In b1e2c3453f50cc05a1b03dc1c8571a01ad7b7dd2, the `res.users.settings`
model was moved from `mail/` to `base/`, but its record rules remained
in `mail/`. This means that if `mail/` is not installed, users will be
able to access other users' `res.users.settings` records. In practice,
this is not a problem, as the only field that can exist in
`res.users.settings` without `mail/` is `homemenu_config`, which
contains nothing senstive.
This commit moves the forgotten record rules to `base/`, preventing
potential problems if new fields with sensitive information were to be
added to `res.users.settings` in the future.
Task-3461652
closesodoo/odoo#131538
X-original-commit: 5a79550c8e35ce733375c2ef7df2ea12e6added6
Signed-off-by: Louis Wicket (wil) <wil@odoo.com>
This commit adds a GIF picker in discuss
app. GIF feature makes use of Tenor GIF API [1].
To enable GIF picker in discuss, you must provide
a Tenor GIF API key in the General Settings.
Then the GIF picker is visible in all channels
(chat window and discuss app), next to the emoji picker
button.
[1] https://tenor.com/gifapi/documentation
task-2365705
closesodoo/odoo#116060
Related: odoo/enterprise#41959
Signed-off-by: Alexandre Kühn (aku) <aku@odoo.com>
Co-authored-by: Brieuc-brd <brd@odoo.com>
* = bus, calendar, crm_livechat, hr, hr_holidays, im_livechat, mail_bot,
mass_mailing, privacy_lookup, test_discuss_full, test_mail,
test_mail_full, website_crm_livechat, website_livechat, base
In preparation of splitting discuss and mail modules.
Part of task-3265211
closesodoo/odoo#118354
Related: odoo/upgrade#4553
Related: odoo/enterprise#39661
Signed-off-by: Sébastien Theys (seb) <seb@odoo.com>
*: im_livechat, website_livechat
Access right should be based on channel type and membership instead.
Chat always private, group always private, channel private should
disapear and be a group instead (migration needed), and other channel
always public (but they can still be further restricted with
the "allowed groups" feature)
task-2632861
closesodoo/odoo#90415
Related: odoo/enterprise#30980
Related: odoo/upgrade#3850
Signed-off-by: Sébastien Theys (seb) <seb@odoo.com>
The only mail.channel rule was that a user only had access to channels
they're members of, or can subscribe to (public, or group based).
This rule applied to admins as well, forcing them to switch to
super-admin mode in order to manage mail channels.
This is undesirable on lots of axis:
- superadmin mode is a bit of a last-ditch feature, as a result it's
somewhat hidden
- there is a much higher risk of screwing up as superadmin mode
basically lifts all the access rules, which can have correctness
implications
- auditing completely breaks down when using superadmin mode, as the
real identity of the user is lost
OPW-2857136
closesodoo/odoo#92299
X-original-commit: 1a77ab5726bbcc477d12f40f67433d474ea85316
Signed-off-by: Xavier Morel (xmo) <xmo@odoo.com>
Current access rule requires fetching all members of each channel, which does not scale.
Use is_member field instead, and make sure itself does not fetch all members.
task-2818759
closesodoo/odoo#88221
Related: odoo/upgrade#3422
Signed-off-by: Sébastien Theys (seb) <seb@odoo.com>
*test_discuss_full,test_lint
This commit adds the audio and video conference feature to mail channels
and integrate it with the groupDM/guest features.
Adds new mp3 and ogg files (from task-2554674) for sound effects.
- Adds three new tables:
* `mail.channel.rtc.session` to manage the peerToPeer interactions
during rtc calls.
* `mail.ice.server` to provide ICE servers necessary to establish
peerToPeer connections with webRtc.
* `res.users.settings.volumes` to hold the partner-to-partner volume
settings, each partner can create one new setting per other
partner to configure the volume coming from those partners during
calls.
- changes res.config.settings:
* Adds new fields for the Twilio credentials to use their STUN/TURN
service.
- changes res.user.settings:
* Adds 4 fields for the push to talk and voice activation.
