Commit Graph
593 Commits
Author SHA1 Message Date
niyasraphy dad4ef4325 [FIX] website_forum: properly make the description field full width
In the forum form view, the description field is not aligned well and
is too compact. This is because of [1] (and related commits of that big
rework), which changed the way form view groups are rendered (using grid
display).

- eLearning -> Forum -> Forums
- Open any record
- In the "Options" tab, there is a description field at the bottom of
  the view

=> The description field is too compact (hard to view and edit the value
   from the field).

In master, this should in fact be changed to not use any group.

[1]: https://github.com/odoo/odoo/commit/a2b894989ea33364dd29a7d412e4bd4260c1f5ef

closes odoo/odoo#103994

X-original-commit: 3dc42aafffc3c41db732a6e52af7956ea1d0da0e
Signed-off-by: Quentin Smetz (qsm) <qsm@odoo.com>
2022-10-25 13:03:44 +02:00
qsm-odoo eed3f1bc59 [FIX] website, *: hide page options for non-designer users
*: website_blog, website_crm_partner_assign, website_customer,
   website_event, website_event_exhibitor, website_event_meet,
   website_event_track, website_forum, website_hr_recruitment,
   website_membership, website_sale, website_sale_loyalty,
   website_sale_slides, website_slides, website_slides_forum

With commit [1], the "customize_show" options were moved in edit mode.
They were wrongly displayed for non-designer users. Trying to use those
would throw a warning at the user.

[1]: https://github.com/odoo/odoo/commit/17a8a37e9bfc5b787d9666597d43e63f0064919f

closes odoo/odoo#103142

X-original-commit: f2ca62a4a9ccb6713a39c100fc87c112619eac41
Related: odoo/enterprise#32768
Signed-off-by: Romain Derie (rde) <rde@odoo.com>
2022-10-12 10:35:05 +02:00
xO-Tx b0484d64c4 [FIX] website, *: fix website content kanban views
*: website_blog, website_forum, website_hr_recruitment, website_sale,
   website_slides

The goal of this commit is to set the missing 'view_ids' on some
actions linked to website 'pages' tree/kanban views.

Linking a form view to actions will make the 'Edit' & 'Configuration'
buttons work correctly (on kanban record dropdown for 'hr.job' &
'slide.channel').

The website url on "product pages" kanban should start on a new line
after this commit too.

Related to task-2889981

closes odoo/odoo#101814

X-original-commit: a61e730cd9f92b2c343646f33f3e59cef518c3bf
Signed-off-by: Quentin Smetz (qsm) <qsm@odoo.com>
2022-10-03 20:19:53 +02:00
xO-Tx f23399db1d [IMP] website, *: add website content kanban views
*: website_event, website_forum, website_hr_recruitment,
   website_sale, website_slides

The website content list views should act as a page manager (click on
a record redirects to iframe, "CREATE" and "Publish / Unpublish"
buttons, ...).

The goal of this commit is to add a kanban version of these views for
key app models ('website.page', 'blog.post',...) since the same code
can now be used for list and kanban controllers / renderers since [1].
It is especially important in mobile where the kanban views are nicer
than list views by default.

[1]: https://github.com/odoo/odoo/commit/ed09db19c372da8d8be541f365117d1ce8e965ba

task-2889981

closes odoo/odoo#101174

Related: odoo/enterprise#31821
Signed-off-by: Quentin Smetz (qsm) <qsm@odoo.com>
2022-09-27 14:54:40 +02:00
Huy Le 58162aa290 [FIX] website_forum: fix wrong attribute
After commit [1], attribute `t-value` was replaced to `value` by mistake

Steps to reproduce:
- Go to a forum post
- Click on the author image, logged in as admin
- On the profile page, unpublish the user
- As public visitor go to the previous forum post
- See the avatar image url -> `href` is now `href="#"` with this PR.

[1]: https://github.com/odoo/odoo/commit/c8c8eb3d5652e9834d0ecd5aad907ee359edb657#diff-2a4205ad15bf7b1ef0d1361b1baec87ef8a6429de19f9e0e8afce4ca16be839d

closes odoo/odoo#100600

X-original-commit: 556ff721fb7f052bee004434029659d55ea00f21
Signed-off-by: Romain Derie (rde) <rde@odoo.com>
2022-09-21 18:58:56 +02:00
qsm-odoo da3f4c2aff [IMP] website, *: fill the "Content" area of the main website menu
*: website_blog, website_event, website_forum, website_hr_recruitment,
   website_sale, website_slides

As indicated by previous commits, new custom list views are created to
fill the "Content" area of the main website menu with key app models:
blog posts, events, forum posts, jobs, products and courses (+ some in
the enterprise version, see related commit).

