The Content-Security-Policy[^1] http header was only set on the response
generated by controllers but it was missing from the `/<module>/static/`
route.
It is not strictly necessary to set that header on the responses comming
from that routes as it is not possible to add new static files or edit
existing ones via the interface (not even as admin). Only the developers
and system administrator can access those files.
It is also worth mentionning that using the Odoo internal web server to
deliver static files is suboptimal. Outside of a dev environment, those
files will typically be delivered via a web server[^2] and sysadmins
should configure their web server to set the CSP header on static images.
[^1]: https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP
[^2]: https://www.odoo.com/documentation/master/administration/install/deploy.html#serving-static-files-and-attachmentsclosesodoo/documentation#6950
X-original-commit: f3f44fe5f2
Related: odoo/odoo#146584
Signed-off-by: Julien Castiaux (juc) <juc@odoo.com>
Install nginx using the nginx configuration found in the documentation
and changes the `listen` port to 8080. Start Odoo in `--proxy-mode`.
listen 8080;
server_name mycompany.odoo.com;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Real-IP $remote_addr;
location / {
proxy_pass http://127.0.0.1:8069;
}
Inside your browser, access "http://mycompany.odoo.com:8080" you are
wrongly redirected to "http://mycompany.odoo.com:80".
Odoo uses the `X-Forwarded-Host` http header value to generate new URls,
in this configuration `$host` only contains the domain (=hostname using
the urllib terminology) instead of the domain+port (=netloc). The
variable that contains both the domain and the port is actually
`$http_host`.
closesodoo/documentation#6941Closes: odoo/odoo#64643
X-original-commit: 09c42c5896
Signed-off-by: Antoine Vandevenne (anv) <anv@odoo.com>
Signed-off-by: Julien Castiaux (juc) <juc@odoo.com>
Updated the chart of accounts page. Forward to master.
16.3 -> Change "ellipsis" menu button
17 -> Change "Setup" to "View"
taskid-3609365
closesodoo/documentation#6913
X-original-commit: b617b47ab2
Signed-off-by: Tom Aarab (toaa) <toaa@odoo.com>
Official packages for wkhtmltopdf 0.12.5 are no more released since the
release of wkhtmltopdf 0.12.6 in 2020. Debian 10 "Buster" and Ubuntu
20.04 "Focal" were the last system for which 0.12.5 was built[^1].
Installing 0.12.5 on a Ubuntu 22.04 "Jammy" (using the Focal package)
fails for outdated dependencies.
Official packages for wkhtmltopdf 0.12.6 are published on another
repository[^2] than 0.12.5 used to, it includes packages for 0.12.6 for
both Debian 11 "Bullseye" and Ubuntu 22.04 "Jammy". Version 0.12.6.1-r3
is compatible out-of-the-box with Odoo and has been used by runbot to
test all 16.x, 17.x and master branches for the past month.
This work makes it official that [wkhtmltopdf 0.12.6.1-r3] must be used
for Odoo 16.0 and onward.
[^1]: https://github.com/wkhtmltopdf/wkhtmltopdf/releases/tag/0.12.5
[^2]: https://github.com/wkhtmltopdf/packaging/releases
[wkhtmltopdf 0.12.6.1-r3]: https://github.com/wkhtmltopdf/packaging/releases/tag/0.12.6.1-3closesodoo/documentation#6797
X-original-commit: e5d77ee285
Signed-off-by: Julien Castiaux (juc) <juc@odoo.com>
The preferred/safe way of running Odoo is with a standard user, with
only the right to create a database.
See b6b73551dbclosesodoo/documentation#6763
X-original-commit: df8114e591
Signed-off-by: Antoine Vandevenne (anv) <anv@odoo.com>
Signed-off-by: William André (wan) <wan@odoo.com>
Many customers struggle with their web server configuration, notably
regarding the `--proxy-mode` option and the way `X-Forwarded-*` HTTP
request headers are interpreted within Odoo.
The `--proxy-mode` section has been updated to cover the most common
misunderstandings and to give guidances on how to setup a web server.
Odoo always only takes the last entry of the `X-Forwarded-*` request
header because there are situations where it is not possible to
determine which last n-th entry to use. Employees might access their
odoo database via the internal network: connecting directly to nginx,
while customers might access the database via an additional proxy such
as cloudflare. The real IP of employees would be the last inside the
`X-Forwarded-For` chain, while the real IP of customers would be the
*second* last entry inside the chain. It would be incorrect to always
take the same nth last entry inside the chain. The cloudflare's own IP
address must be discarded from the chain. Web servers usually feature
a way to ignore trusted IP from the chain, a way so that the real IP
of the user is always the last entry inside the chain. Odoo relies on
such feature to be active and configured.
Prior discussions about `X-Forwarded-For`:
* odoo/odoo#104947
* odoo/odoo#118629
* odoo/odoo#139536
All `X-Forwarded-*` headers are ignored in case the `X-Forwarded-Host`
header is missing (even with `--proxy-mode`). System admin might be
tempted to not set this header and to set `Host` instead, this is
broken as this a user-agent would be able to spoof `X-Forwarded-Host`
and Odoo would use that instead of the correct `Host`.
