Commit Graph
141473 Commits
Author SHA1 Message Date
Nicolas Martinelli 2269a66251 [FIX] stock_account: add total value
Add the Total Value in the Inventory Valuation tree view.

opw-2254718

closes odoo/odoo#51385

X-original-commit: c3dd38de2d60a40b61f364f1daa004f67b3d5137
Signed-off-by: Nicolas Martinelli (nim) <nim@odoo.com>
2020-05-18 08:03:01 +00:00
Yannick Tivisse 71c92e8ecb [IMP] hr_holidays: Fix time off plural labels
Purpose
=======

The noun time off is uncountable. The plural form of time off is also time off.

closes odoo/odoo#51370

Signed-off-by: Yannick Tivisse (yti) <yti@odoo.com>
2020-05-18 08:18:14 +00:00
Swapnesh Shah 57f2dc20a1 [IMP] hr*: correct term on warning
Followup on a3daff6

Use `time off` word instead of 'leave'.
2020-05-18 08:17:31 +00:00
std-odoo 1c7c837a10 [FIX] mass_mailing: improve opened traces tracking
Purpose of this commit is to improve tracking of opened traces. Notably
a token is added to ensure we do not mess with traces and have unique
tracking URLs.

MIGRATION REMARK

Emails sent before the migration will not be marked as opened anymore after
migration. We recommend to avoid sending statistically important mass mailings
about one week before migrating database. Indeed statistics show that most of
open emails happen within the first week after being sent.

Task 2223146

closes odoo/odoo#49139

Signed-off-by: Thibault Delavallee (tde) <tde@openerp.com>
2020-05-18 08:30:59 +00:00
Patrick Hoste 59265847aa [REF] website_slides: move from onchange / default to stored editable computed field
PURPOSE

Try to move from onchange / default_get to stored editable computed fields.
Behavior should be the same (computed or set by user), with support of
create / write / onchange field update without additional code.

SPECIFICATIONS

Update classic fields updated in some cases by onchange and/or default methods
by fields with store=True, readonly=False. It means their value comes either
from manual user input, either from trigger based computation.

Remove onchange and default_get when possible, leading to an unique computation
method and clearing fields definition.

Also clean some fields definition inconsistencies, notably required fields
that should instead be correctly computed or default that have no real meaning.

SPECIFICATIONS: WIZARD CLEANING

Remove email_from and author_id fieles defined on invite wizard. Those are
not used in this wizard (not available in view) and default value is to use
current user. We can simplify this wizard model by removing them.

LINKS

Task ID : 2229048
PR : #49040

Related: odoo/upgrade#1198
Signed-off-by: Thibault Delavallee (tde) <tde@openerp.com>
2020-05-18 08:11:58 +00:00
std-odoo 4476638931 [IMP] sms: improve technical view and usability
Purpose
=======
Clean up of the sms form view to match
what is shown in the composer.

Task-2244195

closes odoo/odoo#50465

Signed-off-by: Thibault Delavallee (tde) <tde@openerp.com>
2020-05-15 09:46:54 +00:00
std-odoo 2a2e5c7b1e [FIX] website_crm_partner_assign: escape interested partner comment
In portal an user can say he is interested by a lead and take it. He can also
post a comment. However this comment was not escaped, leading to possible
html injection.

As this comment is used to post a message no real issue occurs. It is sanitized
and behaves like every html content used in message_post. However we do not
want to support html here and therefore escape the content given to message
post.

Task ID 2228921

closes odoo/odoo#50537

X-original-commit: df5345618c4abbe8766a012b08ed90f1706c919a
Signed-off-by: Thibault Delavallee (tde) <tde@openerp.com>
2020-05-04 07:47:47 +00:00
Xavier Morel ac3cb21836 [FIX] SSF: handle o2m nesting
The SSF had pretty much punted on nested o2m as that's... not usually
a concern because few people are insane enough to put o2ms in their
o2ms in their views. And also because even if somebody did, sometimes
nothing would break because it turns out to be pretty difficult to
actually get into *using* those things.