Those list views will act as the page manager one: a click on an item
redirect to the website iframe, the create button acts as creating a
record via the "+ New" systray button while being on the iframe, the
delete button will in the future allow to know the page that mentions
the related object before deleting it, etc etc.

task-2889981

closes odoo/odoo#98937

Related: odoo/enterprise#30782
Signed-off-by: Quentin Smetz (qsm) <qsm@odoo.com>
2022-09-05 05:21:06 +02:00
qsm-odoo 2bd1ba0e06 [MOV] *: move future page manager related views and action
*: website_blog, website_forum

A "page manager" list view will be created for key models in other
apps. This commit moves blog and forum views to a dedicated file to
save some history for the future introduction of that "page manager"
list view.

task-2889981

Part-of: odoo/odoo#98937
2022-09-05 05:21:05 +02:00
Achraf (abz) 31f389b983 [FIX] *: Adapt old custom-control class of Bootstrap
* = hr_holidays, mail, sale, web, web_editor, website, website_forum,
website_payment, website_sale

https://getbootstrap.com/docs/5.1/migration/

replacing `custom-control` by `form-check` because in bs4 this class had
a use which is not the case in bs5.

closes odoo/odoo#98965

Related: odoo/enterprise#30768
Signed-off-by: Romeo Fragomeli (rfr) <rfr@odoo.com>
2022-08-31 16:05:20 +02:00
Achraf (abz) cb05925d99 [FIX] mail, website_*,base: Update data-toggle to data-bs-toggle
in bootstrap 5.x the toggle attribute changed from `data-toggle` to
`data-bs-toggle`, so we have to change `data("toggle")` by
`data("bs-toggle")`

https://getbootstrap.com/docs/4.6/components/collapse/
https://getbootstrap.com/docs/5.1/components/collapse/
https://getbootstrap.com/docs/5.1/migration/#javascript

Also using `$el[0].dataset.bsToggle` instead of `$el.data("toggle")` is
better since `data()` can be confusing

```js
const a = document.createElement("a");
> <a></a>
a.setAttribute("data-bs-toggle", "dropdown")
> <a data-bs-toggle="dropdown"></a>
a.dataset
> DOMStringMap {bsToggle: 'dropdown'}
$(a).data()
> {}
```

*/

https://pad.odoo.com/p/wowl_views
[aju] https://watch.screencastify.com/v/XuuQTkKRFX3lJh1vnvt9 project.task
kanban view > schedule an activity > mark it as done > traceback
https://pastebin.com/i96Krxrb

closes odoo/odoo#98339

Enterprise: https://github.com/odoo/enterprise/pull/30558
Signed-off-by: Adrien Dieudonné (adr) <adr@odoo.com>
2022-08-19 09:12:42 +02:00
Romain Estievenart 36628c9b1c [FIX] *: removes .form-inline
this commit removes the usage of .form-inline class which is deprecated
since BS5.

here is the css rules that was used:
https://github.com/twbs/bootstrap/blob/8fa0d3010112dca5dd6dd501173415856001ba8b/dist/css/bootstrap.css#L2303

'''Breaking change: Dropped form-specific layout classes for our grid
system.
Use our grid and utilities instead of .form-group, .form-row, or
.form-inline.'''

https://getbootstrap.com/docs/5.0/migration/#forms

We also took the opportunity to remove some .input-group-append and
.form-group. We are currently working to remove all of them.

Part-of: odoo/odoo#97967
2022-08-16 09:19:08 +02:00
qsm-odoo 29613c6ec4 [FIX] web_editor: fix the look of the indent symbol in the editor panel
As a stable fix, to not touch XML templates and break existing
translations, the ⌙ character was automatically replaced by └ which
makes more sense for the usecase and should work properly in all
browsers. The ⌙ character is actually rendered mirrored on Windows 11
Chrome (and others) as the font used for those unicode characters is
left to the browser. We could force a font of our own but it's probably
not worth it.

A better solution with a SVG or CSS solution has to be done in master.
That would unify the look of the symbol across all browsers and
also prevent special characters to be placed in translations.

With this forward-port commit, we'll start first by using └ via a CSS
rule. Three new classes have been created: o_we_sublevel_1,
o_we_sublevel_2 and o_we_sublevel_3. Adding any of them on a widget
automatically adds the └ character. Then choosing 1, 2 or 3 controls
the indentation, which was previously controlled by placing the &emsp;
HTML entity directly inside strings.

