Odoo/addons/website_form/controllers, branch 14.0

[FIX] website_form: cancel records creation if error

2021-04-27T09:00:31+00:00

When running an automated action on record creation, if the action
raises a UserError/ValidationError, the record will still be created.

To reproduce the error:
(Need website_crm,base_automation. Enable debug mode)
1. Create an Automated Action
    - Model: Lead/Opportunity
    - Trigger: On Creation & Update
    - Trigger Fields: Phone (crm.lead)
    - Action To Do: Execute Python Code
    - Python Code:
    ```python
    if record.phone:
        raise UserError("Lorem ipsum")
    ```
2. On website, add a website form WF
    - Action: "Create an Opportunity"
3. Complete and submit WF including a phone number

Error: An error message is displayed ("Lorem ispum"). However, the lead
has been created and is present in CRM Pipeline.

An on-creation automated action is executed once the record is executed,
but nothing will cancel this records creation if the action raises a
UserError/ValidationError.

OPW-2423948

closes odoo/odoo#69477

Signed-off-by: Raphael Collet (rco)

[FIX] website_form: display attachment on form web page

2021-02-26T08:59:02+00:00

When submitting a ticket, if the user adds an attachement, he will not
be able to see it on the ticket web page.

To reproduce the error:
(Need helpdesk,contacts)
1. Go to the settings of a Helpdesk Team (e.g., "Customer Care")
2. Enable "Website Form", Refresh
3. Go on Helpdesk web page and Publish the form
4. Create a partner P and grant him the portal access
5. Sign in with P
6. Submit a ticket with one attachment
7. Consult the ticket's web page

Error: in "Message and communication history", OdooBot's message with
the attachment is not displayed. However, when consulting the
same page with the admin account, this message is considered as
"Published". Thus, P should see the message and the attachment.

When getting the messages, if the user is not an employee, the domain is
restricted:
https://github.com/odoo/odoo/blob/e92ac60a75462dfd830254a3d0dd5d7effe1528e/addons/portal/controllers/mail.py#L128-L130
with
https://github.com/odoo/odoo/blob/cc32b7d1b396a42dd4575c681ceb422f99b6015a/addons/portal/models/mail_message.py#L30-L32
Problem is that, when creating the message with the attachement,
`subtype_id` is not defined.

OPW-2440069

closes odoo/odoo#66899

X-original-commit: b05a72d3cc181c601807b5e633766d504e06bb3a
Signed-off-by: Adrien Widart

[FIX] website_form: prevent adding lang prefix to form action url

2021-01-04T11:20:45+00:00

STEPS:
* create fresh db with default lang fr_CH
* install website
* activate additional language, e.g. en_GB
* set for website only one available language: fr_CH
* for admin user set lang en_GB
* open website and add form

BEFORE: the form doesn't work, because action url is "/en_GB/website_form/"

AFTER: action url is not changed

WHY:

1.

``is_multilang_url`` returns ``True``, because there is no route ``/website_form/``

https://github.com/odoo/odoo/blob/0adcb9a09fe5714fe8479df9450ddcefa7ba0688/addons/http_routing/models/ir_http.py#L233-L244

2.

Model name in action is added after rendering only, this is why ``is_multilang_url`` is
called with ``/website_form/`` and not real url

https://github.com/odoo/odoo/blob/0adcb9a09fe5714fe8479df9450ddcefa7ba0688/addons/website_form/static/src/js/website_form.js#L144

3.

As result we get error on trying to make request ``/en_GB/website_form/mail.mail``

---

opw-2413960

closes odoo/odoo#63997

X-original-commit: e9e86e251b7e262c4fe9c71722c27cc69cc3b712
Signed-off-by: Jérémy Kersten (jke)

[FIX] website_form: allow to submit form without csrf if not logged

2020-09-18T14:45:01+00:00

Chrome recently changed their SameSite policy default value from None to Lax,
the session is no more shared between the webpage and the iframe.
As a result, the csrf check systematically fails.

After this commit, the csrf_token check is only made when you have a session.

In case you are using your form in an iframe on another site, with the new
cookies policy, your cookies with the session_id (linked to the csrf token)
is not sent to the server and the check csrf always fails.

Since the purpose of the csrf is to prevent another website to submit a form
with your 'authenticated account', we can consider that if you are not logged
and so have no session_id, it is no critical and we can ignore the csrf check.

opw-2330286

closes odoo/odoo#58046

X-original-commit: 9a0c9f3192bc7043add89446cbe6c2650499a654
Signed-off-by: Olivier Dony (odo) 
Signed-off-by: Jérémy Kersten (jke)

[FIX] website_form: lang arabic for date/datetime

2020-09-08T07:20:16+00:00

When we send dates with website_form, if the language of the website is
eg. in arabic we will send moment.js arabic dates that can't be parsed
by the server.