- changes mail.channel:
* Adds a new field `rtc_session_ids` that represents the active
participants in a rtc call on that channel.
- changes mail.channel.partner:
* Adds a new field `rtc_inviting_session_id` that represents the
rtcSession of the user that is inviting that channelPartner to a
call.
task-2366708
closesodoo/odoo#66611
Signed-off-by: Sébastien Theys (seb) <seb@odoo.com>
The commit is to refactor the discuss sidebar
- threads are now organized in categories based on the thread type e.g. chat, channel
- categories can be folded or unfolded by clicking the category title
- for active thread, even if the category is folded, it remains under the category title
- for channel category, a new cog button is added to view all channels
- the active indicator bar is removed. The active item now is highlighted with a different background color
- thread avatar is used for livechat, chat and channel
- for livechat and chat, threads are now sorted by last activity time (pin or message exchange)
closesodoo/odoo#70986
Task-id: 2440073
Signed-off-by: Sébastien Theys (seb) <seb@odoo.com>
Rationale
=========
Currently, mail channels have 2 modes
- They can be used like Discuss channel (chat, livechat, group)
- They can be used like a Mailing List (with the "email_send" field)
The mix of both feature in the same model causes some code complexity.
Several fields are not used in both cases (moderation related field)
and the future "Discord like" Discuss will even push the mail channel
further than the usage of the mailing list.
Because of all those reasons, we want to split the 2 mains features of
the mail channels into 2 different modules and models.
Purpose
=======
This commit remove the moderation feature of the mail channel
(email_send=True). This will be re-implemented in a separate module
in the next commit.
Do not be able to check messages in Discuss anymore because this
feature is only used to moderate the message and this feature will be
spitted in a new module "mail_group".
Links
=====
Task-2510267
See odoo/odoo/pull/71599
See odoo/enterprise/pull/19296
See odoo/upgrade/pull/2600
Forward port fixes done in stable versions and not correclty forward ported
into master at merge time.
ORIGINAL COMMIT
Purpose
=======
Before, by default, if a user create a channel, he will not be member
of this channel.
After, the current user will always be member of the new channel.
LINKS
Task ID-2421795
COM PR odoo/odoo#63677
X-Original-commit odoo/odoo@eda542c82f
X-Original-Task ID-1963414
X-original-commit: 1d5d7871d72c8b747ab2e1b3597f6b8b8e371b26
ir.rule are default values but can be customized based on the
company's policy and needs.
This is typically a record that is in noupdate as should be
customization-friendly.
Following changes needing ir.model.access on transient models too.
Remove groups declaration on the action to move it to ir.model.access
when possible.
Rules are strict by default with no unlink access by default and high
priviledge asked. Adaptations may be needed later.
Write access is given as a wizard may need to be modified in case the
action triggers an error and the user has to correct a value
account*: use account.group_account_user for all transient by default
remove account.print.journal relic
stock*: use stock.group_stock_user by default
survey: survey user can send invitations
mail: allow any employee to execute wizards
additional verifications are made to ensure they are executed
only on the documents the user has access to you
give portal access to mail.compose.message as portal still does
some actions like posting messages on the forum
add ir.rule to avoid reading somebody else messages
increase the query count because of undeterminist count
crm: saleman for lead2opp, manager for massmailing
partner manager for actions linked to partners
avoid a write in test_lead_lost
sms: any employee can send sms
mrp: mrp user can execute wizards
give unlink access as making write during do_produce operation
base_import: employees can import files
delivery: stock user can deliver
event_sale: sale user can configure the wizards
event user inherit from sale rights
gamification: employee can give badge
google_service: resolve FIXME
hr: add specific rights
manager can set a plan according to group on button
anyone who can write on an employee can register a departure
hr_expense: set rights based on buttons
hr_holidays: an approver can make a summary report
hr_recruitment: recruiter can refuse a candidate
hr_timesheet: can use the wizard if can create a timesheet
l10n_eu_service: managers can create fiscal positions
mass_mailing: same group as on mass.mailing.list
membership: accountant can create invoice from membership
payment: accountant can create a link
as the source is an account.move
keep the payment.acquirer.onboarding.wizard to system user
only as it is called during company configuration
point_of_sale: PoS manager only can use wizards
never create closing_balance_confirm_wizard records
product_expiry: stock user has rights on stock.picking
product_margin: access from accounting menus
repair: same rules as for above models
sale: set ir.rule for self wizard only
add rule from model introduced in payment to add salesman group
sale_crm: saleman can create a quotation from a lead
sale_coupon: any saleman can generate coupon
add self ir.rule
sale_product_configurator: salesman can select product variants
snailmail: employee can send letters
website: designers can write on website
website_crm_partner_assign: same rule as group on action
website_sale: sale ACL as for payment.acquirer.onboarding.wizard
website_slides: anyone can send invitation
base: base.language.*: allow employee (cf lang_install)
change.password.user: can not read change password wizard of
other users
test.*: no access is needed
Courtesy of Damien Bouvy, William Andre and Antoine Prieëls for review
of acl
Purpose of this commit is to improve model of followers, notably management
code and its use in routes. Indeed it is quite an old model and code had
to be cleaned a bit to improve code readability and maintenance.
