Skip to content

Syncing from upstream OCA/web (19.0) - #1782

Merged
bt-admin merged 41 commits into
brain-tec:19.0from
OCA:19.0
Jul 28, 2026
Merged

Syncing from upstream OCA/web (19.0)#1782
bt-admin merged 41 commits into
brain-tec:19.0from
OCA:19.0

Conversation

@bt-admin

Copy link
Copy Markdown

bt_gitbot

lmignon and others added 30 commits July 13, 2026 11:24
This technical module allows you to send instant notification messages from the server to the user in live.
Fix a check when comparing a user count with items within a mock call.

The previous method was succeeding by pure luck because OCA test
databases contain 2 users, which happens to be the amount of items
within a mock "call_args" (it contains args + kwargs).
- Use the 'session' class of the JS Framework (session no lounger bound
to web client)
- Test change: compare emitted & received messages based on content, not
order. Using string comparison raises false positives.
Only the admin user (sudo) is allowed to send notifications to other
users. The normal users can only send notifications to themselves.

This is to prevent attackers to craft malicious notifications and send
them to other users using RPC.

Correction based on the idea of @hbrunn
Add self-test buttons in demo environment,
Updated readme to show how to test it.
Add buttons to users form
Do not rely on SUPERUSER_ID and avoid getattr usage
* [ADD]: all available bootstrap notifications (success/danger/warning/info/default)
* [IMP] use black color for text for default notification.
* [FIX] reverted require string for `bus.Longpolling` and rename `on_message_received` to `on_message` to prevent collisions.
It seems besides the custom channels provided in this addon it also catches messages from other channels. E.g. in this case it seems the void popup is triggered by these activity creation bus messages.

**Steps to reproduce**

Odoo commit: could reproduce on 5e8b667951 and 4da82776ff
OCA/web commit: 2465278

* Install crm and web_notify modules
* Create an activity for yourself (tried for admin user)
* Empty popup appears

**Attempt to solve**

It seems the bus handles all messages non exclusively. I've hacked in a conditional to handle only messages from web_notify addon, but its unclear wether this does not break something else.
Includes some manual fixes to silent ESLint warnings.
It exists since many version and is actively maintained.
- Use ES6 in js files
- Update screenshots
- Clean old lint exceptions
- New icon

TT38350
When trying to use the notify function that comes from a normal user with sudo flag enabled, it wasn't letting the user access it. Adding the su flag to the check should allow sudo users using this feature.
- We can now set a button name to the notification action.
- We can set an icon button as well.
- After the button is clicked, the notification gets closed.
@bt-admin bt-admin added the 19.0 label Jul 28, 2026
@bt-admin
bt-admin merged commit c2806ae into brain-tec:19.0 Jul 28, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.