[18.0][MIG] dms: Migration to 18.0 #385

kobros-tech · 2025-01-14T23:24:51Z

No description provided.

…ails, preview

versions of muk_dms than 12.0.2.0.0. Tested from 1.2.4 version.

In v13, this test is programmed in such a way that the demo user is supposed to be able to copy that subdirectory: https://github.com/OCA/dms/blob/c3f802db43362127e70d8c7b4987fb71d4c1f01c/dms/tests/test_directory.py#L40 However, in OCA#7 that test was modified indicating that demo user didn't have permissions to do that: https://github.com/OCA/dms/blob/e3b6d8d24534f2a68bfb88e310cc70cefe46bb64/dms/tests/test_directory.py#L39 Rolling back that change to ensure premissions remain the same in both versions of the module. Also changing the directory to test to ensure it contains no SVG files, whose detection seems to differ among environments, and which have some specific permission restrictions that can make the modified test fail or pass. @Tecnativa TT25645

…tions

kobros-tech · 2025-03-25T05:37:41Z

Hello, thanks for the work. but could you check this issues?
Screencast.from.25-03-2025.11.56.33.webm

@xaviedoanhduy

Issue solved

victoralmau

Some comments:

I don't understand why you are changing the “basis” of how this module works, the permissions of directories and files, something that has specific, intentional and appropriate behavior in v17. The migration is to adapt what is necessary to v18, not to change the behavior completely as you are doing. If something is incorrect in v17 it should be fixed there first.
There is no need to create extra commits to fix something that should be fixed in v18 ([FIX] dms: fix access rules for beter security for example), all changes related to the version change should be done in the migration commit.

xaviedoanhduy · 2025-03-25T07:44:42Z

dms/static/src/js/views/dms_file_upload.esm.js

+import {useBus, useService} from "@web/core/utils/hooks";
+import {_t} from "@web/core/l10n/translation";
+
+const {useRef, useEffect, useState} = owl;


Suggested change

const {useRef, useEffect, useState} = owl;

import {useRef, useEffect, useState} from "@odoo/owl";

This suggestion does not change the functionality, I use this syntax outside odoo if I use OWL in other web apps like Flask.

I can merge better code, and a fix code but this one is alike to the old one :)

xaviedoanhduy · 2025-03-25T07:45:21Z

dms/static/src/js/views/dms_file_upload.esm.js

@@ -0,0 +1,173 @@
+/** @odoo-module */


Suggested change

/** @odoo-module */

/** @odoo-module **/ can be removed from the JS files. Reference: odoo/odoo#142858

I understand that in 18.0 definition is no longer necessary, I also wonder why they did not remove it all from the 18.0 brnch?

anyway, this change can be taken into account, thanks.

kobros-tech · 2025-03-25T16:51:30Z

Some comments:

* I don't understand why you are changing the “basis” of how this module works, the permissions of directories and files, something that has specific, intentional and appropriate behavior in v17. The migration is to adapt what is necessary to v18, not to change the behavior completely as you are doing. If something is incorrect in v17 it should be fixed there first.

* There is no need to create extra commits to fix something that should be fixed in v18 ([FIX] dms: fix access rules for beter security for example), all changes related to the version change should be done in the migration commit.

Dear @victoralmau

I well known that you made a lot of contribution on this project and many other fascinating projects.
I am learning from your wok by the way, when I try to fix an issue here or in other place it does not mean personally I downgrade your effort.

I am relying on dms module and we take it priority same as EE documents module or maybe more.

For that reason we need everything to be optimized with no gap!!

I observed the security gap once I started migration, and I asked you and @etobella for helping me in migration.

we are a community and no body can do all the work alone!

Maybe I am interested in 18.0 but you are interested in 17.0 and someone else is interested in 16.0.

So that I finished the migration alone but I had to solve the issue appeared to me here alone.
I am not interested in old versions in the meanwhile, and I left the commit of the fix separate for others to add it in old versions that are of their interest maybe you are one of them.
Maybe me if I have time can do that in sequence from old to new, but we are a community and we do our work here for free to help each other having our business succeed.

I asked you about some rules domains and I did not get a convincing answer, even some reviewers found the issues and I couldn't justify as I myself was not convinced.

For that reason and for having customers upload serious private documents we should have a module takes into account ultimate security and privacy for each partner alone.

I hope you have seen the videos and liked them, if so I encourage you and others to continue what I have started in the versions of your interest that you can review and debug.