MRP managed to do it though, and repro-ing required copying over parts
of mrp.production and then understanding why it didn't fail:

* obviously needs an o2m (f1) which contains an o2m (f2), in the
  view (an invisible tree inside a visible tree)
* needs an onchange which somehow updates the sub-o2m
* needs to actually trigger an onchange on the root form for f1,
  meaning f1 must be a dependency of a compute field or something (here
  I just marked every damn field as on_change as the optimisation of
  "don't call onchange when there's no need to" doesn't matter)

Also needs to be working on an existing record with existing
lines *and sublines* as the issue occurs with records to update.

The issue here is that `_onchange_values` would clean up f1 e.g. send
nothing for unmodified entries, and only send modified fields
otherwise, but it would only do so for the toplevel, meaning the
sub-level would not go through this step, and could send UPDATE
commands with an `id` field (set to the original value but
still). This would then proceed to blow up while loading the record,
as id fields are not writeable.

The fix is to perform `_onchange_values` recursively. Do that using a
separate helper in order to avoid blowing up on override and whatnot,
or faffling about with weird branching to get the "default" values in
case they're not provided, the root function can get all the relevant
bits and call the helper with them, then the helper does that setup
internally and calls itself directly.

An other issue I stumbled upon when investigating is a similar problem
on *save*, due to an implementation detail of the SSF: UPDATE commands
are fetched lazily.

`_values_to_save` took care of "hydrating" all update commands (and
validating and filtering them) of modified o2m fields, but as it would
not do so recursively a modified f2 would not get properly hydrated
and filtered, and could try to write `None` onto existing records.

closes odoo/odoo#51350

X-original-commit: 3dfb4cfad849936748cc6a5b8f712e100461a86f
Signed-off-by: Xavier Morel (xmo) <xmo@odoo.com>
2020-05-15 14:53:20 +00:00
fja-odoo 99910b526e [IMP] web, web_editor: integrate colorpicker in colorpalette
Stop using the colorpicker dialog in the colorpalette widget.
Integrate the colorpicker widget in the colorpalette widget. Of course,
the colorpicker behaviors are adapted so that no useless rerendering
of the colorpalette is made on each value change.

The 'reset color' button is now a button like the other colors, no need
for a 'color_reset' event anymore. It is removed and replaced with a
'color_picked' event with color being an empty string. The clear button
now also work on hover.

Also, the topbar colorpalette for text and text background colors now
has the exact same behaviour as the background colorpalette: adding
color preview on hover.

The colorpalette now also closes on 'enter' keypress.

Part of https://github.com/odoo/odoo/pull/46088
task-2195313

closes odoo/odoo#46088

Related: odoo/enterprise#8696
Signed-off-by: Quentin Smetz (qsm) <qsm@odoo.com>
2020-05-15 11:05:00 +00:00
fja-odoo a72c9adbe5 [IMP] web_editor, *: make Colorpicker a Widget
*: website, web

Move the colorpicker dialog logic into a colorpicker *widget*, which the
colorpicker dialog will now instantiate.

Part of https://github.com/odoo/odoo/pull/46088
task-2195313
2020-05-14 22:45:33 +00:00
qsm-odoo 57ec9049e2 [MOV] web: rename colorpicker_dialog.xml file
The ColorpickerDialog will become a widget, this commit is only about
renaming the related XML file.

Part of https://github.com/odoo/odoo/pull/46088
task-2195313
2020-05-14 22:44:28 +00:00
qsm-odoo 5863411437 [MOV] web: rename colorpicker_dialog.js file
The ColorpickerDialog will become a widget, this commit is only about
renaming the related file.

Part of https://github.com/odoo/odoo/pull/46088
task-2195313
2020-05-14 22:34:52 +00:00
fja-odoo 87f28adaac [IMP] web: make ColorpickerDialog smaller
Remove HSL from the color picker and make the dialog smaller.

Part of https://github.com/odoo/odoo/pull/46088
task-2195313
2020-05-14 22:34:43 +00:00
fja-odoo 79903abc3e [REM] web_editor: remove ColorPaletteDialog
Removing dead code.

