This branch adds request.redirect on all requests.
In case of a front end request, we do an url_for to the location.
We removed redirect_with_hash that was only for retro compatibility
local_redirect has been renamed to redirect_query, and param keep_hash has been
removed and moved.
Default code for redirect is 303 now instead of 302.
Now redirect and redirect_query make local redirect by default, you need to
pass local=False to make external redirect.
All werkeug.utils.redirect has been replaced by request.redirect.
Http.redirect now use an http.Response type, and it become easy to add an
override like 'set_cookies' e.g.
Dispatch of a website.page return an http.response too, so we first need to
check if it is a cached version before to check if it is an Odoo Response.
Migrate your code:
http.redirect -> request.redirect(location, code, local)
http.local_redirect -> request.redirect_query(location, query, code, local)
http.redirect_with_hash -> request.redirect
Courtesy of odony for help and review ;)
closesodoo/odoo#72599
Signed-off-by: Jérémy Kersten (jke) <jke@openerp.com>
The company is needed in the context to get the paper format for
instance because of `get_paperformat`
X-original-commit: a1526eb4e5b1eb7cada603d7fcee7bb77c64bbac
Issue
- Install "Sale" app
- Acivate "Discounts" feature in settings
- Create a quotation to a portal user (ex: Joel Willis)
- Add a product with a discount then send
- Logout then login as 'Joel Willis'
- Go to 'My account' then 'Quotations'
- Select the quotation just created and print it
Discount not display in pdf file.
Cause
The current env.user when rendering pdf is the portal user.
To display discount, current env.user must have group
'product.group_discount_per_so_line' who is not the case
even when using sudo() on report template.
Solution
Since Odoo 13.0, the sudo() function does not return the
superuser by default but instead the current user
with a bypass on access rights.
Therefore, must add `.with_user(SUPERUSER_ID)` on report.
opw-2501337
closesodoo/odoo#69272
X-original-commit: 5dde19c92ecee8ac0238bb5c8e71263840534c28
Signed-off-by: bon-odoo <nboulif@users.noreply.github.com>
1) in this commit, improved portal chatter for messaging. when the user sends a
message, the new message is updated in history without reloading page.
instead of submitting a form which reloads page to send message we added rpc call
to send message.
2) rating on courses is implemented by extending portal chatter, applied changes in
website_slides to do reviews without reloading page
3) refactoring: cleaned or removed code
eg. removed form and some input fields as data is not submitted as form anymore,
introduced some methods to avoid duplication of code
task-2054662
Closes https://github.com/odoo/odoo/pull/47746closesodoo/odoo#47746
Signed-off-by: Samuel Degueldre <sdegueldre@users.noreply.github.com>
Co-authored-by: ktr-odoo <ktr@odoo.com>
Co-authored-by: Siddarth Gajjar <sga@odoo.com>
This commit adapts the business code in which
class/module/function/method redefinition took place so that it no
longer happens and the pylint test passes.
PURPOSE
Clean code and be and more performance oriented.
SPECIFICATIONS
Various portal pages hold references to archive_groups. It was a summary
of customer documents for portal, containing a count of all documents split
by model.
Currently its computation is not used. Indeed archive_groups is displayed
only in 'my_details' page that does not hold any document-based reference
or code call. Other calls to archive_groups are dead code as the result is
not used. Since 13.0 it is even not computed on standard pages to speedup
their load (as it was not used).
It is not used anymore and its computation and references can be removed
safely, especially with v14 in mind for which we want to remove dead code
to maintain.
Followup of odoo/odoo#55228
LINKS
Task ID-2329081
PR odoo/odoo#55800
PR #12368closesodoo/odoo#56859
X-original-commit: e75086000ee4317b2ad2994db5d906fbcbd5081f
Related: odoo/enterprise#12830
Signed-off-by: Thibault Delavallee (tde) <tde@openerp.com>
Signed-off-by: Victor Feyens (vfe) <vfe@odoo.com>
Before this commit, the time to compute all counters was making the rendering
of the portal page slow.
Now the count is done in rpc after the loading of the page.
Now you can decide which part you want to show on the portal, and only compute
for these one.
It is not because you have purchase installed for your internal process, that
it means that your supplier use your portal and it avoid the computation for
all end users.