Now I am satisfied with what I have done till you decide to merge or to modify, as long as it is a contribution it is owned by every contributor.

pedrobaeza · 2025-03-25T16:57:03Z

@kobros-tech in a community, we should try to drive things to make them feasible for the actors, and asking the double effort of both reviewing the migration and the changes, and more without having clear (except for videos, which are not very explanatory IMO), the behavior changes, makes that this pull request will hardly be mergeable.

Please start just making a plain migration to the new version, and the open other PR and focus on that changes, and always try to explain in the cleanest way the problem you are trying to fix and how to do it. Take also into account that what you consider a problem, others may consider that behavior as a requirement for their needs. And even if not a requirement, just the change of behavior is something that needs to be handled (for example, with migration scripts).

Can you please split then the work?

kobros-tech · 2025-03-25T17:19:50Z

@pedrobaeza
ok, I have to add it in 17.0 PR and discuss there, on the same way it can be migrated to 18.0 here or on my side using gitaggregate.

I will start it now

kobros-tech · 2025-03-25T17:59:06Z

The fix for 17.0 is on this closed PR
If some one is interested they can reopen and fix test cases, I am sorry if can not do it in the meanwhile:
#393

victoralmau · 2025-03-26T08:13:44Z

dms/models/dms_security_mixin.py

+        base_sql = """(
+                SELECT
+                    dir_group_rel.aid
+                FROM
+                    dms_directory_complete_groups_rel AS dir_group_rel
+                    INNER JOIN dms_access_group AS dag
+                        ON dir_group_rel.gid = dag.id
+                    INNER JOIN dms_access_group_users_rel AS users
+                        ON users.gid = dag.id
+                WHERE
+                    users.uid = %s
+            )"""
+        if operation == "read":
+            sql = SQL(
+                base_sql,
+                self.env.uid,
+            )
+        else:
+            base_sql = f"""(
+                            SELECT
+                                dir_group_rel.aid
+                            FROM
+                                dms_directory_complete_groups_rel AS dir_group_rel
+                                INNER JOIN dms_access_group AS dag
+                                    ON dir_group_rel.gid = dag.id
+                                INNER JOIN dms_access_group_users_rel AS users
+                                    ON users.gid = dag.id
+                            WHERE
+                                users.uid = %s {self._OPERATION_CONDITIONS[operation]}
+                        )"""
+            sql = SQL(
+                base_sql,
+                self.env.uid,
+            )
+        return sql


Although the result is the same, can you reduce the diff to do everything without if/else (just as it was before)?

victoralmau · 2025-03-26T08:15:29Z

dms/security/security.xml

        <field name="perm_write" eval="0" />
        <field name="perm_unlink" eval="0" />
-        <field name="domain_force">[('permission_create', '=', user.id)]</field>
+        <field name="domain_force">[('permission_create', '=', True)]</field>


According to the comments on #385 (comment) these changes (and everything related) are not necessary, the behavior that has been in place up to now should be maintained.

victoralmau · 2025-03-26T08:20:14Z

dms/template/portal.xml

+            <li
+                id="portal_breadcrumbs_documents"
+                t-if="page_name == 'dms_directory' or dms_directory"
+                t-attf-class="breadcrumb-item #{'active 'if not dms_directory else ''}"
+            >
+                <a
+                    t-if="dms_directory"
+                    t-attf-href="/my/dms?{{ keep_query() }}"
+                >Documents</a>
+                <t t-else="">Documents</t>
+            </li>


These changes are not necessary and it should be as before. The breadcrum will only be shown if access_token is not used (if it is used, probably there is no logged in user and adding the link to “/my/dms” does not make sense because it will not work).

kobros-tech · 2025-03-26T14:24:05Z

The cause of security suspecion can be shown in this example:

`

file = self.env['dms.file']
file.search_count([])
36
domain = [('permission_read', '=', self.env.user.id)]
file.search_count(domain)
36
domain = [('permission_read', '=', 123456)]
file.search_count(domain)
36
domain = [('permission_write', '=', 'foo bar baz')]
file.search_count(domain)
36
portal_user = self.env.ref('base.demo_user0')
portal_user.name
'Joel Willis'
domain = [('permission_unlink', '=', portal_user.id)]
file.search_count(domain)
36
domain = [('permission_unlink', '=', 'Can any value give permission to do anything?')]
file.search_count(domain)
36
domain = [('permission_write', '=', 'Can any value give permission to do anything?')]
file.search_count(domain)
36
domain = [('permission_create', '=', 'Can any value give permission to do anything?')]
file.search_count(domain)
36
domain = [('permission_create', '=', False)]
file.search_count(domain)
0
domain = [('permission_create', '=', True)]
file.search_count(domain)
36
domain = [('permission_unlink', '=', self.env.user.id)]
file.search_count(domain)
36
domain = [('permission_create', '=', self.env.user.id)]
file.search_count(domain)
36