In this commit we
* remove unnecessary code examples in gamification about followers: using
that model as example of code for goals is probably not a good idea as it
is technical;
* rewrite routes called by JS are simplified to better match JS
implementation;
* introduce computed fields to fetch related partner or channel name,
email (partner only) and active status;
LINKS
Task 1933771
Task 2078313
closesodoo/odoo#39808
Signed-off-by: Thibault Delavallee (tde) <tde@openerp.com>
Co-authored-by: Remy Voet <ryv@odoo.com>
Co-authored-by: jgi-odoo <jgi@odoo.com>
Co-authored-by: Xavier-Do <xdo@odoo.com>
Managers could see only their sessions like other operators.
Now they can see all the sessions so they can check and help the operators.
task-2048498
closesodoo/odoo#41175
X-original-commit: 6ae791335a1986aa4cc72f7ed9aadd471c1774c5
Signed-off-by: Thibault Delavallee (tde) <tde@openerp.com>
As activities are created using the current user there is no need anymore to
have another field to store the activity creator. We can therefore remove
create_user_id and replace its use by the magic create_uid field.
This commit is linked to task ID 1856417 and PR #27619.
This commit improves code of access rights checks when creating or updating
activities. Several points triggers this commit
* we would like to use _filter_access_rules and override it on activities
model in order to be more standard;
* we would like to get rid of sudo used in various CRUD overrides as using
standard ORM method allows to correctly use current user;
* we would like to get rid of create_user_id field once we can keep the
current user as create_uid;
Access rights are a bit updated. They are now the following
* you can create activities for documents like posting messages (using
_mail_post_access attribute; if not defined, write access on document
is required);
* you can read activities for documents you can read;
* you can write and unlink activities either following the defined access
rule (created OR assigned), and otherwise like posting messages (
using _mail_post_access attribute; if not defined, write access on
document is required);
In this commit we also hide edit / mark as done / cancel buttons for
activities the current user cannot modify.
This commit is linked to task ID 1856417 and PR #27619.
Co-Authored-By: Sébastien Theys <seb@odoo.com>
Co-Authored-By: Thibault Delavallée <tde@odoo.com>
Purpose of this commit is to allow to make private channels linked to
an HR department with an auto subscription.
It will ease the use of discussion channels among employees of a given
department. Moreover auto subscription is useful to avoid having to
manually synchronize channel members and department members.
This commit is linked to task ID 1848526 and closes PR #26650 .
Co-authored-by: Gert Pellin <gpe@odoo.com>
Co-authored-by: Richard Mathot <rim@odoo.com>
Purpose of this commit is to allow moderation on incoming messages in
discussion channels. On some channels on which moderation is required
messages should be in a pending moderation stage. Moderators can accept
or refuse messages as well as always allow or ban messages coming from
a given set of emails.
Channels now have an option to be moderated. Moderators can be added on
channels. They have access to a specific UI in Discuss to see and take
action on messages waiting for moderation.
