In the worst case, user is not logged in and he will really have no access and
will have a perm read error after login. We cannot check if an unknow user has
access or not.
In most cases, user will be logged in and will see the document directly if
he has access or will be redirected to messaging if no access.
In the best case, he will be redirected to login page before to see the message.
task-22505
In multi company, some followers of a document could be not
readable for a user who has the rights to modify this document.
If the user has the rights to write on a document, he is allowed
to read and modify the followers of this document.
opw:693536
As this button leads to a void form view without context it is not
really usefull. As creating new records is achieved using aliases
there is no real need for a New Task/Issue/Note button.
mail/new controller is kept for compatibility but should be removed
before v11.
Move code related to redirection in its own class method. This way all
controllers perform their own actions and checks before calling the
redirection itself. Moreover it is necessary for some controllers to be
able to call the redirection independently outside of the mail/view
controller scope.
This commit also fixes some links generated for mail notification email
buttons. Assign and (un)follow buttons now effectively use the link helper
when generating the associated URL instead of manually crafting it.
Custom routes for notification buttons used in HR and CRM are added.
Indeed in order to be able to fine-tune the behavior called by those
buttons, using dedicated controllers is simpler than trying to use
a generic one. As there are few custom buttons in notification emails
using dedicated controllers does not lead to a code overhead.
mail/view controller is a generic controller that redirects the user to a
given view, depending on the record and the user. Users may be redirected
to the backend form view, or to a website view. This is done notably by
calling get_access_action method that gives the action to perform (act_window
or url).
Previously this method was called using SUPERUSER. However it was therefore
impossible to know who the user was. This method is now called using the
current user. Various overrides of get_access_action have been updated to
add some logic and access rights check directly in the method allowing
more fine-grain behavior of the access action.
* Assign controller now effectively redirects to mail/assign instead of
mail/assign
* Follow and Unfollow button now uses the helper that generated the link
When a request fail due to a database concurrency error, the request is
replayed. However, the `mail` overwrite of /longpolling/poll requests
modified its arguments inplace, which lead to a sanity check to failed
in case of retry.
Fixes#13121
FIX 1
-----
If the partner_id is not allowed, we return the placeholder.
Before this commit, the status as undefined and raise traceback.
UnboundLocalError: local variable 'status' referenced before assignment
FIX 2
-----
Fix the defaultheader to avoid to have:
[[('Content-Type', 'image/png')], ('Content-Length', 43)]
And so, during parsing by werkzeug:
ValueError: need more than 1 value to unpack
binary_content return '' if no picture, so, we keep the placeholder
if no image has been returned.
It avoid in the new portal with discuss widget to get the default
browser 404 picture (file broken)
This commit close#12683
The button "Convert to opportunity" in the mail notifications
sent when posting a message on an opportunity just coudln't
work as it attempted to call the `convert_opportunity`
method without one of its required method parameter.
opw-680017
Use the mention mechanism of the composer to autocomplete on canned responses
(keyword :) with fuzzy search.
Directly perform the string replacement in the composer, instead of
server-side as before.
Add a menu item to access an editable list view to create and edit canned
responses.
Add two canned responses as demo data.
When creating a new record, read_followers() was called without res_id and it
produced an error as the argument didn't have a default value. That argument
wasn't used anyway so this rev. simply removes it.
When loading a form_view with the follower widgets, an RPC was performed to get
the followers info (name, email...), and if the user is one of the followers,
a second RPC was done to retrieve the subtypes.
This rev. batches those two RPCs. Also simplifies read_subscription_data() as
it is now always called with a follower_id.
A few code refactoring as well.
Remove the RPC to retrieve the action_id of the client action as do_action()
can take directly the xml_id, and batch the RPC to retrieve the menu_id with
the initial RPC used to fetch channel slots, emojis...
Methods get_formview_action can be called by sudo() so for knowing the
real user they should prefer context['uid'] to uid.
Without the action `/web` can't figure out that e.g the view we want is
the one for portal user and not the default one.
With this fix, portal user (not in base.group_user) get to the intended
view with the intended menu when clicking on a invoice/sale order portal
mail link. As for other user there is no change.
closes#10681
opw-666260
Two RPCs were performed by the chat_manager on webclient launch. One of them
was about emojis, and recent messages received in the past 10 minutes in
detached channels. This RPC has been removed as the emojis fetching can be
done in the other RPC (mail/client_action), and the recent messages are not
useful since the refactoring of mail and the introduction of the chat_manager.
The route `/mail/unfollow` is used by the button
`Unfollow` in the mail notification template so a user
can remove himself from the followers of a thread.
To be able to remove yourself from the followers,
you need to have the write access on the thread
(see `message_unsubscribe` in `mail/mail_tread.py`)
which you perhaps do not have, for instance if you
are a portal user.
The unsubscribe of this follower from the thread
should therefore be done as sudo.
opw-659295
The purpose of this commit is to improve the overall performance of the mention
mechanism of the client action and chatter composer, by pre-fetching some data.
First, the employees are fetched at chat initialization (basically, at web
client initialization), if hr is installed.
Second, when focusing on the composer of a channel, the members of this channel
are fetched. In the case of a chatter, the members are already known as they
are the followers of the document.
When the user types a mention, we first display suggestions from the pre-fetched
partners, and we only perform an RPC when there are no more result matching the
search string. This RPC searches among user, and then partners if there aren't
enough matches.
A few side changes occurred:
- auto_join set to True on user_ids field of res.partner to boost the query
that searches partners that are users
- the '/mail/read_followers' route now returns follower's email as well, as
we need it for the mention;
- a partner can now be mentionned several times in the same message;
- mentionned partner previsualization has been removed, mainly because of
the previous point, but also because it simplifies the code;
As this method is overided in several modules, the mix of new and
old API makes it difficult to handle. Indeed in some cases we
receive the expected dictionary, sometimes in a list, sometimes
in a list of list, due to api.one decorator.
This is a change in the method API, however it is currently completely
buggy. Moreover this method is used internally and should not be
used as an external API. Lastly, this method is new from v9.
This controller is mainly used by im_livechat which don't send html message. It is more secure to force it in plain text. If anonoymous user write html tags, it will be escaped and sanitize.
Use the (dbname, 'ir.needaction', partner_id) channel to broadcast needaction to partner. Some message can be needaction, without belonging to a mail channel of the partner. Keep the (dbname, 'res.partner', partner_id) channel for conversation header.
Previous commit (3304b31938) was not performant enough for AL, so got special autorization to make a particular controller for mail.message author avatar. Avatar of message is avaiblable if current user has 'read' access right to the document. Otherwise the default avatar is one white pixel.
Christophe Simonis