Part of https://github.com/odoo/odoo/pull/46088
task-2195313
2020-05-14 22:34:36 +00:00
Martin Trigaux 5a7427fcf3 [FIX] account: allow manager to add bank account
The model account.setup.bank.manual.config (menu "Add a Brank
Account") was with the group account.group_account_user ("Show Full
Accounting Features").
Since 65530dfd6a, transient models have ACL and are not accessible
if the user does not belong in the group.
The account.setup.bank.manual.config model is triggered via the server
action account.action_new_bank_setting instead of a classical
menu. It's also displayed in an onboarding step of account.
Because of this, the group must be relaxed (and not just adding a
group of a view/action)

In saas-13.2, 65530dfd6a made simply the wizard appears in readonly
but in saas-13.4, since 56a8c9e431, trying to display a model on
which we do not have access produces and access rights error.

closes odoo/odoo#51330

X-original-commit: a4a2b8198d5d2d368e279929a5cdbcca0376d8ef
Signed-off-by: Christophe Monniez (moc) <moc@odoo.com>
Signed-off-by: Martin Trigaux (mat) <mat@odoo.com>
2020-05-15 11:15:22 +00:00
Martin Trigaux 74c1107512 [IMP] web: generate lowercase password
No more shouting master passwords

closes odoo/odoo#51327

Signed-off-by: Martin Trigaux (mat) <mat@odoo.com>
2020-05-15 10:47:55 +00:00
Laurent Smet 318325a74a [IMP] account: Add default label on payment's journal items
The label of the journal items generated for a payment is the
communication. However, this field is not required leading to
journal items with an empty label.
This doesn't lead to a good usability when opening the reports or
when trying to edit manually the journal entry because the label
is required on the form view.

closes odoo/odoo#51275

Signed-off-by: Quentin De Paoli (qdp) <qdp@openerp.com>
2020-05-15 06:20:33 +00:00
Odoo's Mergebot e15d9f2930 [IMP] website_forum: back2basics
Improve ranking display
Improve backend view
Fix share popup displayed on invalid post
Fix ranking search
Fix Upvote allow when already downvote
Allow to edit FAQ (karma out of accordion)
Add list view mode on forum index
Add last_post / Number of post on forum index
...

task-2201708

closes odoo/odoo#46634

Signed-off-by: Jérémy Kersten (jke) <jke@openerp.com>
2020-05-15 13:05:58 +02:00
Okan SUMER (osu) f759a316f6 [IMP] website_profile: add badge breadcrumb and profile rank
This commit add a breadcrumb in the badge frontend view to redirect
to the last page the user was.
It highlights the user profile line in ranking view (profile/users).
It add this line at the top of every pages except for the one where
it already was.

Part of https://github.com/odoo/odoo/pull/46634

task-2201708
2020-05-15 08:40:14 +00:00
Okan SUMER (osu) 645056554e [IMP] website_forum: frontend improvements and corrections
This commit adds new features and corrects some others in the frontend
of website_forum app.
- In the "about" section of a forum, use the s_accordion instead
  of a custom one for the first 3 elements, the last one is on a
  new page accessible from a link below the accordion
- Cut the description after a specific amount of characters in the
  page where all forum are listed
- In that same view, create options that show the number of post
  and the last post a forum has. Create an option to render forums
  in list view
- Allow the user to cancel his vote (down or up)
- Hide the answer box in the post view. Make it appear when the user
  click on the "answer" button
- Use a JS public widget to validate a Post form (new, save, comment)
- Enable the modification of a forum's image from the frontend
- Hide Solved/Unsolved categories in "Discussion" forums
- Disable the possibility to add snippets to an answer
- Corrections of tours that broke after these modifications

Part of https://github.com/odoo/odoo/pull/46634

task-2201708
2020-05-14 18:27:00 +00:00
Okan SUMER (osu) b869020401 [IMP] website_forum: improve tree and form view
This commit add a lot of features and information about forum.forum,
forum.post, forum.tag.

- Correct the forum and post tree view to correctly render the number
  of posts, answers, views and favorites
- Add a Status column to post tree view
- Add stat buttons to redirect to the frontend
- Add stat buttons to highlight datas in forum.forum and forum.post
- Make the tree view of forum.tag editable
- Add buttons to change the state of a forum.post in the form view
- Add post close reason menu and views

Part of https://github.com/odoo/odoo/pull/46634

task-2201708
2020-05-14 18:27:00 +00:00
Okan SUMER (osu) bfb70b6b9c [IMP] website_forum: rename fields, labels, texts,...
This commit rename every "Question" references by "Post"
to make it appropriate for both forum's type (Question and Discussion)
It renames some other fields/labels to be shorter or with a
capital letter at the start.
Update demo data to add a title to answers

Part of https://github.com/odoo/odoo/pull/46634

task-2201708
2020-05-14 18:27:00 +00:00
Okan SUMER (osu) 87a1b54717 [IMP] gamification: improve tree and form view
This commit improve the tree and form view of gamification.karma.rank
and correct a bug on auto generated email when a user pass to the
next rank.

