The Content-Security-Policy[^1] http header was only set on the response
generated by controllers but it was missing from the `/<module>/static/`
route.
It is not strictly necessary to set that header on the responses comming
from that routes as it is not possible to add new static files or edit
existing ones via the interface (not even as admin). Only the developers
and system administrator can access those files.
It is also worth mentionning that using the Odoo internal web server to
deliver static files is suboptimal. Outside of a dev environment, those
files will typically be delivered via a web server[^2] and sysadmins
should configure their web server to set the CSP header on static images.
[^1]: https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP
[^2]: https://www.odoo.com/documentation/master/administration/install/deploy.html#serving-static-files-and-attachmentsclosesodoo/documentation#5485
Related: odoo/odoo#131700
Signed-off-by: Julien Castiaux (juc) <juc@odoo.com>
Install nginx using the nginx configuration found in the documentation
and changes the `listen` port to 8080. Start Odoo in `--proxy-mode`.
listen 8080;
server_name mycompany.odoo.com;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Real-IP $remote_addr;
location / {
proxy_pass http://127.0.0.1:8069;
}
Inside your browser, access "http://mycompany.odoo.com:8080" you are
wrongly redirected to "http://mycompany.odoo.com:80".
Odoo uses the `X-Forwarded-Host` http header value to generate new URls,
in this configuration `$host` only contains the domain (=hostname using
the urllib terminology) instead of the domain+port (=netloc). The
variable that contains both the domain and the port is actually
`$http_host`.
closesodoo/documentation#6932Closes: odoo/odoo#64643
X-original-commit: 8d1642984f
Signed-off-by: Antoine Vandevenne (anv) <anv@odoo.com>
Signed-off-by: Julien Castiaux (juc) <juc@odoo.com>
Updated the chart of accounts page. Forward to master.
16.3 -> Change "ellipsis" menu button
17 -> Change "Setup" to "View"
taskid-3609365
closesodoo/documentation#6910
X-original-commit: b617b47ab2
Signed-off-by: Tom Aarab (toaa) <toaa@odoo.com>
Official packages for wkhtmltopdf 0.12.5 are no more released since the
release of wkhtmltopdf 0.12.6 in 2020. Debian 10 "Buster" and Ubuntu
20.04 "Focal" were the last system for which 0.12.5 was built[^1].
Installing 0.12.5 on a Ubuntu 22.04 "Jammy" (using the Focal package)
fails for outdated dependencies.
Official packages for wkhtmltopdf 0.12.6 are published on another
repository[^2] than 0.12.5 used to, it includes packages for 0.12.6 for
both Debian 11 "Bullseye" and Ubuntu 22.04 "Jammy". Version 0.12.6.1-r3
is compatible out-of-the-box with Odoo and has been used by runbot to
test all 16.x, 17.x and master branches for the past month.
This work makes it official that [wkhtmltopdf 0.12.6.1-r3] must be used
for Odoo 16.0 and onward.
[^1]: https://github.com/wkhtmltopdf/wkhtmltopdf/releases/tag/0.12.5
[^2]: https://github.com/wkhtmltopdf/packaging/releases
[wkhtmltopdf 0.12.6.1-r3]: https://github.com/wkhtmltopdf/packaging/releases/tag/0.12.6.1-3closesodoo/documentation#6751
Signed-off-by: Julien Castiaux (juc) <juc@odoo.com>
The preferred/safe way of running Odoo is with a standard user, with
only the right to create a database.
See b6b73551dbclosesodoo/documentation#6728
Signed-off-by: Antoine Vandevenne (anv) <anv@odoo.com>
Many customers struggle with their web server configuration, notably
regarding the `--proxy-mode` option and the way `X-Forwarded-*` HTTP
request headers are interpreted within Odoo.
The `--proxy-mode` section has been updated to cover the most common
misunderstandings and to give guidances on how to setup a web server.
Odoo always only takes the last entry of the `X-Forwarded-*` request
header because there are situations where it is not possible to
determine which last n-th entry to use. Employees might access their
odoo database via the internal network: connecting directly to nginx,
while customers might access the database via an additional proxy such
as cloudflare. The real IP of employees would be the last inside the
`X-Forwarded-For` chain, while the real IP of customers would be the
*second* last entry inside the chain. It would be incorrect to always
take the same nth last entry inside the chain. The cloudflare's own IP
address must be discarded from the chain. Web servers usually feature
a way to ignore trusted IP from the chain, a way so that the real IP
of the user is always the last entry inside the chain. Odoo relies on
such feature to be active and configured.