This commit also takes the opportunity to fix some of those level
indentations (sometimes 2 was used instead of 1 or 1 was used instead of
2, etc) and also review some related labels.

closes odoo/odoo#97361

X-original-commit: e5d45643598671077ade7e41f0dbfe2b502665b8
Signed-off-by: Romain Derie (rde) <rde@odoo.com>
2022-08-04 11:45:31 +02:00
Romeo Fragomeli 1fcd098af5 [REF] *: BS5: migration
Automated change made by a lot of RegEx to change all think that is
possible to automate.

https://getbootstrap.com/docs/5.1/migration

Task ID: 2766483

Part-of: odoo/odoo#95450
2022-07-07 13:30:24 +02:00
Romeo Fragomeli 3e7c13c97d [REF] *: BS5: Migrate data attributes
> Data attributes for all JavaScript plugins are now namespaced to help
> distinguish Bootstrap functionality from third parties and your own code.
> For example, we use data-bs-toggle instead of data-toggle.

https://getbootstrap.com/docs/5.1/migration/#javascript

Task ID: 2766483

Part-of: odoo/odoo#95450
2022-07-07 13:30:21 +02:00
Romeo Fragomeli 23c3a31a0d [REF] *: BS5: removal of .media class
https://getbootstrap.com/docs/5.1/migration/#grid-updates
https://getbootstrap.com/docs/5.1/utilities/flex/#media-object
https://github.com/twbs/bootstrap/pull/28265

Task ID: 2766483

Part-of: odoo/odoo#95450
2022-07-07 13:30:19 +02:00
Romeo Fragomeli 9ea1351334 [REF] *: BS5: Migrate forms and inputs
- BS5 uses native inputs instead of pseudo-element for some
  input like checkbox, radio, ...
  in BS5 input checkbox don't have "virtual visual" checkbox anymore
  (::before), so we remove the relative's rules

- removed `.custom-control` class

- `form-switch` use a new layout system in BS5 we adapt the code to
  match the Bootstrap approach (inline SVG).

- In tests, we don't check the exact value of the background as it
  change in community/enterprise, and it's difficult to check the value
  of an SVG.

- Overflow in progressbar is now hidden.
  -> we had to restore it.

- In BS5 margins in forms/inputs has been changed
  -> we had to restore it (e.g. 'mb-3')

- .form-group, .form-row, .form-inline
> Dropped form-specific layout classes for our grid system.
> Use our grid and utilities instead of .form-group, .form-row,
> or .form-inline.

- .input-group-append and .input-group-prepend
> Dropped .input-group-append and .input-group-prepend.
> You can now just add buttons and .input-group-text as direct
> children of the input groups.

Ref:
[1] https://getbootstrap.com/docs/5.1/migration/#forms

Task ID: 2766483

Part-of: odoo/odoo#95450
2022-07-07 13:30:18 +02:00
Romeo Fragomeli b82ba2a8fd [REF] *: BS5: Migrate modals and .btn-close for modals and alerts
- modal 'show' option doesn't exist anymore
  -> We need to call .show()

- by default, show is not the default
  -> we need to call .show() explicitly.

- generic close button for dismissing content like modals and alerts.

- BS5 modals needs `modal-dialog` class to work

- normally we need also to add `modal-content` class but as the original
XML don't have this nested level of div we don't use it, but instead
we add `pointer-events: auto` for all children `DIV` of `modal-dialog`
-> See DocumentViewer

Task ID: 2766483

Part-of: odoo/odoo#95450
2022-07-07 13:30:18 +02:00
Romeo Fragomeli ac584e171d [REF] *: BS5: Migrate Badge
From [1]:
> Dropped all .badge-* color classes for background utilities
> (e.g., use .bg-primary instead of .badge-primary).

We now have to manage constrast for some badge. It's why we
add 'text-dark' at some point.

Note:
Due to the backport of 'text-bg-#{theme}', we can use this to
avoid to use 'text-dark'.

Ref:
[1] https://getbootstrap.com/docs/5.1/migration/#badges

Task ID: 2766483

Part-of: odoo/odoo#95450
2022-07-07 13:30:18 +02:00
Arthur Detroux (ard) e5b094b683 [IMP] website, *: remove unused assets
*: website_blog, website_event, website_forum, website_links,
   website_livechat, website_slides, survey, web_editor

This commit removes the website navbar root widget, as the edition is
now handled in the backend through the client action and custom menus.

It removes associated widgets and their css.

See merge commit for more information.

task-2687506
2022-06-24 10:28:06 +02:00
Benjamin Vray 823d46fc6f [IMP] website, *: adapt customize show options in website pages
*: website_crm, website_crm_partner_assign, website_customer,
   website_forum, website_hr_recruitment, website_membership,
   website_slides, website_slides_forum

This commit adapts "customize show" options from several website modules
by creating new options available in edit mode.