Concerning mail.thread message that are pending moderation are not notified.
It means nobody receives a notification about them. Moderation process calls
the notification once the message is validated.
Various features included in this commit :
* a model is added to store the decision about emails, allow or ban;
* access rights are updated so that only moderators can modify moderation
fields on message;
* specific bus notifications are send to moderated people as well as to
moderators on incoming emails as well as when a decision is taken;
* options are added on channels to send explanations to moderated emails;
* options are added on channels to write and send guidelines explaining
why and how moderation is performed;
* a reminder is send daily to moderators with remaining messages to moderate;
* discuss UI is adapted and a new channel is added below Inbox and Starred
giving access to moderation tools;
* chanenl UI is adapted allowing to moderate directly inside channels;
This commit is linked to task ID 29521. Closes#21921.
This commit improve the daily use of activities by delegating activities
management to the document. Activities are already managed on document
through the UI either in form view or in kanban view.
Currently it is impossible in Discuss to know whether an email has been sent
to a customer and whether it failed or bounced. A notified partner has an
entry in the needaction m2m table. In this commit we decorate this table to
add fields about the email notification: is an email sent, did it failed, did
it bounce.
This information is kept only for customers. Internal users does not use this
information. Moreover their notification is deleted once the message is read
in the Chatter. This avoids having a notification table that grows quickly.
Chatter now holds a new icon for email details. It allows to know on a thread
status of emails sent to customers.
In method `user_has_groups`, make "Technical Features" effective in debug mode.
Make the group "Employees" inherit "Technical Features".
Make the group "Technical Features" invisible in the user form view.
Remove useless `ir.rule` attached on group "Technical Features".
Fix `test_acl` by avoiding the tricks around the group "Technical Features".
Main changes :
- mail.notification model is removed. People do not receive notifications
anymore. Instead two ways of following documents exist
- using a channel; messages will be displayed on the channel itself
in a near future commit
- following with its partner; messages will all be considered as
needaction, using a new m2m table. People should receive less
needaction messages by following less records by themselves.
There is no more read / unread state anymore. Instead only needaction
messages are considered. Todo (Favorites) messages still exist, and are
stores on a new m2m table instead of using decorated notifciations.
- the main filter for documents is not message_unread anymore, but
message_needaction. A lot of views and filters have been updated
accordingly.
- the vote feature has been removed
Some features from live_chat have been moved to the mail module :
- channels now have members, replacing followers;
- a decorated m2m is used to link channels and members. It stores the last
seen message on the channel for a specific partner;
- channels do not create menu entries anymore, because the
NewChatter will have its own display and use of channels;
- access rights have been updated accordingly, using members instead of
followers
Followers can now be partners or channels. Partners following a document
will receive needaction, as previously. However people can follow documents
through channels. Members of a channel are able to listen to a stream
of messages using the channel. Those messages do not create needaction
messages. It is therefore possible to follow documents without receiving
too much notifications. For interesting documents subscribing with its
partner will create notification.
message_follower_ids fields is udpated. It is now a many2many to
mail.followers, not to res.partner anymore. A subscription can be either
a partner (partner_id) or a channel (channel_id).
Some access rules have been updated accordingly.
model has been renamed to mail.channel to prepare the slack modeling.
In future commits the mail.group model will be merged with the channel
model from im_chat. The first move is to rename mail.group into
mail.channel to have a model that will unite both features.
Starting from now, subtypes can be internal. This means that only employees
(group_user members) can see the messages with this subtype. This feature
replaces and enhances the 'log a note = no subtype = internal only'
feature.
Public and portal users cannot see internal messages. This allows to have
subtypes and a follow mechanism that works for employees and is not
visible for external people.
Its first use will be for Crm Activities, allowing to have custom
subtypes visible only for salesman and not send to the customer.
ir.rule records are in noupdate data blocks to let the admin
alter them without fear of them being reset at next update.
Other records such as groups are in normal mode, so they
can be updated whenever necessary
bzr revid: odo@openerp.com-20121218232001-t425t4hi7qbmsip2
Julien Carion (juca)