1. 12 Nov, 2024 9 commits
  2. 11 Nov, 2024 1 commit
  3. 08 Nov, 2024 8 commits
  4. 07 Nov, 2024 3 commits
  5. 06 Nov, 2024 1 commit
    • Vincent Pelletier's avatar
      erp5_oauth2_authorisation: Do not edit OAuth2 Session on every refresh token issuance · 36768696
      Vincent Pelletier authored
      Malevolent users may decide to only - and repeatedly - present an otherwise
      valid refresh token, causing the issuance of a new access tokens everytime,
      likely along with new refresh tokens, causing many ZODB writes.
      Avoid this by pushing the token expiration date by one lifespan accuracy,
      so there can only be one write per session per lifespan accuracy period.
      36768696
  6. 05 Nov, 2024 6 commits
    • Jérome Perrin's avatar
      accounting: only allow Assignor to restart accounting periods · d7c0baf1
      Jérome Perrin authored
      This partially reverts 8a336dc5 (erp5_accounting: Allow
      Assignor manage Accounting Periods, 2024-09-16) for the restart
      transition, it is intentional that only Assignor can restart
      an accounting period that have been closed.
      The idea was to support a scenario where re-opening a period
      that was closed can not be done directly by the Assignee but
      needs validation from the assignor.
      d7c0baf1
    • Jérome Perrin's avatar
      web_renderjs_ui: fix detection of Base_redirect redirections · ad699c72
      Jérome Perrin authored
      The check was made on the blob response type, which is set from the
      Content-Type header returned by the server, but Safari has a different
      interpretation of the charset parameter from the mime type, with a
      content type set to application/json;charset=utf-8 like Base_redirect
      does today, safari creates a blob with type application/json;charset=utf-8
      and this was not detected as redirection and the json returned by
      Base_redirect was downloaded. Fix this by checking only the essence
      of the type.
      
      This also revealed a potential problem when actually downloading json
      files, in that case we also check that we have the X-Location header,
      that is supposed to be set by Base_redirect before interpreting the json
      and when it's not present we force download.
      ad699c72
    • Jérome Perrin's avatar
      ERP5Workflow: fix adding permissions · 9f3d6a99
      Jérome Perrin authored
      Follow up of ff624fd2 (ERP5Workflow: newly added permission should be
      acquired for all existing states., 2024-11-04) and cbef6282 (ERP5Workflow:
      make sure not create duplicate permissions, 2024-11-05)
      9f3d6a99
    • Jérome Perrin's avatar
      ERP5Workflow: make sure not create duplicate permissions · cbef6282
      Jérome Perrin authored
      Fix a problem introduced in ff624fd2 (ERP5Workflow: newly added
      permission should be acquired for all existing states., 2024-11-04),
      visible in a test failure
      cbef6282
    • Jérome Perrin's avatar
      3a9b16d4
    • Jérome Perrin's avatar
  7. 04 Nov, 2024 4 commits
  8. 01 Nov, 2024 2 commits
  9. 30 Oct, 2024 1 commit
  10. 29 Oct, 2024 1 commit
  11. 28 Oct, 2024 1 commit
    • Jérome Perrin's avatar
      Revert "simulation: introduce Rule.getSimulationMovementSimulationState" · ccadeaa4
      Jérome Perrin authored
      This reverts commit 5e21f77f.
      
      This was done too quickly based on a wrong assumption that simulation
      movements to build would always be in planned state and that we could
      have an efficient way of selecting them by catalog with index on
      portal_type and simulation state, but it does not work this way.
      
      Maybe the change is useful for something else, but since we don't have
      any use case for now, let's just revert.
      ccadeaa4
  12. 25 Oct, 2024 1 commit
  13. 24 Oct, 2024 2 commits