- Add a stat button in form view and column in tree view to know
  how many users have the current rank
- Split Description and Motivational in 2 pages
- Hide the line that mention the next rank the user can get when
  there is no more rank to get in email templates
- Add a menu to access badges tree view

Part of https://github.com/odoo/odoo/pull/46634

task-2201708
2020-05-14 18:27:00 +00:00
Antoine Prieels 5a8467b751 [IMP] doc: Reference for IoT Interfaces
Add documentation for development of new Interfaces for the IoT Box.

closes odoo/odoo#39759

Taskid: 2092878
Related: odoo/enterprise#6552
Signed-off-by: Quentin Lejeune (qle) <qle@odoo.com>
2020-05-13 13:26:05 +00:00
Antoine Prieels e5d25e98b4 [IMP] hw_drivers: Give a priority order to drivers
Previously, we tested the `supported` methods of all drivers
sequentially in alphabetical order of file names. If you wanted to
extend a driver, the `supported` method of your driver could never be
tested if the one of its parent was tested first.

We've now added a priority order to drivers so that by default the
extending driver will always be tested before the extended driver.

You can still do something similar to what `is_tested_last` did by
manually setting the priority of a driver to 0.

Ex: The way barcode scanners is really similar to keyboards, but still
requires a few modifications in the driver. We couldn't extend the
keyboard driver easily because the supported method of barcode scanners
had to be more strict than the one of keyboards. If the
KeyboardUSBDriver was tested first, scanners were recognized as
keyboard and didn't have all the specific features of scanners.

TaskID: 2082282
2020-05-13 13:26:05 +00:00
Antoine Prieels e1c52c936d [IMP] hw_drivers: Easier detection of new devices
Until now, to detect new types of devices on the IoT Box, we had to
modify driver.py. If partners wanted to connect a new type of device,
they had to modify directly the files on the Box, meaning that after
each new build they had to re-apply all their modifications.

We remove the loops that detected the connected devices and replace
them by `Interfaces`. All interfaces will be loaded from the connected
Odoo instance with the corresponding drivers.

TaskID: 2082282
2020-05-13 13:26:05 +00:00
Swapnesh Shah bea1613f11 [FIX] stock,stock_account: fix undefined variable and return True
Fixes #29694
Close #47204
Fix #37554

Before this commit, There was Traceback on calling this method w/o any inventories as variable `res` was not declared but Returned or Calling this methord over RPC will raise TypeError as this method does not returns amything.

In this commit, We return True at original `post_inventory` method and Declare `res` to prevent undefined variable.

closes odoo/odoo#51320

X-original-commit: cfb2f00ae2fcbe33184d76383e3b624700101a75
Signed-off-by: Nicolas Martinelli (nim) <nim@odoo.com>
2020-05-15 09:14:06 +00:00
David Beguin 0cc6a76891 [IMP] crm: improve automated probability cron
Purpose
=======

Update Lead Probability CRON is currently running in a single transaction
and is locking lead table for too long.
This task aim to improve the performance of the cron by:
- reducing the number of update (instead of updating one by one the leads,
  update all lead with same value to update)
- Making it multi-transactional (to avoid locking table during
  the whole process)

Spec
====

- compute probability and automated probability values with only 2 decimals
  (needed to compare new and old probability + to avoid too many values
  in the group by probability)
- Group the leads to update by Probability value (rounded by 2 decimals)
  Note : This commit doesn't change the field definition to avoid migration.
- Update leads by batch of limited number (=step), to avoid transaction to take
  too long. After each batch execution, commit to unlock the table before
  continuing with next batch.