See merge commit for more information.

task-2710582
2022-06-24 10:28:05 +02:00
xO-Tx 8925df7e75 [IMP] website, *: add new content dialogs
*: website_blog, website_event, website_forum, website_livechat,
   website_sale, website_sale_slides, website_slides,
   website_slides_forum

The goal of this commit is to add dialogs to create new website content
using a 'target:new' action on the form view and an overridable
"website" form controller.

See merge commit for more information.

task-2687506
2022-06-24 10:28:05 +02:00
qsm-odoo 2f6aa250eb [MOV] *: move some static XML to view definitions
*: website_event, website_forum, website_slides

As the first commit of the merge of this work at [1], this moves files
without modifying them to preserve code history and ease forward-ports.

This part is about moving static XML to non-static files where the
XML will be changed into view definitions (as some UI now become normal
backend views). This cannot be a standalone working move of course.
So it was not done in the first commit but here, just before the
relevant commits of the merge.

[1]: https://github.com/odoo/odoo/pull/89223

See merge commit for more information.

task-2687506
2022-06-24 10:28:05 +02:00
Younn Olivier a9a0107f7c [IMP] website, *: reorganize website menus
*: website_blog, website_forum, website_mail_group, website_sale,
website_sale_comparison

task-2687506
2022-06-24 10:28:04 +02:00
Gorash b0a2a41d78 [IMP] all/website: using lazy values and t-cache in templates
Using lazy values allows you to not do query when the content is not
displayed or if it is already cached. Adding `t-cache` only reduces
render time, but combining it with lazy values saves browses, computes
and query.
Thus for the `/shop` page the page is displayed in 60ms (before: 250ms).

Part-of: odoo/odoo#88276
2022-06-03 16:40:40 +02:00
Elena d8b742aa21 [FIX] website_forum: reorder faq question depending of karma required
Order of karma needed is ascending now.

closes odoo/odoo#89087

X-original-commit: b29bfd65c6f55cd9ff4f8a899d8648bb8ba000ca
Signed-off-by: Romain Derie (rde) <rde@odoo.com>
2022-04-19 22:28:18 +02:00
Martin Trigaux 4107d17b01 [FIX] website_profile,forum: avoid relative links
The origin parameter must be an absolute link (starting with a /)
To be consistent and always have a leading slash (and avoid relative
links if the developer forgot to add a leading slash)
2021-12-20 11:39:03 +01:00
Kevin Baptiste 7dc796f8d6 [FIX] website_forum: make link buttons work again
Since #45352, the dropdown actions "Edit" / "Close" / "Delete" were no
longer working; clicking on them was not submitting the form like it was
supposed to.

closes odoo/odoo#81156

Taskid: 2499623
X-original-commit: 2e7cb0e19a81598f3e52660753b925b3f2216a6d
Signed-off-by: Kevin Baptiste <kba@odoo.com>
2021-12-09 16:14:47 +00:00
ijas ahammed a85f02a31f [IMP] website_{forum,slides_forum}: improve forum and forum post list views
This commit improves forums and forum posts list views. The changes are listed
below.

Forums list view:
  - optional hidden `total_answers` and `total_favorites`
  - added `slide_channel_id` and `visibility` fields
  - added sum for `total_posts` and `total_views`

Forum posts list view:
  - added badge widget on `state` field for better decoration
  - added sum for `views` and `child_count`, updated their label to
    '# Views' and '# Answers'
  - removed `favourite_count` field
  - moved `website_id` field at last as optional hidden
  - added title for the demo data in which title was missing.

TaskID-2607467

Part-of: odoo/odoo#76930
2021-11-23 09:39:35 +00:00
Hardik Prajapati 3d2fe2f2d8 [FIX] website_forum: fix forum back button url from backend
Currently, when user open the question from helpdesk ticket and
user clicks on the back button of the forum page,
it redirects the user to the app switcher. It happens because the
back button contains the homepage URL as httprequest.referrer
does not support the fragment url with hash(#).

so this commit fixes the issue by binding the onclick event on the
back button so clicking on the back button redirects the user
to the helpdesk ticket.

task-2602604

closes odoo/odoo#77458

Signed-off-by: Laurent Stukkens (ltu) <ltu@odoo.com>
2021-11-04 11:07:16 +00:00
Thomas Josse 91db19c187 [IMP] mass_mailing_slides / survey / website_forum / website_[sale_]slides_* : enhancing the views in eLearning
Purpose
=======
This commit is enhancing the website_slides module.

Specifications
==============
It changes placeholders for certain fields, it changes helpers in some
of the views.