We parallelize the counters in arbitrary 3 rpcs.
closesodoo/odoo#55999
Related: odoo/enterprise#12456
Signed-off-by: Jérémy Kersten (jke) <jke@openerp.com>
* allows portal users to update their password
* and manage their API keys
* any anything technical / security related we may need to add in the
future
Also bridge module for the password meter (auth password policy).
* migrate website to overriding web_login less (still needed to flag it
as website-enabled) and use _login_redirect for its login redirection
override needs
* modify portal and website to not replace / shortcut the redirection
workflow, so it's possible to override those properly if / as
necessary
Before this commit, some errors were shown to the end user when
he tried to login to the mobile app with a portal user.
The problem is the user was stuck to a blank page and wasn't
able to logout even after reloading the app.
Note that even if portal users aren't supposed to access to the
backend, it's quite annoying to not be able to go back.
After this commit, portal users are automatically redirected to
the portal page ("/my") if they try go to "/web". This is the same
behavior as when portal users login via "/web/login".
By doing this we avoid having custom code in the native apps
because we already avoid any login to the app if we are out of "/web".
Note: this commit doesn't cover all cases as portal users are defined in
the "base" module and the portal page is set in the "portal" module.
So this this fix will not work if "portal" is not installed and if you
manually created a portal user (only possible in debug mode).
This is unlikely and we therefore consider that this fix covers the
majority of cases while being the safest.
Task ID: 2266024
opw-2281168
closesodoo/odoo#55439
X-original-commit: 29cbba73a71990e76f497ee892ce16fc7fc53d9f
Signed-off-by: Adrien Dieudonné (adr) <adr@odoo.com>
The record counts are only useful for the badges displayed in /my &
/my/home.
By avoiding those counts on subpages, we gain a lot of useless queries,
improving the loading speed of those sub-pages.
X-original-commit: 79c8384f1bcbcdede030e187008319a70c664571
Using a few regex like
\((_\(.*%s.*)(\) % )([\w\[\]][\w .\[\]\(\)'"]*)\)
($1, $3))
Old syntax is still compatible but starts the migration to the new
syntax that catches error.
Bugs
====
On e-commerce, the portal user is not able to upload
attachment with his comment, under a product.
On website blog, the portal user is not able to upload attachment with
his comment, in the discussion of the blog.
And, in `website_crm_partner_assign`, portal user is not able to upload
attachment with his comment, under the lead/opp.
Issue
=====
In the create method of the mail message, we check is the user can
read the attachment. If he can't, we raise an error.
But, the method that make the verification doesn't care about the access
token. So, when a portal user want to upload an attachment on a "public"
record (without a token on the record to sudoed it) the error is raised.
The portal user give an token for the attachment, so he should be able
to attach it to the message. This verification is done with
`_portal_post_check_attachments` so we can sudo write the attachment
after the creation of the mail message to bypass the verification.
Task-2214795
closesodoo/odoo#51772
X-original-commit: d59f8f62dbc7771fee51c3593f89f9b6832bb7ec
Signed-off-by: Thibault Delavallee (tde) <tde@openerp.com>
render, render_template, load, activity_schedule_with_view,
get_website_pages should all be private:
It should not be possible to render an aribtrary template only with
its name or id
Still need to render some qweb views from js so the method
render_template is kept public.
This explains why the website editor still need read access on
ir.ui.view as we want to allow any snippet to be rendered.
PURPOSE
Clean posting process and improve mail.message definition and comprehension.
SPECIFICATIONS
Website mail defines a website_published field allowing to publish / unpublish
comments on the frontend of some modules. This field has several drawbacks :
* it is used only for front-end people (portal, public) and has no real
effect in chatter / classic discussions;
* it is used only in some advanced front-end module and is not available
in portal by default;
* its naming is not really correct as it is not linked to fields coming
from the website_published mixin and its behavior is not really
the same;
* its use is a bit duplicated with internal flag coming from subtype
allowing to hide messages related to an internal subtype;
* there are overrides of standard mail.message methods just to handle
this flag;
In this commit we change that field by an is_internal flag directly on
mail.message model itself. It tells if share people (customers, share users)
are allowed to read the message. This field can be given through posting
API or set manually using widgets. It is also used in access rights custom
methods and managed like the internal flag of subtypes.