Task ID: 2224677

closes odoo/odoo#51310

X-original-commit: ee346936efc6cabce14cb73223ecd2e6a0cc1e3f
Signed-off-by: Thibault Delavallee (tde) <tde@openerp.com>
2020-05-15 08:35:35 +00:00
Jorge Pinna Puissant a63a314f20 [FIX] crm: update email alias when crm setting is modified.
-Configure alias on sales team;
-Send email, opportunity is created for sales team;
-Enable leads on CRM settings and enable leads for sales team;
-Send email to alias, lead is created for sales team;
-Disable leads in CRM settings;
-Send email to sales team alias;

Before this commit a lead is created even those these have been disabled
in CRM settings and you cannot access this menu anymore.

Now, an opportunity is created for sales team.

opw-2244379

closes odoo/odoo#50943

X-original-commit: 3e9f07e8fe2f31b66087db4b0fc274df2e6253c8
Signed-off-by: Jorge Pinna Puissant (jpp) <jpp@odoo.com>
2020-05-15 07:50:39 +00:00
jbw 26175ea7a1 [IMP] account : remove analytic default modules
Merge account_analytic_default into account
Merge account_analytic_default_hr_expense into hr
Merge account_analytic_default_purchase into purchase

Prevent having to manually install default modules after activating analytics

closes odoo/odoo#50816

Task: 2182900
Related: odoo/upgrade#1186
Signed-off-by: Quentin De Paoli (qdp) <qdp@openerp.com>
2020-05-14 07:53:18 +00:00
Yannick Tivisse 152097d099 [IMP] hr*: Use correct default employee_id based on company
Followup of https://github.com/odoo/odoo/pull/50982/commits

Courtesy of https://github.com/sswapnesh

In a multi-company environment `self.env['hr.employee'].search([('user_id', '=', self.env.uid)], limit=1)` could be wrong while `employee_id`represents correct employee based on company.

https://github.com/odoo/odoo/blob/fb17af76d791488c69eb3829376940b32998d374/addons/hr/models/res_users.py#L13

Making behavior Similar to https://github.com/odoo/odoo/blob/fb17af76d791488c69eb3829376940b32998d374/addons/hr_expense/models/hr_expense.py#L663

closes odoo/odoo#51246

Taskid: 2254687
X-original-commit: d7d1557e7a0f613335a9ca5ca1355d246093f9d1
Related: odoo/enterprise#10599
Signed-off-by: Yannick Tivisse (yti) <yti@odoo.com>
2020-05-15 07:06:59 +00:00
Julien Castiaux b6537c4335 [REV] base: restore removed deprecated osv and exceptions
To ensure backward compatibility, stuff removed by ab4000fb3 have
been restored.

closes odoo/odoo#49603

Task: 2234749
Signed-off-by: Raphael Collet (rco) <rco@openerp.com>
2020-05-14 14:00:41 +00:00
Stéphane Debauche 55cb0de1db [IMP] tools: remove unnecessary lxml Cleaner override
Purpose
=======

Currently a custom override of Cleaner.allow_element()
exists in tools to allow object tags for SVG images.
This was due to the first prototype of website builder
and its first implementation of image and svg management.

This is not necessary anymore as using the tag is sufficient.
We can safely clean code in the cleaner, allowing to speedup
its performances. As it is used in most html fields and email
parsing each unnecessary code removed is time gainged.

Task 2215228

closes odoo/odoo#51294

X-original-commit: 4a0b09fd3b0d3b63f2df00f002e4d6825cac4eef
Signed-off-by: Thibault Delavallee (tde) <tde@openerp.com>
Signed-off-by: Martin Trigaux (mat) <mat@odoo.com>
2020-05-14 18:51:22 +00:00
fja-odoo c54824dfee [IMP] website_forum: hide negative karma posts
Currently posts are hidden at the post level only (by giving a 404).
The posts are still visible in the list of posts on the main forum page.