It updates some of the main views of the menus and corrects wordings
inside of them.

It activates the Graph and Pivot views for the reporting of
Courses, Reviews and Quizzes.

It cleans up some of the measures inside of the Pivot and Graph views
of each menus where it is available.

It also merges 2 models: slide.slide.link and slide.slide.resource into
slide.slide.resource with a type Selection field.
This is done in order to create a single table for the additional
resources of a Content.

It also improves the front-end of the module with minor changes.
It fixes the problem of long names inside of breadcrumbs.
It also adds a message when there is no leaderboard in /profile/users.

task-2597345

See odoo/enterprise#20480
See odoo/upgrade#2784

Part-of: odoo/odoo#75646
2021-10-22 11:09:16 +00:00
Romain Derie 7d8a8ddea0 [IMP] website(_forum/_profile): remove _get_http_domain method
Before Odoo saas-14.4, one should call `_get_http_domain()` on website to get
its domain. Indeed, that method was in charge of cleaning that domain, as it
was done with commit [1].

Since Odoo saas-14.4, that cleaning is automatically performed on domain before
saving it into database, thanks to commit [2].

Thus, we can now remove the `_get_http_domain()` and use directly the domain as
it is considered clean.

Note that migrated databases coming from version older than Odoo saas-14.4
could still have an incorrect domain (trailing slash, no scheme..).
This will be handled during migration with [3].

[1]: https://github.com/odoo/odoo/commit/3ad775aab717b395a5d11527aeb3596af66afa99
[2]: https://github.com/odoo/odoo/commit/042c95b0219bb0aa13e73385e092fa76ff1a1b0a
[3]: https://github.com/odoo/upgrade/pull/2951

closes odoo/odoo#78766

Signed-off-by: Quentin Smetz (qsm) <qsm@odoo.com>
2021-10-21 15:47:22 +00:00
Dhwani Patelandjpr-odoo 4aacc0edb8 [IMP] website_forum: rename the title of question page
This commit changes the title of new question page from 'new_question' to
'New Post'.

task-2167561

closes odoo/odoo#45352

Signed-off-by: Romain Derie (rde) <rde@odoo.com>
Co-authored-by: jpr-odoo <jpr@openerp.com>
2021-10-14 12:26:09 +00:00
Dhwani Patelandjpr-odoo d69c49349b [IMP] website_forum: improve the flagging question UX
Now, once the question is flagged, we show two options for it: 'Validate' and
'Mark as Offensive'.
So, one can directly validate (or not) directly from the question page.

task-2167561

Part-of: odoo/odoo#45352
Co-authored-by: jpr-odoo <jpr@openerp.com>
2021-10-14 12:26:09 +00:00
Dhwani Patelandjpr-odoo 7223f0e720 [IMP] website_forum: tooltip based on condition
This commit display the tooltip "only one answer per question is allowed" only
for question-answer type of forum.

task-2167561

Part-of: odoo/odoo#45352
Co-authored-by: jpr-odoo <jpr@openerp.com>
2021-10-14 12:26:09 +00:00
Fabio Barbero 2d65d022d9 [IMP] website_slides: change confirmation messages for email
Purpose
=======
Clean up messages related to email verification.

Specification
=============
Rephrase messages, add confirmation of email sent and let user change
email.
Do not show "Validation Email sent" if the current user changed their
email address.

PR: https://github.com/odoo/odoo/pull/77617
Task-2647065

closes odoo/odoo#77617

Signed-off-by: Thibault Delavallee (tde) <tde@openerp.com>
2021-10-12 11:44:40 +00:00
Mathieu Duckerts-Antoine 7545913020 [REF] *: graph archs cleaning
We clean various graph archs taking into consideration that:
 - the default type of a graph is "bar".
 - a bar chart is by default stacked.
 - the field attributes type="row" and type="col" does not make sense for
   a graph view (since its implementation was separated from the pivot
   implementation a long time ago))
 - the boolean attributes should now take 1 or 0 as value (but the other
   values are accepted for retrocompatibility).

Part-of: odoo/odoo#76065
2021-09-07 15:50:14 +00:00
Benoit Socias 7559626c54 [IMP] website, *: make a generic search bar snippet available
(*: website_blog, website_event, website_forum, website_sale,
website_slides)

Before this commit the search bar was specific to products.

After this commit a generic search bar is available as a general feature
of website which can be configured to inspect specific models.
The snippet is used to replace the old search bar in blog, courses,
event, forum, page and shop.
The search results of these pages and the autocomplete of the search bar
run through the same search mechanism.
A new hybrid results page has also been created as a target of a search
on "Everything".

