Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[MIG][15.0] web_notify #2176

Closed
wants to merge 51 commits into from
Closed

Conversation

em230418
Copy link

Porting notes:

  1. Removed notify_default, since it does not pass validation in [1]
  2. Modifications to notificaation widgets are removed in prefer of original widget implementation
  3. Odoo improved notification usage in [2], so no need to add extra channels that depend on user's id

[1] https://github.com/odoo/odoo/blob/21be7ca0c9eef18184d06755ff83337be1e4752e/addons/web/static/src/core/notifications/notification.js#L49
[2] odoo/odoo@543af27

Copy link

@JrAdhoc JrAdhoc left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please fix codecov tests for reviewing. Usage test approved.

@em230418
Copy link
Author

Checked why codecov did not cover tests. https://github.com/OCA/web/pull/2176/checks?check_run_id=5770875580
There was error while executing tests (https://github.com/OCA/web/runs/5770842937?check_suite_focus=true), but for some reason it is marked as passed.

lmignon and others added 25 commits April 28, 2022 11:15
This technical module allows you to send instant notification messages from the server to the user in live.
Fix a check when comparing a user count with items within a mock call.

The previous method was succeeding by pure luck because OCA test
databases contain 2 users, which happens to be the amount of items
within a mock "call_args" (it contains args + kwargs).
- Use the 'session' class of the JS Framework (session no lounger bound
to web client)
- Test change: compare emitted & received messages based on content, not
order. Using string comparison raises false positives.
Currently translated at 100,0% (5 of 5 strings)

Translation: web-11.0/web-11.0-web_notify
Translate-URL: https://translation.odoo-community.org/projects/web-11-0/web-11-0-web_notify/pt_BR/
Currently translated at 40.0% (2 of 5 strings)

Translation: web-11.0/web-11.0-web_notify
Translate-URL: https://translation.odoo-community.org/projects/web-11-0/web-11-0-web_notify/da/
Only the admin user (sudo) is allowed to send notifications to other
users. The normal users can only send notifications to themselves.

This is to prevent attackers to craft malicious notifications and send
them to other users using RPC.

Correction based on the idea of @hbrunn
Add self-test buttons in demo environment,
Updated readme to show how to test it.
Add buttons to users form
Do not rely on SUPERUSER_ID and avoid getattr usage
Updated by Update PO files to match POT (msgmerge) hook in Weblate.
* [ADD]: all available bootstrap notifications (success/danger/warning/info/default)
* [IMP] use black color for text for default notification.
* [FIX] reverted require string for `bus.Longpolling` and rename `on_message_received` to `on_message` to prevent collisions.
Updated by "Update PO files to match POT (msgmerge)" hook in Weblate.

Translation: web-12.0/web-12.0-web_notify
Translate-URL: https://translation.odoo-community.org/projects/web-12-0/web-12-0-web_notify/
Updated by "Update PO files to match POT (msgmerge)" hook in Weblate.

Translation: web-12.0/web-12.0-web_notify
Translate-URL: https://translation.odoo-community.org/projects/web-12-0/web-12-0-web_notify/
It seems besides the custom channels provided in this addon it also catches messages from other channels. E.g. in this case it seems the void popup is triggered by these activity creation bus messages.

**Steps to reproduce**

Odoo commit: could reproduce on 5e8b667951 and 4da82776ff
OCA/web commit: 2465278

* Install crm and web_notify modules
* Create an activity for yourself (tried for admin user)
* Empty popup appears

**Attempt to solve**

It seems the bus handles all messages non exclusively. I've hacked in a conditional to handle only messages from web_notify addon, but its unclear wether this does not break something else.
Porting notes:
1. Removed notify_default, since it does not pass validation in [1]
2. Modifications to notificaation widgets are removed in prefer of original widget implementation
3. Odoo improved notification usage in [2], so no need to add extra channels that depend on user's id

[1] https://github.com/odoo/odoo/blob/21be7ca0c9eef18184d06755ff83337be1e4752e/addons/web/static/src/core/notifications/notification.js#L49
[2] odoo/odoo@543af27
@em230418 em230418 marked this pull request as draft April 28, 2022 07:18
@matiasperalta1
Copy link
Contributor

Is this PR ready for review?

@em230418
Copy link
Author

em230418 commented May 6, 2022

You can review functionality. Unit-tests are not ready.

self, type_message, message=DEFAULT_MESSAGE, title=None, sticky=False
):
# pylint: disable=protected-access
if not self.env.user._is_admin() and any(
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This allows to use sudo() to send a message to any user.

Suggested change
if not self.env.user._is_admin() and any(
if not (self.env.su or self.env.user._is_admin()) and any(

Copy link
Contributor

@JosDeGraeve JosDeGraeve left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just a small remark,

Probably also an issue with v14 - i was expecting that using sudo() allows to send a notification to any user.

@em230418
Copy link
Author

em230418 commented Jan 6, 2023

Closing in favour of #2381

@em230418 em230418 closed this Jan 6, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.