Avoid duplicating web addon in enterprise by extracting a common basis.
Enterprise features stay in enterprise, but use that common basis.
Mainly:
- JS refactoring and linting
- Conversion of .sass into .less split into multiple files
- Templates cleaning and DOM simplification
- Re-generation of web.pot, and update of .po files
When exporting text data in CSV format, values
beginning with '=', '+' or '-' will usually be
mistaken by spreadsheet applications as formulas
upon CSV import.
That will often cause the cell to display an
error message instead of the actual contents,
such as "#NAME?"
Prefixing them with a single quote makes them
pure text cells. The special single quote
character is usually hidden by the spreadsheet
in that case.
Numbers and other types of values are not affected.
CSV export was added in f146e2a and since then newline were not
exported.
But new line should be allowed if the string is quoted by " characters
which is done in Odoo.
closes#11005
opw-667853
By setting the information returned by read_companies on the session
information, we are able to remove the rpc call and the willStart
method definition
Also: Set a debounce on SwitchCompany widget to avoid multiple RPC
The `binay_image` and `content_disposition` are moved
from the web controller to the `ir.http` model,
to be able to override these methods.
This makes possible to browse the records images as sudo
when the record is published on the website.
e.g. to see the partner images on the website `/partners` page
from the `website_crm_partner_assign` module.
opw-659244
The QWeb image widget allows passing either
max_width, max_height or both, but the
controller required both.
We'll consider a 0px dimension request as
meaning: "appropriate value according to ratio".
URL attachments are now returned as data and not redirection.
If the url does not match with a module file, the 301 status
(redirection) is still returned.
This allows to use the /web/image/<xmlid>/<dimension> route
and get an image attachment with correct dimensions.
Some accounting model (i.e. account.tax) are redefining the ORM search
method, but with misordered arguments (placing count as fifth argument
instead of context).
For the export function, this lead to have the "context" variable
associated to the "count" function variable. As "count" is then
considered as True, the method returns the number of records instead
of the list of record ids. This then exported the last record (the
count'th one) instead of all the records that matched the domain.
The solution here is to explicitly give the context variable by name.
- Differentiate between the Community and Enterprise editions
in the version number. By adding this attribute on the global
odoo JS object in the web client bootstrap controller /web,
we can differentiate between versions easily on the client
side without extra RPC calls.
- Remove a couple of version-related RPC calls in case
the global version info is present in the JS environment
- Update "About" panel to display the edition info
- This commit also reverts 07fe5afc87
which implemented the idea in a more limited way.
Closes#9625
HTTP status lines are required to have both
a status code *and* a "reason phrase".
Some stricter HTTP clients / proxies choke
on status lines without "reason".
Technically, setting `response.status` is supposed
to set both at the same time, so we need to provide
both, or to set `status_code` only and let werkzeug
add the reason. This patch does the latter.
Fixes#8924
This reverts commit bd9cbdfc41.
The above revision solved the SQL constraints not being
translated when raised. They were not translated because
the context, containing the lang, was not located as expected
in the `kwargs` dict.
While it solved this issue, it had as side-effect to raise
`current transaction is aborted,
commands ignored until end of transaction block` errors more
often when using the web client.
This can be explained by the double check, when the first
check raised this error
- which can happen, e.g. when the cursor is closed,
there is a retry mechanism in such cases -
and by the fact the transaction was not rollbacked.
This issue could have been solved as well by rollbacking
the transaction, but it is regarded as not-so-clean.
Therefore, to solve this issue, while still having
the SQL constraints translated, we apply the
second patch proposed in bd9cbdfc41
commit message, which is not-so-clean as well, but
which is a proper solution.
opw-651393
Only used by web tests (which rely on a module they don't depend on to
run, bad!) and altering the test session directly should work, so this
endpoint seems completely unnecessary.
* make CSRF protection the default on all non-SAFE methods
note: there currently is no way to call a CSRF-protected endpoint
without a form-encoded entity-body as that's the only place we get the
CSRF token from.
* simple CSRF token generation: just use the HMAC'd session id, no
generating a new random token per session then HMAC it
* use constant-time equal function to avoid timing attacks
* assert that a database secret is configured before hashing/validating
the CSRF token
* opt-out database manager from CSRF: The super-admin password serves
the purpose of a CSRF token in the database manager screens.
There is no request database to obtain the
secret and generate a CSRF token.
Christophe Simonis