In each involved module, `website._search_get_details()` is implemented
to return search metadata for every model related to the `search_type`
parameter.
Search metadata for a single model is returned by `_search_get_detail()`
on that specific model.

The autocomplete runs through the additional
`website._search_render_results()` pre-rendering step that prepares the
data to fit in the autocomplete template.

task-2379555
https://github.com/odoo/odoo/pull/65871

Part-of: odoo/odoo#65871
2021-09-03 06:59:33 +00:00
Romain Derie f253018002 [FIX] website_forum: add missing ID which lead to broken JS
That ID was removed with c8c8eb3d56, but the JS code is expecting to find
this ID inside the DOM to increment the flag counter.

Courtesy of @dwa-odoo
Spotted while working on task-2167561

closes odoo/odoo#74819

X-original-commit: 2e3f78569e2bb2e0cd2ad9271b1877a43a8c4abb
Signed-off-by: Jérémy Kersten (jke) <jke@openerp.com>
Signed-off-by: Romain Derie <rdeodoo@users.noreply.github.com>
2021-08-06 14:01:34 +00:00
Leonardo Pavan Rocha c53724ebc3 [IMP] *: adds generic user avatar
Description of the issue/feature this PR addresses:
It is currently quite difficult to differentiate users. Most of the time, people
don't take the time to upload an actual avatar so everybody looks the same. This
PR generates a custom avatar with the users initials and random color to
differentiate them. For res.users, res.partner and hr.employee, image fields now
hold the binary image and avatar are used to show the image or svg.

Current behavior before PR:
Avatar had only random colors and was being saved in database, being inefficient

Desired behavior after PR is merged:
A new mixin defines image fields and in case no image is set, it generates an
SVG image with the user's initials and random color.

closes odoo/odoo#69819

Task: 2404630
Related: odoo/enterprise#18199
Signed-off-by: Sébastien Theys (seb) <seb@odoo.com>
2021-06-01 14:36:23 +00:00
Xavier Morel 25aeaecf85 [FIX] website_forum: de-raw-ify
`post_content` is rendered template content, so should be makup-safe.

`result_msg` is qweb template content, so it's markup-safe.
2021-04-29 05:34:20 +00:00
Xavier Morel 996cb85c27 [FIX] *: mass replace known t-raws by t-out
* QWeb bodies should be markup-safe so `0` should always be
  markup-safe.
* `head` is qweb-rendered so the same.
* The `json` pseudo-module in qweb templates is `json.scriptsafe`,
  which should be markup-safe.
2021-04-29 05:34:20 +00:00
Xavier Morel 01875541b1 [CHG] core, web: deprecate t-raw
Add a big fat warning when the qweb compiler finds a `t-raw`.

`t-esc` should now be used everywhere, the use-case for `t-raw` should
be handled by converting the corresponding values to `Markup`
objects. Even though it's convenient, this constructor *should never
be made available in the qweb rendering context* (maybe that should be
checked for explicitely?).

Replace `werkzeug.escape` by `markupsafe.escape` in
`odoo.tools.html_escape`, this means the output of `html_escape` is
markup-safe.

Updated qweb to work correctly with escaping and `Markup`, amongst
other things QWeb bodies should be markup-safe internally (so that a
`t-set` value can be fed into a `t-esc`). See at the bottom for the
attributes handling as it's a bit complicated.

`to_text` needed updating: `markupsafe.Markup` is a subclass of `str`,
but `str` is not a passthrough for strings. So `Markup` instances
going through would be converted to normal `str`, losing their safety
flag. Since qweb internally uses `to_text` on pretty much
everything (in order to handle None / False), this would then cause
almost every `Markup` to get mistakenly double-escaped.

Also mark a bunch of APIs as markup-safe by default

* html_sanitize output.
* HTML fields content, sanitization is applied on intake (so stripped
  by the trip through the database) and if the field is unsanitised
  the injection is very much intentional, probably. Note: this
  includes automatically decoding bytes as a number of default values
  & computes yield bytes, which Markup will happily accept... by
  repr-ing them which is useless. This is hard to notice without `-b`.
* Script-safe json, it's rather the point (though it uses a
  non-standard escaping scheme).
* Note that `nl2br`, kinda: it should work correctly whether or not
  the input is markup-safe, this means we should not need to escape
  values fed to `nl2br`, but it doesn't hurt either.

Update some qweb field serialisations to mark their output as
markup-safe when necessary (e.g. monetary, barcode,
contact). Otherwise either using proper escaping internally or doing
nothing should do the trick.

