Odoo/addons/website/controllers/main.py, branch 14.0

[FIX] http_routing, website: prevent crash when using `fw` in url

2021-05-03T16:16:12+00:00

Before this commit, the routing map generated and used would be the one from
the website the request is performed, instead of the one from the `fw` website
ID which will be the one we redirect the user to.

This issue was introduced with the routing map by website, be8fc2296b38 and is
restricted to a single case: a publisher using the website switcher, and it
won't happen on next page naviguation/refresh as the `fw` website id will be
the same as the current website's ID. Thus there won't be any routing map
mismatch.

Step to reproduce:
  - Create a page on website 2, set it as homepage
  - Naviguate to website 1 on '/' url
  - Naviguate to website 2 on '/' url
This will raise a werkzeug error about `EndPoint not iterable`.

----- Technical analysis ------

This is the current flow:
1. `_dispatch()` is setting `website_routing` to `get_current_website()` -> 2
2. `_dispatch()` is calling `_match()`
3. `_match()` is calling `routing_map()` with key = `website_routing`, which
   was set to 2 in step 1.
4. `routing_map()` is calling `_generate_routing_rules()` which generate the
   rules based on `website_routing`, which was set to 2 in step 1.
5. `_dispatch()` authenticate the user by calling `_authenticate()`
6. `_dispatch()` is calling `_add_dispatch_parameter()`, where URL param `fw`
   is forced in session, so `get_current_website()` now return the correct
   `website_id` -> 1

The issue: in order to handle the `fw` URL parameter (step 6.), we need to
check the rights to ensure we can allow the website switch.
To check rights, user need to be authenticated (step 5.), which is done after
generating the routing map (2. & 3. & 4.).
The routing map is generated based on the current website (step 1.)

Step 6 depends of steps 5 which depends of steps 2/3/4 which depend of step 1,
but step 1 should depend of step 6, which is an impossible cycle.

closes odoo/odoo#70278

X-original-commit: 878e28f93a65756fa2002ef2af5b02a3e2c59b1b
Signed-off-by: Jérémy Kersten (jke) 
Signed-off-by: Romain Derie

[FIX] website: _handle_exception takes only two arguments

2021-03-22T12:31:30+00:00

Before the commit, if an exception occurs there was an error saying:
`TypeError: _handle_exception() takes 2 positional arguments but 3 were given`

Impacted versions:

 - 12.0
 - 13.0
 - 14.0

X-original-commit: 47d6fa4ff6e78a33691c22b08504ce03e6796c9a

[FIX] website: only toggle view in toggle state

2020-11-20T14:11:23+00:00

Before this commit, we write on each record the value, whatever the current value.
Now we check if it is necessary to avoid useless fork.

The first change on header was slowly.

[FIX] website: adapt /website/action to v14 perms

2020-11-17T14:16:06+00:00

As of v14 and #53335 (6c97a6d), access to `ir.actions*` models has been
restricted to admins, except in specific context such as via the
`/web/action/load` route.

This commit updates the `/website/action/` route to follow that logic,
and allow custom server actions to be exposed as "custom controllers".

The principle is that the action is located in a sudo environment, but
executed using the request environment. Access will only be permitted if
the model of the action is writable for the current user, or if any
action "groups" are set and the user belongs to one of them
(cfr f0d37c384b299e5f35cddda02d3f56c6ad37a9a7 for that part).

closes odoo/odoo#61863

Signed-off-by: Toufik Benjaa (tbe)

[FIX] website: favicon use STATIC_CACHE_LONG that is a real year

2020-10-26T18:06:13+00:00

365 * 24 * 60 is not a year, but year/60 ;)
While we fix it, it is the good time to change and use the dedicated
http.STATIC_CACHE_LONG that exists for it.

closes odoo/odoo#60768

Signed-off-by: Jérémy Kersten (jke)

[FIX] website: filter filter_opt of dynamic snippet by website_id

2020-10-13T13:00:21+00:00

Add a filtering by the contextual website_id when looking up available
website_snippet_filters via an rpc route limited to logged in users but
relying on a sudo to actually obtain the list of available filters.

Before this commit filters were visible on the editor for all websites.

After this commit filters are only visible on the editor of the website
that matches their website_id.

https://github.com/odoo/odoo/pull/59341
task-2312878

closes odoo/odoo#59341

Signed-off-by: Jérémy Kersten (jke)

[FIX] website: get visitor tz directly from cookie

2020-10-08T09:13:58+00:00

Since tz is now (from 6eb4762fee20a158023d774a90e7ee90c2cacec5) added to the client cookie,
visitor timezone can directly be set when creating the visitor, using the
request.

Jstz can be removed as even for module in ENT that used this lib,
we can get the timezone using Intl lib instead.

This will also reduce the number of request made only to get visitor's
timezone.

This commit reverts part of 17e84025239ed78716ed5d5d92c0ee0e10fbfb29
Linked ENT PR: 12963

Task ID: 2333825

closes odoo/odoo#57103

Related: odoo/enterprise#12963
Signed-off-by: Thibault Delavallee (tde)

[FIX] website: prevent /web/become route to crash

2020-09-16T12:01:31+00:00

Since 9f82605df111, any call to `_login_redirect()` without previously going
through `web_login()` method would crash, as `login_success` is set there.

In this case, it was:
Dispatch -> web_login -> redirect (new dispatch) -> _login_redirect()

task-2340941

closes odoo/odoo#57839

Signed-off-by: Jérémy Kersten (jke)

[FIX] website: check website_published exists before use

2020-08-28T14:35:32+00:00

closes odoo/odoo#56734

Signed-off-by: Jérémy Kersten (jke)

[IMP] website, website_sale: add dynamic snippets

2020-08-18T17:40:25+00:00

* Implement new snippets that allow the user to choose a filter
  and a template.
  Three snippets have been created:
  - Dynamic Snippet: Displays the data in a grid format
  - Dynamic Carousel: Displays the date in a carousel
  - Dynamic Products: Let the user pick a product category and
                      displays the products in a carousel

task-2276740
PR #53175

Signed-off-by: Jérémy Kersten (jke)