Prior discussions about `X-Forwarded-For`:
* odoo/odoo#104947
* odoo/odoo#118629
* odoo/odoo#139536
All `X-Forwarded-*` headers are ignored in case the `X-Forwarded-Host`
header is missing (even with `--proxy-mode`). System admin might be
tempted to not set this header and to set `Host` instead, this is
broken as this a user-agent would be able to spoof `X-Forwarded-Host`
and Odoo would use that instead of the correct `Host`.
Prior discussions about `X-Forwarded-Host`:
* odoo/odoo#63277
* odoo/odoo#70117closesodoo/documentation#6738
X-original-commit: 3d91c57b57
Signed-off-by: Julien Castiaux (juc) <juc@odoo.com>
The lambda function here is useless and makes newdooers think
they need to use it everytime.
`default=fields.Date.add(fields.Date.today(), months=3))`
should do the trick, no lambda involved.
closesodoo/documentation#6607
Signed-off-by: Antoine Vandevenne (anv) <anv@odoo.com>
The "../technical-training-sandbox" is added too early in the path since
its still empty, and results into an "invalid addons-path" error.
Part-of: odoo/documentation#6607
Without the :show-content: metadata markup, it is not possible to open the
page by navigating from the toctree.
closesodoo/documentation#6524
X-original-commit: 16e339a7a3
Signed-off-by: Xavier Platteau (xpl) <xpl@odoo.com>
This addition explains how to create and connect an existing plausible.io account in Odoo.
task-3540753
closesodoo/documentation#6495
Signed-off-by: Jonathan Castillo (jcs) <jcs@odoo.com>
0c0cf8ebc9
added a new way to select accounts in the account_codes engine. This
commit adds some explanation in the doc on how to use this new syntax.
closesodoo/documentation#6494
Signed-off-by: Jonathan Castillo (jcs) <jcs@odoo.com>
This PR adds the documentation for a new Pos IoT Six module which will
soon replace the old Six module.
task-3555605
closesodoo/documentation#5912
Signed-off-by: Yaroslav Soroko (yaso) <yaso@odoo.com>
Co-authored-by: Yaroslav Soroko (yaso) <yaso@odoo.com>
Co-authored-by: Loredana Perazzo <lrpz@odoo.com>
For some reason, the first-person was used throughout the IAP
documentation, and quite inconsistently.
As the rest of the documentation is using second-person writing, IAP
should be no exception.
closesodoo/documentation#6298
X-original-commit: 8d0ae3b5df
Signed-off-by: Antoine Vandevenne (anv) <anv@odoo.com>
Signed-off-by: Louis Baudoux (lba) <lba@odoo.com>
It has been decided to remove the possibility for our users to create
their own IAP services.
This decision was motivated by the fact that, in the 5 years of
existence of IAP, very few non-Odoo services have been created and
actively used by our customers.
X-original-commit: 0c1b7c4636
Part-of: odoo/documentation#6298
We have introduced a second version of the Extract API that adds the IAP
account token to the `get_result` and `validate` routes.
There are also other changes in this commit:
- The deprecated stuff has been removed as it's been deprecated for a
while and won't be supported anymore in the future.
- The `status` table of the `get_result` route has been added as it was
missing for some reason.
- The documentation regarding the `/validate` routes have been removed
for security reasons.
closesodoo/documentation#6277
X-original-commit: a8c6272899
Signed-off-by: Antoine Vandevenne (anv) <anv@odoo.com>
Signed-off-by: Louis Baudoux (lba) <lba@odoo.com>
In the CLI, `--unaccent` try to enable PostgreSQL unaccent extention
when odoo is responsible to create new database(s).
closesodoo/documentation#6238
X-original-commit: 1639d22efd
Signed-off-by: Antoine Vandevenne (anv) <anv@odoo.com>
Signed-off-by: Rémy Voet (ryv) <ryv@odoo.com>