Mailgateway was already using an internal flag for internal note replies. It
is renamed to is_internal and propagated as it is now a standard field. It
also eases code understanding.
Portal is updated to allow managing the flag directly. It means customer portal
now natively allows to moderate customer comments without any need of website
modules.
Rating is updated accordingly. An is_internal field is added, replacing the
related on website published.
LINKS
Task ID 2071556
PR #38692
PURPOSE
Clean posting process and improve mail.message definition and comprehension.
SPECIFICATIONS
In order to be more explicit subtype parameter is renamed to subtype_xmlid.
It therefore clearly indicates it should be a valid subtype Xml ID. Support
of ill formatted Xml IDs is removed because there is no reason to try to
add some random prefix. Give something that exists or go to hell, punk !
LINKS
Task ID 2071556
PR #38692
Steps to reproduce the bug:
- Create a portal user U
- Try to update the details of U from portal
Bug:
A server error was raised because the country_id was set as a character.
opw:2082450
closesodoo/odoo#38924
X-original-commit: 009b632c552822cb9892a2ccdbe9d79947d88a34
Signed-off-by: Simon Goffin (sig) <sig@openerp.com>
Go on the portal with a portal user
Drop a message in the chatter
The message is logged in the chatter from the right partner
Before this commit however, the email that was sent had
its address from of the OdooBot
After this commit, the mail is sent with the partner's email from
OPW 2074154
closesodoo/odoo#38553
X-original-commit: 2ce5d3840c7c43a2226b007a180cb91c5031312c
Signed-off-by: Lucas Perais (lpe) <lpe@odoo.com>
PURPOSE
Allow to manage attachments when updating a frontend review.
SPECIFICATIONS
Currently when posting a review in eLearning or eCommerce one can attach
files to its review thanks for portal composer. Rating popup composer allow
to update its comment and rating. However this edit mode has two limitations.
It does not display attachments previously added and does not allow to add
attachments.
This commit fixes that by
* giving attachment values to the composer, allowing its display by the
composer display at startup;
* allowing to give new attachments and properly handle them in slides
route;
Uploaded and validated attachments cannot be removed by users. Indeed
message with attachments has probably already be sent to people and removing
attachments would lead to information loss.
LINKS
Task 2066600 (manage attachments)
Task 2058595 (eLearning v13 testing)
From the user's frontend "My Account" page:
- Try to edit your details.
- Complete the form with all required fields.
- Select a country for which there are no states
(the `state_id` field is hidden)
- And confirm
=> Internal server error
The state was not filled, therefore the value sent to the server
is an empty string. This empty string is used in the UPDATE
query to register the state value. Since it's a string and
not a valid (integer) id, the query fails.
closesodoo/odoo#36272
Signed-off-by: Yannick Tivisse (yti) <yti@odoo.com>
Follow up of 3620cb68a0
`split` called on an empty string returns a list containing the empty string.
The previous commit assumed it was returning an empty list.
closesodoo/odoo#35773
Signed-off-by: Christophe Simonis <chs@odoo.com>
Follow up of 61de1c263a
- Remove the dangerous **kw from the route in favor of specifying useful args.
- Use the existing method to link attachments to message instead of duplicating
the logic in an incomplete manner.
- Fix an issue where the actual email would not be sent if the message was empty
but an attachment was defined.
- Ensure the send attempt is done immediately instead of after the cr commit.
The goal is to show potential error messages correctly to the user with the
crash manager instead of a generic error page.
This also increases the send timeout and prevents the error in the first
place in most situations.
closesodoo/odoo#35263
Signed-off-by: Christophe Simonis <chs@odoo.com>
Purpose of this commit is to move notification methods to mail.thread. Indeed
currently they are split among several models: thread, message, partner.
It makes code difficult to understand. Base record has to be propagated in
order to run methods on it. It is therefore simpler to make those methods
on mail.thread and correctly have model methods.
All notification methods are moved into a single section in the mail.thread
file. This implies some more code move inside mail.thread but allow to have
methods classified by their purpose.
Related to task 1943901
Linked to PR #32404
Message post should always be called on a record (ensure_one). That way we
ensure posting a message is always done in a record's context with right
values computed (reply_to, followers, ...)
