Odoo/addons/payment_transfer/controllers/main.py, branch 14.0

[IMP] payment: UI/flow

2019-08-12T08:44:25+00:00

[FIX] *: use `auth='public'` in controllers that use `request.env`

2019-07-04T11:32:22+00:00

The following trick used to work, because `sudo()` was actually making
an environment for the superuser to operate upon:

request.env[...].sudo().method(...)

It no longer works in general, since `sudo()` now makes an environment
in superuser mode but with `uid=None`!  It may still work by accident
for operations that never use `env.uid`, but is broken in general.

Using `auth='public'` fixes the problem by using the public user when no
user is available.

closes odoo/odoo#34297

Signed-off-by: Olivier Dony (odo)

[IMP] payment_*: payment acquirers error handling

2018-09-19T16:25:32+00:00

This commit aims to improve the user experience when using payment acquirers. There currently are no error feedback with some acquirers, which leaves the user wondering what is going on and what is the real status of its payment.
In some cases, the user is currently being redirected to the home page even though the payment has failed. We want to make it more obvious to the user that something unexpected has happened by redirecting to an intermediate page that will provide good feedback on payments status.

Another goal of this commit is to order acquirers by sequence instead of by flow and to select the first acquirer by default. This feature was already implmented in commit fe294fd43e521bd2d339e962f43acf46c3d4cb97, some UI adaptations were needed though.

Related to task #36680
Closes #26958

[MIG] payment_transfer

2016-07-06T13:10:49+00:00

No functional change.

[ADD] *: CSRF protection in forms and routes

2015-09-30T23:36:50+00:00

* make CSRF protection the default on all non-SAFE methods
  note: there currently is no way to call a CSRF-protected endpoint
  without a form-encoded entity-body as that's the only place we get the
  CSRF token from.
* simple CSRF token generation: just use the HMAC'd session id, no
  generating a new random token per session then HMAC it
* use constant-time equal function to avoid timing attacks
* assert that a database secret is configured before hashing/validating
  the CSRF token
* opt-out database manager from CSRF: The super-admin password serves
  the purpose of a CSRF token in the database manager screens.
  There is no request database to obtain the
  secret and generate a CSRF token.

[REM] remove disable_db and ensure_db() from addons

2014-01-30T09:23:08+00:00

bzr revid: fme@openerp.com-20140130092308-s24a7h2mhzuaasf1

[REM] Removed auth='admin' from modules

2014-01-29T17:15:20+00:00

bzr revid: fme@openerp.com-20140129171520-wkz8ot4pa63utoi3

[FIX] payment_transfer: fixed controler, request.redirect -> werkzeug.redirect

2014-01-24T14:56:28+00:00

bzr revid: tde@openerp.com-20140124145628-3e9pvz88wyww9kr3

[IMP] payment_*: routes as admin, remove website parameter in routes

2014-01-23T15:49:24+00:00

bzr revid: tde@openerp.com-20140123154924-r1cylz0fobzav90y

[RENAME] payment_acquirer_* -> payment_ *

2014-01-22T17:57:02+00:00

bzr revid: tde@openerp.com-20140122175702-1h1e51z4njt4s70w