,
so all the events dates displayed in the front-end are the same,
so they are all within the event own timezone instead of the
user browser time zone.
opw-667065
The controller /event/<event_id>/page/<page> raise exception if page is not existing.
Allow to pass the template reference when user are creating a new page.
Without it, it is impossible for the end user to create a website_event page without
change manually the xml id because the xml id is based on the module from the template.
This fix is retro compatible, because from_template will be ignored until next update
of website. And during update from website, website_event will be updated because it's a
dependance and so the default_page template created.
t-field expects a UTC datetime which it then localizes to the current
viewer's timezone (using context tz from the browser), but goal here was
to display the event's own local time, so t-field was provided an
already localized datetime and would parse it as UTC then re-offset it
based on the user's timezone, resulting in a completely nonsensical
displayed datetime.
Just display the localized datetime without reprocessing it (save to
slice off the seconds count)
* make CSRF protection the default on all non-SAFE methods
note: there currently is no way to call a CSRF-protected endpoint
without a form-encoded entity-body as that's the only place we get the
CSRF token from.
* simple CSRF token generation: just use the HMAC'd session id, no
generating a new random token per session then HMAC it
* use constant-time equal function to avoid timing attacks
* assert that a database secret is configured before hashing/validating
the CSRF token
* opt-out database manager from CSRF: The super-admin password serves
the purpose of a CSRF token in the database manager screens.
There is no request database to obtain the
secret and generate a CSRF token.
- dates are editable even in confirm state. Only events in done states are
not editable.
- the print badge button is actually a button to edit badges, so let us udpate
the name
Indeed the type field has been renamed to event_type_id. However some code
was still relying on the type and type_count names, instead of event_type_id
and event_type_id_count.
How great is it to get Odoo (almost) 9.0 (almost) translated?
Clean .tx/config file
Regenerate .pot files
Fetch current translations from Transifex (10% completion)
Now that most refactoring has been merged
It is better to have red a great work of another culture in translation than never to have read it at all.
― Henry Gratton Doyle
Yannick Tivisse