Message_notify can be called on record or on mail_thread and must have
partner_ids. It is based on the recently modified user_notification mechanism
and allow to notify a partner on a record or just to push him a message
(aka, not linked to a record).
Small performance improvement
* browse recipients instead of search in _notify_email_recipients;
* todo in future optimizations: mayybe be improve by searching on ids
and is_blacklist immediately;
Related to task 1943901
Linked to PR #32404
Before this commit, it was only possible to add attachments on documents from
the backend or by sending them by email.
It is now possible to add them also from the portal chatter, including for
portal/public users who have a valid access_token.
Part of task-37264
closesodoo/odoo#34526
Signed-off-by: Olivier Dony (odo) <odo@openerp.com>
Co-authored-by: Pratima Gupta <pgu@odoo.com>
Co-authored-by: Sébastien Theys <seb@odoo.com>
No more modal because it's not visible and less handy. Use same behavior as
sales order portal.
Adapt the invoice style to properly adapt and align with the chatter block.
Part of task-37264
closesodoo/odoo#34360
Signed-off-by: Quentin Smetz (qsm) <qsm@odoo.com>
Co-authored-by: Pratima Gupta <pgu@odoo.com>
Co-authored-by: Sébastien Theys <seb@odoo.com>
Since 1e6c3bec2c that refactored the sudo in general, the
`_document_check_access` method from portal that was supposed to return the
document in sudo mode was not returning the expected record.
It was not with the admin UID, making some code to crash, for instance:
https://github.com/odoo/odoo/blame/120f890ecf57969878399d9543b49080e7618c60/addons/stock/models/stock_quant.py#L252
Which is doing `self.with_user(self._uid).check_access_rights('read')`.
Step to reproduce:
- Install `sale_stock` module.
- Create a quotation for a portal user
- As the portal user, try to sign the quotation
- It will crash on `stock.quant` right access
closesodoo/odoo#35030
Signed-off-by: Xavier Dollé (xdo) <xdo@odoo.com>
The field website_published is not ensured when module portal
is installed because the module portal doesn't depend on module
website_mail.
PS:The module website_mail depends on the module portal because
website_mail depends on website and website depends on portal.
opw:1997478
closesodoo/odoo#33452
Signed-off-by: Simon Goffin (sig) <sig@openerp.com>
If there are too much users to show on the page and to avoid performance
issues, a pager is now applied on the all users page.
A new pager based on website_pager is added in order to ease the navigation
through the potential high number of pages. 'Go to first page' and 'Go to last
page' buttons have been added and the design of the pager have been adapted
to be more integrated into the new eLearning platform.
Also add the pager on the slide page if search category is applied. The pager
was already computed in the controller but not displayed.
Task ID : 1946160
PR #31697
This commit e84779749b factorize the check of
special access to post a message using a token mecanism, but it breaks the
case without token. Indeed, on some models, it is allow to post a message
on a document when having a certain access. This is handle with the
`_mail_post_access` attribute on model inheriting mail.thread.
Using this mecanism, a user that can read (or write) the document can also
post a message. This is used in the eShop to review product and in blog to
comment blogpost.
This commit restore posting a message without token. the normal access rights
will be applied by message post and raise if the user can not post message,
taking `_mail_post_access` into account.
The balance is now restored in the universe.
Task-1902304
Add a new widget for binary fields. It open a dialog box and the user can sign manually,
or an signature can be draw automatically or he can upload a picture of his signature.
Move fonts, controller, scss,templates about signature from portal to web to avoid redundance
closesodoo/odoo#30222
To post a comment with a signed token, we compare tokens with the pid.
The token is signed with the pid, which is an integer. When checking
access, we compare the token with a pid as char. Obviously, the comparison
failed, and posting the message is refused, as the 2 'pid' does not
share the same type.
This commit cast the recieved 'pid' into an integer before checking
special access.
closesodoo/odoo#30906
When a portal user post a message to review a channel, we
want to allow him to edit its own comment and rating.
This commit modifies the special check access method in
portal to extract the security check and reuse it to
allow user to update its comment on slide.channel only.
We decided to reuse existing widget (new rating popup
composer) to do the message modification.
Task-1902304
Jeremy Kersten