Also update qweb to return markup-safe bytes: we want qweb to return
markup-safe contents as a common use-case is to render something with
one template, and inject its content in an other one (with Python code
inbetween, as `t-call` works a bit differently and does not go through
the external rendering interface).

However qweb returns `bytes` while `Markup` extends `str`. After a
quick experiment with changing qweb rendering to return `str` (rather
unmitigated failure I fear), it looks like the safest tack is to add a
somewhat similar bytes-based type, which decodes to a `Markup` but
keeps to bytes semantics.

For debugging and convenience reasons, MarkupSafeBytes does *not*
stringify and raises an error instead (`__repr__` works fine). This is
to avoid implicit stringifications which do the wrong thing (namely
create a string `"b'foo'"`).

Also add some configuration around BytesWarning (which still has to be
enabled at the interpreter level via `-b`, there's no way to enable it
programmatically smh), and monkeypatch `showwarning` to show warning
tracebacks, as it's common for warnings to be triggered in the bowels
of the application, and hard to relate to business logic without the
complete traceback.

`t-out`
=======

`t-esc` is a bit confusing for the new behaviour of "maybe escape
maybe not", so add a `t-out` alias with the same behaviour.

Unlike `t-raw`, `t-esc` is only soft-deprecated for now: there are
thousands of instances, so editing all the templates is not
great. Eventually we'll add a `ci/style` to prevent addition of new
ones, and eventually we might do a bulk-replace and hard-deprecate.

Attributes handling
===================

There are a few issues with respect to attributes. The first issue is
that markup-safe content is not necessarily attributes-safe
e.g. markup-safe content can contain unescaped `<` or double-quotes
while attributes can not. So we must forcefully escape the input, even
if it's supposedly markup-safe already.

This causes a problem for script-safe JSON: it's markup-safe but
really does its own thing. So instead of escaping it up-front and
wrapping it in Markup, make script-safe JSON its own type which
applies JSON-escaping *during the `__html__` call.

This way if a script-safe JSON object goes through `markupsafe.escape`
we'll apply script-safe escaping, otherwise it'll be treated as a
regular strings and eventually escaped the normal way.

A second issue was the processing of format-valued
attributes (`t-attf`): literal segments should always be markup-safe,
while non-literal may or may not be. This turns out to be an issue if
the non-literal segment *is* markup-safe: in that case when the
literal and non-literal segments get concatenated the literal segments
will get escaped, then attributes serialization will escape
them *again* leading to doubly-escaped content in attributes.

The most visible instance of this was the `snippet_options` template,
specifically:

    <t t-set="so_content_addition_selector" t-translation="off">blockquote, ...</t>
    <div id="so_content_addition"
        t-att-data-selector="so_content_addition_selector"
        t-attf-data-drop-near="p, h1, h2, h3, .row > div > img, #{so_content_addition_selector}"
        data-drop-in=".content, nav"/>

Here `so_content_addition_selector` is a qweb body therefore
markup-safe, When concatenated with the literal part of
`t-atff-data-drop-near` it would cause the HTML-escaping of that
yielding a new Markup object. Normal attributes processing would then
strip the markup flag (using `str()`) and escape it again, leading to
doubly-escaped literals.

The original hack around was to unescape() `Markup` content before
stringifying it and escaping it again, in the attribute serialization
method (`_append_attributes`).

That's pretty disgusting, after some more consideration & testing it
looks like a much better and safer fix is to ensure the
expression (non-literal) segments of format strings always result in
`str`, never `Markup`, which is easy enough: just all `str()` on the
output of strexpr. We could also have concatenated all the bits using
`''.join` instead of repeated concatenation (`+`).

Also add a check on the type of the format string for safety, I think
it should always be a proper str and the bytes thing is only when
running in py2 (where lxml uses bytestrings as a space optimization
for ascii-only values) but it should not hurt too much to perform a
single typecheck assertion on the value... instead of performing one
per literal segment.

Note: we may need to implement unescape anyway, because it's still
possible to get double-escaping with the current scheme: given an
explicitly escape-ed `foo` and `t-att-foo="foo"`, `foo` will be
re-escaped.

fixup! [CHG] core, web: deprecate t-raw
2021-04-29 05:34:19 +00:00
27166ff9df [REM] web_editor, website: remove Summernote wysiwyg rte library
Co-authored-by: David Monjoie <dmo@odoo.com>
Co-authored-by: Antoine Guenet <age@odoo.com>
Co-authored-by: Nicolas Bayet <nby@odoo.com>
Co-authored-by: Sébastien Geelen <sge@odoo.com>
Co-authored-by: Emilien Durieu <edu@odoo.com>
2021-04-01 12:49:47 +00:00
Julien MougenotandSimon Genin 03641610c2 [REF] *: convert all modules to new asset system
Conversion of all modules to the new manifest assets declaration.