Prior discussions about `X-Forwarded-Host`:
* odoo/odoo#63277
* odoo/odoo#70117closesodoo/documentation#6741
X-original-commit: 3d91c57b57
Signed-off-by: Julien Castiaux (juc) <juc@odoo.com>
The lambda function here is useless and makes newdooers think
they need to use it everytime.
`default=fields.Date.add(fields.Date.today(), months=3))`
should do the trick, no lambda involved.
closesodoo/documentation#6629
X-original-commit: 620508fb29
Signed-off-by: Antoine Vandevenne (anv) <anv@odoo.com>
Signed-off-by: Claire Bretton (clbr) <clbr@odoo.com>
The "../technical-training-sandbox" is added too early in the path since
its still empty, and results into an "invalid addons-path" error.
X-original-commit: 8707609b38
Part-of: odoo/documentation#6629
This addition explains how to create and connect an existing plausible.io account in Odoo.
task-3540753
closesodoo/documentation#6543
X-original-commit: cd11937f43
Signed-off-by: Jonathan Castillo (jcs) <jcs@odoo.com>
Without the :show-content: metadata markup, it is not possible to open the
page by navigating from the toctree.
closesodoo/documentation#6527
X-original-commit: 16e339a7a3
Signed-off-by: Xavier Platteau (xpl) <xpl@odoo.com>
0c0cf8ebc9
added a new way to select accounts in the account_codes engine. This
commit adds some explanation in the doc on how to use this new syntax.
closesodoo/documentation#6503
X-original-commit: 1a32165180
Signed-off-by: Jonathan Castillo (jcs) <jcs@odoo.com>
This PR adds the documentation for a new Pos IoT Six module which will
soon replace the old Six module.
task-3555605
closesodoo/documentation#6437
X-original-commit: bc98b8c491
Signed-off-by: Yaroslav Soroko (yaso) <yaso@odoo.com>
Co-authored-by: Yaroslav Soroko (yaso) <yaso@odoo.com>
Co-authored-by: Loredana Perazzo <lrpz@odoo.com>
For some reason, the first-person was used throughout the IAP
documentation, and quite inconsistently.
As the rest of the documentation is using second-person writing, IAP
should be no exception.
closesodoo/documentation#6325
X-original-commit: df474342ba
Signed-off-by: Antoine Vandevenne (anv) <anv@odoo.com>
Signed-off-by: Louis Baudoux (lba) <lba@odoo.com>
It has been decided to remove the possibility for our users to create
their own IAP services.
This decision was motivated by the fact that, in the 5 years of
existence of IAP, very few non-Odoo services have been created and
actively used by our customers.
X-original-commit: 282f041ed1
Part-of: odoo/documentation#6325
We have introduced a second version of the Extract API that adds the IAP
account token to the `get_result` and `validate` routes.
There are also other changes in this commit:
- The deprecated stuff has been removed as it's been deprecated for a
while and won't be supported anymore in the future.
- The `status` table of the `get_result` route has been added as it was
missing for some reason.
- The documentation regarding the `/validate` routes have been removed
for security reasons.
closesodoo/documentation#6280
X-original-commit: a8c6272899
Signed-off-by: Antoine Vandevenne (anv) <anv@odoo.com>
Signed-off-by: Louis Baudoux (lba) <lba@odoo.com>
In the CLI, `--unaccent` try to enable PostgreSQL unaccent extention
when odoo is responsible to create new database(s).
closesodoo/documentation#6241
X-original-commit: 1639d22efd
Signed-off-by: Antoine Vandevenne (anv) <anv@odoo.com>
Signed-off-by: Rémy Voet (ryv) <ryv@odoo.com>
Added a note to make it clearer that for fiduciaries, a single API key
is valid for all databases linked to the user.
taskid-3570700
closesodoo/documentation#6228
X-original-commit: 323d3563c9
Signed-off-by: Xavier Platteau (xpl) <xpl@odoo.com>
Signed-off-by: Tom Aarab (toaa) <toaa@odoo.com>
Updated screenshots and typos for 16.3
Forward to 16.4:
- Change: Dashboard links are improved, and audit features can be found
in the journal items view.
closesodoo/documentation#6162
Signed-off-by: Xavier Platteau (xpl) <xpl@odoo.com>
A new way to disable IAP accounts has been introduced recently.
This feature is mostly used in neutralization scripts to prevent
customers from accidentaly consuming their credits on their
staging/testing databases.
Documenting it will help users re-enable their accounts if they still
wish to use it in a testing environment.
closesodoo/documentation#6137
X-original-commit: fa604a95b0
Signed-off-by: Louis Baudoux (lba) <lba@odoo.com>
Remove parenthesis around a term that's fairly straightforward to
understand and later used as a title Add a much-needed point.
closesodoo/documentation#6124
X-original-commit: 6f3ed657fc
Signed-off-by: Antoine Vandevenne (anv) <anv@odoo.com>
Signed-off-by: Stanislas Gueniffey (stgu) <stgu@odoo.com>
