* The compiled templates are cached per user, lang, inherit context values
* ir.ui.fields: attributes method return an dict, and record_to_html return only the content value of the field
* all rendered text use build_text and all attributes use build_attribute
* t-esc-options is removed and replace by format_value method
* AssetsBundle receive the list files and remains
* Fixes a bug that prevented the system to fetch the default provider
because the default_get call was wrong (wrong model + missing
company_id kwarg)
* Displays the amount as a monetary widget (to do that, the amount
must be sent as a float in the controller)
* Display the acquirer 'pre_msg' field to display eventual fees
This commit adds controller to list documents of customer, with pager and archive
widget to sort documents. Impacted documents are : quotations, sale order,
invoices, and issues.
Portal breadcrumd is improved too : add the home icon, and keep the query
params when using archive widget.
Some editable zones were added to templates, allowing people to customize
their frontend portal.
* make CSRF protection the default on all non-SAFE methods
note: there currently is no way to call a CSRF-protected endpoint
without a form-encoded entity-body as that's the only place we get the
CSRF token from.
* simple CSRF token generation: just use the HMAC'd session id, no
generating a new random token per session then HMAC it
* use constant-time equal function to avoid timing attacks
* assert that a database secret is configured before hashing/validating
the CSRF token
* opt-out database manager from CSRF: The super-admin password serves
the purpose of a CSRF token in the database manager screens.
There is no request database to obtain the
secret and generate a CSRF token.
Split of website_portal into a generic (and mostly empty) website_portal and a sales-related website_portal_sale (sales order, quotes, invoices)
This allows other modules to extend website_portal without depending on sales
- cleaned feedback: same method naming as ogone, cleaned method, now called
by the controller. IPN basically works.
- cleaned controllers
- cleaned test module website_payment a bit about paypal
- added support of custom, to give and receive back custom values with paypal
bzr revid: tde@openerp.com-20131118123314-jkfomek10ncq7mlu
Added payment_acquirer_paypal and .._ogone modules. Those modules hold
the model / data / controllers related to the specific acquirer.
Also updated website_payment, to use website.menu instead of custom change
in header, as menus are now editable.
bzr revid: tde@openerp.com-20131107180444-bbzobquqq9o6pctv
Christophe Matthieu