Odoo/odoo/addons/base/views/res_users_views.xml, branch 14.0 The current checkout of upstream Odoo [FIX] base: update API documentation link 2021-05-18T14:30:13+00:00 Swapnesh Shah swapneshshah111@gmail.com 2020-11-17T19:39:42+00:00 646f51368a45869a18ada897703b7eaf1c5217ca Before this commit, link to the API documentation was referenced to the master version, instead of the current one, 14.0. Furthermore, the link wasn't adapted correctly following the documentation reorganisation, which is also fixed by this commit. closes odoo/odoo#61905 Signed-off-by: Victor Feyens (vfe) <vfe@odoo.com> 
Before this commit, link to the API documentation was referenced
to the master version, instead of the current one, 14.0.

Furthermore, the link wasn't adapted correctly following the documentation
reorganisation, which is also fixed by this commit.

closes odoo/odoo#61905

Signed-off-by: Victor Feyens (vfe) <vfe@odoo.com>
[FIX] base: User with "Administration /Access Right" can't View "Groups" 2021-04-15T11:15:26+00:00 Goffin Simon sig@odoo.com 2021-04-15T11:10:48+00:00 e179011b3118fe355ea33be194585f674d40df3f 1. Create a new user with only "Administration / Access Right" 2. Login as the user 3. Turn on debug mode (via plugin or by editing url) 4. Go to "Settings -> Users and Companies -> Groups" 5. Open any group form / Press "Create" button. Bug: Error "You are not allowed to access 'View' (ir.ui.view) records." A user who is managing "Access Right" must be able to create/edit groups opw:2492803 closes odoo/odoo#69306 Signed-off-by: Simon Goffin (sig) <sig@openerp.com> Co-authored-by: mart-e <mat@odoo.com> 
1. Create a new user with only "Administration / Access Right"
2. Login as the user
3. Turn on debug mode (via plugin or by editing url)
4. Go to "Settings -> Users and Companies -> Groups"
5. Open any group form / Press "Create" button.

Bug:

Error "You are not allowed to access 'View' (ir.ui.view) records."

A user who is managing "Access Right" must be able to create/edit groups

opw:2492803

closes odoo/odoo#69306

Signed-off-by: Simon Goffin (sig) <sig@openerp.com>
Co-authored-by: mart-e <mat@odoo.com>
[FIX] base: mail signature CSS inlined for icons etc 2021-02-16T13:21:33+00:00 Nicolas Lempereur nle@odoo.com 2021-02-15T15:05:36+00:00 5e093b7a37984c8cc5aa73d1c0f7aa9c9345e6b1 The mail signature of an user did not inline the CSS like the body of a message, so for example icons seemed to work but would not be seen (unless the mail reader had the same font-awesome system). With this change we inline the signature too. On edition there was also an issue since the original icon was saved as data-class which was stripped: so eg. when editing a mail.message with working icon, the icons would disappear. opw-2453912 closes odoo/odoo#66264 X-original-commit: a723bcbebbbc3a526cf63f28b66f53b8be3fe76e Signed-off-by: Nicolas Lempereur (nle) <nle@odoo.com> 
The mail signature of an user did not inline the CSS like the body of a
message, so for example icons seemed to work but would not be seen
(unless the mail reader had the same font-awesome system).

With this change we inline the signature too.

On edition there was also an issue since the original icon was saved as
data-class which was stripped: so eg. when editing a mail.message with
working icon, the icons would disappear.

opw-2453912

closes odoo/odoo#66264

X-original-commit: a723bcbebbbc3a526cf63f28b66f53b8be3fe76e
Signed-off-by: Nicolas Lempereur (nle) <nle@odoo.com>
[FIX] base: API documentation link 2020-11-04T11:08:09+00:00 Moens Alexandre mao@odoo.com 2020-11-04T08:50:34+00:00 c1f43707c6e9efc7321b71120df45f2e2cf7ee82 opw-2374318 closes odoo/odoo#61309 Signed-off-by: Nicolas Martinelli (nim) <nim@odoo.com> 
opw-2374318

closes odoo/odoo#61309

Signed-off-by: Nicolas Martinelli (nim) <nim@odoo.com>
[IMP] base, totp: simplify form layout and improve responsiveness 2020-09-25T18:15:34+00:00 Olivier Dony odo@odoo.com 2020-09-25T18:15:34+00:00 f085be23da4eab4dc4369fea9e13dc827f12bf4f Some of the TOTP-related forms contained an attempt at making a centered modal pop-up, using a bootstrap `card` that would also serve to emphasize that the interaction was sensitive and security-related. Some of the "footer buttons" were moved inside the form to make it more obvious that they were part of the interaction flow. However some of this caused breakages of responsiveness and did not yield a really satisfactory result anyway. This commit switches back to using regular non-centered forms. It looks quite ugly because the content is better suited for a narrow modal, but it means less surprises in terms of layout and less responsiveness issues. closes odoo/odoo#58541 Signed-off-by: Olivier Dony (odo) <odo@openerp.com> 
Some of the TOTP-related forms contained an attempt at making a centered
modal pop-up, using a bootstrap `card` that would also serve to
emphasize that the interaction was sensitive and security-related.
Some of the "footer buttons" were moved inside the form to make it
more obvious that they were part of the interaction flow.

