{"push_id":2770537671,"size":2,"distinct_size":2,"ref":"refs/heads/master","head":"9434f7b64ec5ecb5e0a4036c60998bf599fa2ba4","before":"766a1025b1ba25ef40897418fac662eaa42d3a0f","commits":[{"sha":"84f528bcff12e39b5ed172a4789aab27c9f89a19","author":{"name":"Mitali Patel","email":"b9e0f7aed71fa470d5913fb2df2da788a8fb0eb2@odoo.com"},"message":"[IMP] Portal - Share link : Easily share the url of a document\n\nPurpose\n=======\n- Quickly share the url to someone else (a client, a colleague,...)\n- Ensure that the recipient can access at least\n  the portal view of the shared record.\n- Typically used when a client cannot retrieve the mail to access his order.\n  The share link can be used in this case.\n\nSpecifications\n==============\nFor any object inheriting form portal.mixin:\n    - Add a button SHARE (not visible in edit mode)\n    - When clicking on this button, a popup opens with :\n        - A warning message for tasks and projects only (see below)\n        - the link (like in gmail) that can be copied\n        - Recipients\n        - mail composer (with preselected template) ==> see below\n        - button [Send Link] [Copy Link] Discard\n        - After sharing document, put internal note like\n          \"Document shared to xyz,....\" with template message\n    - Anyone with the link, even anonymous user (not logged in) can have access\n      to the document with the access token provided in the url.\n\nImpacted models:\n    - account.invoice (Community)\n    - project.project (Community)\n    - project.task (Community)\n    - purchase.order (Community)\n    - sale.order (Community)\n    - helpdesk.ticket (Enterprise)\n\nWarning messages and access rules:\n    Allowed :\n        - SO canceled or draft will be accessible with the link\n          with access_token\n        - If the customer account is B2B (signup not enabled), the recipient\n          will anyway see the document as the user specifically wants the\n          recipient to see the document.\n    Restrictions :\n        - For Project and Task, if the privacy is not public, then, there is a\n          contradiction between the access_token mechanism\n          and the privacy of the document.\n        - A warning message will be displayed in the share wizard to inform the\n          user if the document cannot be visible by the recipients and to\n          ask him to set the privacy to 'Visible by following customer'.\n          The send button will, in that case, be hidden.\n        - To avoid to block the share for a new project, default privacy value\n          is now set to 'Visible by followong customer'\n\nTechnical implementation\n========================\n- Move the access_token mechanism (field + methods + mail controller)\n  to the portal.mixin to be able to use it in a generic way for each object\n  inheriting the portal.mixin\n- Generalise a part of the _*model*_get_page_view_values method\n  into a single one in portal\n- Generalize the _*model*_check_access into the portal controller of the\n  portal module\n- Remove the init_column + default value for the access_token\n  > old records have an access_token,\n  > new one won't but it will be generated on demand via the get_access_token\n  Done for performance reasons\n- Add share button into action menu separately. + kanban view context menu\n  (except for task and project where button not in action menu but 'simple'\n  button for task and project because other modules already provide action\n  to send documents by email, which is not the case for project and task.)\n- Add a sign_token used to authentify the recipient in the portal view chatter,\n  if any. The message will be posted as if the user was logged in.\n- Set the _get_share_url as private for security reason\n- Add a redirect parameter to _get_share_url to get\n    If false : The direct portal view url\n    If True : The redirect url (mail/view/?)\n- Cleaning up unnecessary code\n\n- Bug fix :\n    - Before, if user was not logged and record had partner_id,\n      if partner id was null, post message was done as admin.\n      Now, the post message is done as public user.\n    - If the user had an uid but had no access_token, he could be able\n      to gain the access token of the record.\n      check_access_rights was missing in the get_access_action.\n\nTask ID : 30985\nCloses #25629","distinct":true,"url":"https://api.github.com/repos/odoo/odoo/commits/84f528bcff12e39b5ed172a4789aab27c9f89a19"},{"sha":"9434f7b64ec5ecb5e0a4036c60998bf599fa2ba4","author":{"name":"David Beguin","email":"27e7e3872de3b7eb7691b5079c8bb859b71288fa@odoo.com"},"message":"[REF] Portal Controller : Remove domain from account and purchase\n\nThe list of visible records are anyway based on access_rights.\nState has been removed from the domain.\nIf the portal must be customized for a model,\naccess rights / rules can be added to do so.\n\nTask ID : 30985","distinct":true,"url":"https://api.github.com/repos/odoo/odoo/commits/9434f7b64ec5ecb5e0a4036c60998bf599fa2ba4"}]}
{"actor":{"display_login":"dbeguin"}}