Now we hide the posts of users with negative amount of karma.

task-2093636

closes odoo/odoo#46194

Signed-off-by: Jérémy Kersten (jke) <jke@openerp.com>
2020-02-25 09:05:02 +00:00
Goffin Simon 969ea2a0d3 [FIX] account: Wrong base amount with included tax
Fine tuning of the test of https://github.com/odoo/odoo/commit/d9eaae8acc600f936fbc4fa48a49a7f4d65fcd7f

As the journal was not explicitely set, a default journal with a company different that the one set up from
function setUpClass() defined in class InvoiceTestCommon

So a traceback was sometimes raised in the test saying:

Some records are incompatible with the company of the Journal Item.\n\nIncompatibilities:\nFields: account_id\nRecord ids: 1809, 1810, 1811

opw:2244708

closes odoo/odoo#51285

X-original-commit: dd40fb63b4ebdd4dd7b44c75d415e99b52d633a1
Signed-off-by: Laurent Smet <smetl@users.noreply.github.com>
Signed-off-by: Simon Goffin (sig) <sig@openerp.com>
2020-05-14 16:39:08 +00:00
Lavish Chhatwani 35308b674c [IMP] crm: display currency after Expected Revenue in lead list view
This commit displays the currency of the `Expected Revenue` field of
lead in the list view.

Known drawback : the sum is not correct if multiple currencies are involved.

Task-ID 2238661
Closes #49954

Signed-off-by: Thibault Delavallee (tde) <tde@openerp.com>
2020-05-14 13:17:48 +00:00
Julien Castiaux d6d0e8d6d2 [FIX] models.py: remove leftover import crm like compatibility
Historically, it was possible to import addons via a naked import. It is
no more possible since 9e1f13bac, since that commit, the only possible
way to import odoo addons is via the `import odoo.addons' prefix.

closes odoo/odoo#46995

Signed-off-by: Raphael Collet (rco) <rco@openerp.com>
2020-05-14 14:40:02 +00:00
jvm-odoo 975deb21da Revert "[FIX] sale_product_configurator: fix mobile product template search"
This reverts commit eda451f99fe050bace503d422ebb1a3842c046e7.

closes odoo/odoo#51270

X-original-commit: d7e7eb65aa9f45f78e636360bfaa7277204ba0ff
Signed-off-by: Jason Van Malder (jvm) <jvm@odoo.com>
2020-05-14 13:41:09 +00:00
jvm-odoo 9b16e2db8a [FIX] sale_product_configurator: make it works on mobile
With this code, we can do an XML customization on
customers database if they want to have the product
configurator.

Note that this is not the entire feature, just
a "workaround" waiting for a real feature.

OPW-2214095

X-original-commit: ad467a6c1e1e1905ca43912047de4897f3a8fc8c
2020-05-14 13:41:09 +00:00
Victor Feyens 88f3d9c076 [FIX] project: company creation
* Wrong environment for project & task creation
On company creation, a leave project and task are created, but with the
wrong environment, potentially leading to inconsistent values in a
multi-company environment.

* Company creation in batch
Also fix the create override decorator to specify the create override
supports batch creation of companies.

closes odoo/odoo#51264

X-original-commit: e6bd644851819692eeddadaa50950efd0f83f6d9
Signed-off-by: Victor Feyens (vfe) <vfe@odoo.com>
2020-05-14 13:27:08 +00:00
Dharmraj Jhala ad6ea605ab [IMP] crm, event, website_crm_partner_assign: remove useless copy attributes
Editable stored fields are copy by default if their base field
allow it (char, integer, ...). Purpose of this commit is to remove
unnecessary copy=True statements added when using stored editable
fields.

PR #49464
Task 2225253

Signed-off-by: Thibault Delavallee (tde) <tde@openerp.com>
2020-05-14 13:14:45 +00:00
Martin Trigaux b334dfcbd2 [IMP] web: force a master password on insecure dbs
When creating a new database, a random master password for it is
generated and strongly suggested to be used.

The motivation for this change is to have, by default, a secure master
password set for any Odoo deployment.
Often, users do not realise that, when making an Odoo installation
accessible on internet, anyone else can also access it.

Use autocomplete="new-password" for updating the master password and
play nice with password managers
When generating a new password, use autocomplete="new-password" as
well to prevent autofill of password potentially saved in password
manager.

Make the eye click to toogle on click instead of need to maintain.

closes odoo/odoo#45117

Task-id: 2091260
Signed-off-by: Martin Trigaux (mat) <mat@odoo.com>
2020-05-14 13:45:40 +00:00
Odoo's Mergebot f6ed407712 [MERGE] base: remove read access to ir.ui.view
Only system and designer users can access `ir.ui.view` records.
An employee, portal or public user should not be able to read a view arch, while
ok in standard (all views are in the code anyway), one may want to integrate
confidential business logic in some views.
All operations on views must be done in `sudo` or use helpers like
`fields_view_get` or `_render`.