`

kobros-tech · 2025-03-26T14:25:49Z

xaviedoanhduy · 2025-03-28T08:48:52Z

The UI looks like it's broken. Maybe this PR will be useful for you when changing some outdated classes in the upstream codebase: OCA/odoo-module-migrator#121

Menu Documents > Files

Menu Documents > Directories

xaviedoanhduy

it should show file name instead of file size, it should show file name instead of file size

victoralmau · 2025-03-28T09:10:02Z

As discussed at #385 (comment), can you continue this PR with only the necessary migration changes?

xaviedoanhduy

onboarding component is gone. I'm not sure, it seems to have been removed in version 18.0 (if that's true, you should remove references to calling onboarding like in previous versions)

xaviedoanhduy · 2025-03-28T09:45:04Z

compare version 16.0 to 18.0: menu Documents > Configurations > Tags

version 16.0

version 17.0

version 18.0: missing colors

note: I think the tag names should be written in regular like version 16.0 instead of bold

xaviedoanhduy · 2025-04-01T05:28:47Z

Can you check why portal users can access the list and download all the files?
Here I am comparing 2 versions 16.0 and 18.0. While version 16.0 will limit portal users to see certain documents, not all like version 18.0.

16.0
Screencast from 01-04-2025 12:25:05.webm

18.0
Screencast from 01-04-2025 12:16:58.webm

kobros-tech · 2025-04-01T06:45:21Z

Can you check why portal users can access the list and download all the files? Here I am comparing 2 versions 16.0 and 18.0. While version 16.0 will limit portal users to see certain documents, not all like version 18.0.

16.0 Screencast from 01-04-2025 12:25:05.webm

18.0 Screencast from 01-04-2025 12:16:58.webm

Apply this commit and and watch description video and review if you need to limit accessing files.

victoralmau · 2025-04-01T06:48:50Z

Sorry, are you going to continue this migration PR with the extra security rule changes you have added? #385 (comment)

I just intend to clarify, otherwise, this PR will not work (at least for me) because it has changes that are not necessary and deform the existing behavior in previous versions, therefore, I will create a new one re-using the changes that are from the migration in a new PR.

kobros-tech · 2025-04-01T07:16:25Z

Sorry, are you going to continue this migration PR with the extra security rule changes you have added? #385 (comment)

I just intend to clarify, otherwise, this PR will not work (at least for me) because it has changes that are not necessary and deform the existing behavior in previous versions, therefore, I will create a new one re-using the changes that are from the migration in a new PR.

all right, ping us and will be reviewing with you there if you need.

victoralmau · 2025-04-01T07:18:33Z

Sorry, are you going to continue this migration PR with the extra security rule changes you have added? #385 (comment)
I just intend to clarify, otherwise, this PR will not work (at least for me) because it has changes that are not necessary and deform the existing behavior in previous versions, therefore, I will create a new one re-using the changes that are from the migration in a new PR.

all right, ping us and will be reviewing with you there if you need.

Everything is commented and explained at #392, but in any case, all those changes should not be included here.

victoralmau · 2025-04-02T10:05:35Z

Superseded by #399

pedrobaeza · 2025-04-03T07:09:14Z

Yes, having the fact that this PR is introducing debatable behavior changes, let's do the raw migration, and discuss in subsequent PRs the convenience of the other changes.