Part of task: 2352566

Co-authored-by: Julien Mougenot <jum@odoo.com>
Co-authored-by: Simon Genin <ges@odoo.com>
2021-03-31 13:57:18 +02:00
Michael Mattiello (mcm) 785b304876 [IMP] *: reduce shift in form views (xml)
* account, analytic, calendar, coupon, crm, crm_iap_lead_website,
  delivery, digest, event, event_crm, fleet, gamification, hr,
  hr_expense, hr_skills, im_livechat, lunch, mail, maintenance,
  mass_mailing, membership, mrp, point_of_sale, pos_mercury, product,
  purchase, purchase_requisition, sale_management, sales_team, sms,
  stock, stock_landed_costs, survey, website_crm_partner_assign,
  website_event_exhibitor, website_event_track, website_forum,
  website_slides, base

This commit removes oe_edit_only labels and adds placeholder
on fields in form views from a lot of apps to minimize the
shift when switching mode.

task 2330101
2021-02-02 12:40:22 +00:00
Jeremy Kersten 0ca248892f [FIX] website*: fix quick create (o_new_content) performance
Before, on request by groups, now we use a variable is_system / is_designer
to make only once the request.

closes odoo/odoo#62313

Related: odoo/enterprise#14970
Signed-off-by: Jérémy Kersten (jke) <jke@openerp.com>
2020-11-25 13:10:39 +00:00
Thibault Delavallée 187c7239f0 [MOV][IMP] website_{blog/forum}: reorganize qweb / jinja templates used for mailing
PURPOSE

Clean organization of templates in odoo apps: mail.template records in data,
qweb templates (views) used directly in code, notably using post with view.
Purpose is to ease future improvements in posting based on templates.

SPECIFICATIONS

  * move those templates in their own file to ease their discovering and
    maintenance;
  * put them into data (as those are not views even if it contains qweb)
  * guidelines are now :

    -> Qweb templates should be in data/mail_templates.xml;
    -> mail.template records should be in data/mail_template_data.xml;

  * put their declaration in no update when not done if template has no
    technical code or complex dependency on underlying code;
  * move found mail data (mail.message.subtype or mail.activity.type) records
    in a mail_data file that should contain only "core" records linked to mail;

LINKS

Task ID-2375767
COM PR odoo/odoo#61814
ENT PR odoo/enterprise#14775
UPG PR odoo/upgrade#19366
2020-11-25 12:31:09 +00:00
Benoit Socias 20141a0b91 [FIX] various: not translate the close icon of notifications
Same change in several areas where translations existed:
- website editor notification popup
- elearning share popup
- forum remediation filter popup
- event registration attendees popup
- portal rating popup
- stripe payment error popup
And many other locations where there were no translations yet
"&times;" has been replaced by its UTF8 character.
Also introduced aria-label where missing.

Before this commit the close icon was included in translated resources.
For example, in Spanish the "&times;" had been turned into "&veces;"
thus not rendering an icon anymore

After this commit the close icon is not a translated text anymore and
remains an icon across all languages

https://github.com/odoo/odoo/pull/60186
task-2312878

closes odoo/odoo#62250

X-original-commit: 9896af94ebc887d98ccf44e6568ef7eeb5a27172
Related: odoo/enterprise#14937
Signed-off-by: Jérémy Kersten (jke) <jke@openerp.com>
2020-11-24 15:59:43 +00:00
Martin Trigaux c59c10f1bc [FIX] *: correct typos and bad English
Courtesy of translators
Reexport .pot of modified modules

closes odoo/odoo#61010

X-original-commit: 62a18bdb372e234107fd2099a2df5f9e3a442c96
Related: odoo/enterprise#14489
Signed-off-by: Martin Trigaux (mat) <mat@odoo.com>
2020-10-29 19:23:41 +00:00
Victor Feyens 2f3dcb8947 [IMP] base,website*: do not store country flags.
1) Avoid the storage of all country flags as ir_attachment (230+
ir_attachment in a new db) to reduce the filestore of databases.

The country flags are nearly static and not expected to be modified on
Odoo instances.

This change is based on the new "image_url" widget logic (see previous commits).

2) Extend the flag coverage for countries

Add the missing country flags & specify a mapping to provide flags
for overseas administrated countries/territories.
2020-09-02 16:43:45 +00:00
Barad Mahendra 63f239163a [IMP] *: set sample="1" on various graph archs
The purpose of this commit is to enable sample data in various
graph views.

TaskID: 2311486
2020-08-12 09:57:09 +00:00