This PR is part of the long-term task id 8203 that plans to remove all access to
`ir.*` models

**Changes of ACL**:
- remove read for all on `ir.ui.view`
- remove read for all on `website.page` (uses `_inherits`)
- add read on `ir.ui.view` for website publisher (cf `read_template`)
(maintain all for system and designer)

**Changes of method**:
- `fields_view_get` uses `sudo`. Can only be called only if we have the read
  access on the linked model.
- `render*` becomes private `_render*` and uses `sudo`. Shouldn't be able to
  arbitraly render any template. A QWeb template is not linked to a model so
  can't apply the same ACL check as in `fields_view_get`.
- `read_templates` remains public but without `sudo`. It is called by the method
  `load` method (now private too) or by the web_editor module

**Changes of behaviour**
- the `groups_id` parameter may be used on a view to relax the access and allow
  a specific group to access its content (e.g. frontend assets for employees)

closes odoo/odoo#44993

Signed-off-by: Martin Trigaux (mat) <mat@odoo.com>
2020-05-14 16:21:54 +02:00
Victor Feyens 51bc8ef124 [IMP] doc: Image field documentation
It was considered important to precise that image fields without 
limitations weren't checked
at all and could therefore contain non image content (and precise some 
other things on Image fields).

Forward-port of #51200

closes odoo/odoo#51259

Signed-off-by: Victor Feyens (vfe) <vfe@odoo.com>
2020-05-14 13:19:58 +00:00
Martin Trigaux 64d0dab0a6 [FIX] *: add group_ids where it is needed
Following the previous commit adding access via groups_id
These views are rendered publicly by specific user
2020-05-14 13:59:10 +02:00
Martin Trigaux 8eb575a1cf [IMP] base: allow using groups_id on ir.ui.view
Allow groups_id on top level view as a way to relax the access of some
views

There was some scenarios where ir.ui.view were still needed to be
accessible.
For instance the website.snippet is needed to display the website
editor sidebar to designers. The website.compiled_assets_wysiwyg is
needed to display the app switcher on the website to employees.

This should cover most of the cases where a view still must be
accessible and no specific controller is available.
2020-05-14 13:59:10 +02:00
Martin Trigaux d879300944 [REM] website: remove lazy template call
Was making a render_template on an arbitrary template
Does not seem to be used anymore
2020-05-14 13:59:10 +02:00
Martin Trigaux d9287caf94 [IMP] *: convert to private methods
render, render_template, load, activity_schedule_with_view,
get_website_pages should all be private:
It should not be possible to render an aribtrary template only with
its name or id

Still need to render some qweb views from js so the method
render_template is kept public.
This explains why the website editor still need read access on
ir.ui.view as we want to allow any snippet to be rendered.
2020-05-14 13:59:10 +02:00
Martin Trigaux 56a8c9e431 [FIX] *: add sudo when accessing views
The method fields_view_get should be the only way to retrieve the view
content. This method is executed in a super-user context.

To avoid retrieving views for a model a user does not have access to
(as it may reveal some informations like name of fields), add a
verification of 'read' rights before retrieving the view content.

Execute _postprocess_access_rights with sudo(False) as this method is
used to evaluate which buttons should be displayed.
Remove the su flag to avoid misleading the user and displaying a
button they won't be able to use.

Retrieving the database id from an view key is not considered as a
sensitive information and get_view_id and viewref can be left as a
public methods.

Add missing sudo when needed

Change _handle_visibility in website to avoid increasing the query
count: Checking the visibility (to fail most of the time) to retry in
sudo was making unecessary queries.
2020-05-14 13:59:10 +02:00
Martin Trigaux ccc98e0169 [IMP] base: remove read access to ir.ui.view
Only system users should be able to access directly ir.ui.view records
Other users should use helper methods like fields_view_get or render
to interact with view records (or use sudo)

Give read access to views to publisher
He needs to call read_template on some views like
'web_editor.colorpicker' in edition mode

Restrict ACL on website.page
Apply the same ACL than on ir.ui.view as the model inherits from it.
Give access to designer to modify views
2020-05-14 13:59:10 +02:00