However some of this caused breakages of responsiveness and did not yield
a really satisfactory result anyway.

This commit switches back to using regular non-centered forms. It looks
quite ugly because the content is better suited for a narrow modal, but
it means less surprises in terms of layout and less responsiveness
issues.

closes odoo/odoo#58541

Signed-off-by: Olivier Dony (odo) <odo@openerp.com>
[FIX] base: fix update password wizard 2020-09-17T08:56:17+00:00 Cedric Snauwaert csn@openerp.com 2020-09-17T08:56:14+00:00 641ae07dbce1d0515fb0710a3363db47b27548e7 due to breaking changes in https://github.com/odoo/odoo/pull/55995/commits/bf32b22ce247c19fda94ded74e37f7c6120ce2c4 and especially the part: "NOTE 1. If the default_get within the onchange returns a value for a field that is not in the view, we ignore it, and it won't be saved. Before, that value was kept and sent upon save. This change in behavior may prove problematic, although the overall risk is small. Decision has been made to keep heavy comments and code snippets if we were to revert back somehow to the previous situation." the wizard to update user password was broken as the field user_id which is required was not present in the view and was thus ignored by to web client when calling 'create'. closes odoo/odoo#57922 Signed-off-by: Laurent Smet <smetl@users.noreply.github.com> 
due to breaking changes in https://github.com/odoo/odoo/pull/55995/commits/bf32b22ce247c19fda94ded74e37f7c6120ce2c4
and especially the part:

"NOTE 1.  If the default_get within the onchange returns a value for
a field that is not in the view, we ignore it, and it won't be saved.
Before, that value was kept and sent upon save.  This change in behavior
may prove problematic, although the overall risk is small.  Decision has
been made to keep heavy comments and code snippets if we were to revert
back somehow to the previous situation."

the wizard to update user password was broken as the field user_id
which is required was not present in the view and was thus ignored by
to web client when calling 'create'.

closes odoo/odoo#57922

Signed-off-by: Laurent Smet <smetl@users.noreply.github.com>
[WIP] base, auth_totp: add doc links for 2FA & API keys 2020-09-10T12:50:20+00:00 Xavier Morel xmo@odoo.com 2020-08-20T10:47:41+00:00 f577cb715284616cbe220e3dba19ab027f0cc074 






[FIX] base,hr*: adapt profile view to security fields
2020-08-14T23:06:24+00:00

Olivier Dony
odo@odoo.com

2020-08-14T18:06:04+00:00

63e38dad8de9d59edc2b75433b4e3f761eda0f3c












[IMP] portal: /my/security page
2020-08-14T23:06:11+00:00

Xavier Morel
xmo@odoo.com

2020-02-18T09:29:28+00:00

ee1b67d60732f1dc964c90d13368243f49fdef59

* allows portal users to update their password
* and manage their API keys
* any anything technical / security related we may need to add in the
  future

Also bridge module for the password meter (auth password policy).




* allows portal users to update their password
* and manage their API keys
* any anything technical / security related we may need to add in the
  future

Also bridge module for the password meter (auth password policy).






[ADD] base: API keys support
2020-08-14T23:03:27+00:00

Xavier Morel
xmo@odoo.com

2019-05-22T14:12:33+00:00

d0dbbe23f4b1f797a9ed8c7a4726146d6df902ad

* ability for a user to request / create keys associated to their user
* overrides can block RPC solely through API keys, by overriding
  `_rpc_api_keys_only()` (to require API auth even in
  situations where the user has not requested it themselves)
* hash keys just in case as we can do so and might as well, add a
  cleartext index (first 4 bytes of 20) to avoid blowing up the DB if
  a user decides to create millions of keys for some daft reason
* users can delete their own keys, admins can delete (invalidate)
  anyone's keys
* `scope` on API keys can be used to restrict usage to certain
  kind of applications, so API keys can be used for other things
  than global authentication. New keys manually created by users
  have no scope by default so they are valid everywhere (global
  keys). RPC auth (stateless XML-RPC/JSON-RPC) requires global keys

Co-authored-by: Florimond Husquinet <fhu@odoo.com>
Co-authored-by: Olivier Dony <odo@odoo.com>




* ability for a user to request / create keys associated to their user
* overrides can block RPC solely through API keys, by overriding
  `_rpc_api_keys_only()` (to require API auth even in
  situations where the user has not requested it themselves)
* hash keys just in case as we can do so and might as well, add a
  cleartext index (first 4 bytes of 20) to avoid blowing up the DB if
  a user decides to create millions of keys for some daft reason
* users can delete their own keys, admins can delete (invalidate)
  anyone's keys
* `scope` on API keys can be used to restrict usage to certain
  kind of applications, so API keys can be used for other things
  than global authentication. New keys manually created by users
  have no scope by default so they are valid everywhere (global
  keys). RPC auth (stateless XML-RPC/JSON-RPC) requires global keys

Co-authored-by: Florimond Husquinet <fhu@odoo.com>
Co-authored-by: Olivier Dony <odo@odoo.com>