This also happens with norwegian and any language which doesn't use
ascii numbers or textual format of month or days (and possibly RTL
language).

With this changeset, if we detect we are in a use case where this matter
(an existing field and a date format that will fail) the date will be sent
as odoo server format.

Expected change:

- what worked still work with or without server restart

- what didn't work works after server restart

- special case such as "english" with custom format in res.language
  containing textual month might now not work with code update without
  server restart (probability of this is low).

opw-2326882
closes #57042

closes odoo/odoo#57214

Note: the saas-13.5 version always force isoformat for existing fields
X-original-commit: 9a5bb5e892bc40709fab77c2bc62adcba19e02d2
Signed-off-by: Nicolas Lempereur (nle)

[IMP] website_form: avoid string concatanation

2020-06-09T08:47:07+00:00

This is a slow operation and string join is significantly faster
https://stackoverflow.com/a/3055541/1398110

This can make a noticable difference when processing a long form

Courtesy of Nils Hamerlinck

closes odoo/odoo#52664

X-original-commit: 87a2702fdabdcfeb774ddfb9db2e28bdd5595f9a
Signed-off-by: Martin Trigaux (mat)

[IMP] google_recaptcha, *: integrate recaptchaV3

2020-06-05T10:58:50+00:00

* = base_setup, website_form, website_sale, website_crm,
crm_iap_lead_website, website_hr_recruitment, website_mass_mailing

Integrate reCaptchaV3 on website_form submit and website_mass_mailing
subscription.
You can now use ReCaptchaV3 to add reCaptcha verification in any module
using google_recaptcha.

Also added a better error management on the form with custom messages.

task-2217980

closes odoo/odoo#48466

Related: odoo/enterprise#9649
Signed-off-by: Jérémy Kersten (jke)

[FIX] website_form: fix wrong user sending email

2020-03-27T09:50:27+00:00

Issue

	When you send a form which create a customer
	from the website, you get a 400 error.

	I used the customer database to reproduce
	the issue. I guess this is due to specific
	settings who set a value for `meta` here

	https://github.com/odoo/odoo/blob/5381e9d900b344e7d48a6b347c5fc551d433b15e/addons/website_form/controllers/main.py#L187

Cause

	The cause is the same than the one for fc8a0474b4
	Here, we use sudo:
	https://github.com/odoo/odoo/blob/5381e9d900b344e7d48a6b347c5fc551d433b15e/addons/website_form/controllers/main.py#L211

	sudo adds a flag "su" and does not replace the user in env
	So we have "public user" who doesn't have email instead
	of OdooBot who has an email, there is a raise who explain
	the issue but it's not forwarded to the error in the website

Solution

	Use with_user(SUPERUSER_ID) instead of sudo, in order to have
	the right user (as it is done few lines above.

OPW-2220816

closes odoo/odoo#48481

X-original-commit: 1dba2ec8166b934d0698220e7062280d347f8af1
Signed-off-by: Nicolas Martinelli (nim) 
Signed-off-by: Jason Van Malder (jvm)

[FIX] website_form: fix wrong user sending website forms

2020-03-04T09:53:50+00:00

Issue
	- Set outgoing mail server
	- Install Online Ticket Submission
	- Publish an Helpdesk Team
	- Log out
	- Create a ticket from the helpdesk form

	The user who created the ticket is "Public User"
	He has no email address, so the mail is not sent

Cause

	insert_record method in website_form/main.py uses .sudo()
	In v12 => sudo replaces the user in env by the superuser => ok
	In v13 => sudo adds a flag "su" and does not replace the user in env

Solution

	Add a with_user(SUPERUSER_ID) to the create method's call in
	insert_record

OPW-2196668

closes odoo/odoo#46835

X-original-commit: 761ae16634b14bec7be522666bb2163490566ecc
Signed-off-by: Jason Van Malder (jvm)

[FIX] website_form: binary work with website_crm_phone_validation

2020-02-25T13:19:39+00:00

With this change, a binary field in a website form works when
website_crm_phone_validation (website_crm in 13.0) is installed.

The module website_crm_phone_validation would call `extract_data` method
to do some things, but when extract_data was called a second time to
really save data, the FileStorage werkzeug object would already consumed
and files would erroneously appear as empty.

opw-2191873

closes odoo/odoo#46241

X-original-commit: a168fe23cc6d9b817b44c189822952a1ee98d81d
Signed-off-by: Nicolas Lempereur (nle)