Mathias Markl and others added 30 commits January 13, 2025 21:48

Version 1.0.0

bb8c0a5

9.0 > 10.0

7636f28

added markdown preview using showdown js library

822c966

update

6cc57c9

Add Ukrainian translation to mik_dms and muk_dms_access

e1aa6ce

Documents 2.0

c68ab06

publish muk_dms - 11.0

9a0163b

v12

cdfdda2

[IMP] : black, isort, prettier

a684fe2

[MIG] dms: from muk_dms to dms

d88300f

[MIG] Dms tag

b2da326

[MIG] dms: File

102de18

[MIG][13.0] dms: Finish migration

5f23f8b

[IMP] Minor mig fixes

c75dede

[MIG] dms: fix tests

87a5b4b

[IMP] Add security groups

060c964

[ADD] dms: add funcionality of muk_dms_file

39245e6

[MIG] dms: File functionality

84813ee

[IMP] dms: Allow to drag and drop

810dfa3

[FIX] Various fixes

ae2af0d

[IMP] dms: Add mail

b034c19

[FIX] dms: remove unused code and fixing: webpanel, migration, thumbn…

2143a41

…ails, preview

[IMP] dms: add migration script for muk_dms

38e2e4e

[13.0][MIG] dms: make migrations scripts compatible with older

931920c

versions of muk_dms than 12.0.2.0.0. Tested from 1.2.4 version.

[FIX] dms: Download file with its proper name

f60081c

[FIX] dms: missing banner images & Load fields on the usual way

ec78f52

[FIX] dms: Fix preview widget

9fa8985

[IMP] dms: Portal

e7003ea

[FIX] dms: /my/dms change to user and separate some urls in some func…

de9c656

…tions

kobros-tech requested review from etobella, victoralmau and xaviedoanhduy March 25, 2025 05:57

victoralmau suggested changes Mar 25, 2025

View reviewed changes

xaviedoanhduy suggested changes Mar 25, 2025

View reviewed changes

kobros-tech mentioned this pull request Mar 25, 2025

[FIX] dms: fix access rules for better security #392

Closed

[18.0][MIG] dms: Migration to 18.0

f0908f5

kobros-tech force-pushed the 18.0-mig-dms branch from 5d2860c to f0908f5 Compare March 25, 2025 17:36

victoralmau suggested changes Mar 26, 2025

View reviewed changes

xaviedoanhduy suggested changes Mar 28, 2025

View reviewed changes

xaviedoanhduy reviewed Mar 28, 2025

View reviewed changes

victoralmau mentioned this pull request Apr 2, 2025

[18.0][MIG] dms: Migration to 18.0 #399

Merged

15 tasks

pedrobaeza closed this Apr 3, 2025

	const {useRef, useEffect, useState} = owl;
	import {useRef, useEffect, useState} from "@odoo/owl";

Uh oh!

[18.0][MIG] dms: Migration to 18.0 #385

[18.0][MIG] dms: Migration to 18.0 #385

Uh oh!

Conversation

kobros-tech commented Jan 14, 2025

Uh oh!

kobros-tech commented Mar 25, 2025

Uh oh!

victoralmau left a comment

Choose a reason for hiding this comment

Uh oh!

xaviedoanhduy Mar 25, 2025

Choose a reason for hiding this comment

Uh oh!

kobros-tech Mar 25, 2025

Choose a reason for hiding this comment

Uh oh!

xaviedoanhduy Mar 25, 2025

Choose a reason for hiding this comment

Uh oh!

kobros-tech Mar 25, 2025

Choose a reason for hiding this comment

Uh oh!

kobros-tech commented Mar 25, 2025

Uh oh!

pedrobaeza commented Mar 25, 2025

Uh oh!

kobros-tech commented Mar 25, 2025

Uh oh!

kobros-tech commented Mar 25, 2025

Uh oh!

victoralmau Mar 26, 2025

Choose a reason for hiding this comment

Uh oh!

victoralmau Mar 26, 2025

Choose a reason for hiding this comment

Uh oh!

victoralmau Mar 26, 2025

Choose a reason for hiding this comment

Uh oh!

kobros-tech commented Mar 26, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

The cause of security suspecion can be shown in this example:

Uh oh!

kobros-tech commented Mar 26, 2025

Uh oh!

xaviedoanhduy commented Mar 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

xaviedoanhduy left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

victoralmau commented Mar 28, 2025

Uh oh!

xaviedoanhduy left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

xaviedoanhduy commented Mar 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

xaviedoanhduy commented Apr 1, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

kobros-tech commented Apr 1, 2025

Uh oh!

victoralmau commented Apr 1, 2025

Uh oh!

kobros-tech commented Apr 1, 2025

Uh oh!

victoralmau commented Apr 1, 2025

Uh oh!

victoralmau commented Apr 2, 2025

Uh oh!

pedrobaeza commented Apr 3, 2025

Uh oh!

Reviewers

Assignees

kobros-tech commented Mar 26, 2025 •

edited

Loading

xaviedoanhduy commented Mar 28, 2025 •

edited

Loading

xaviedoanhduy left a comment •

edited

Loading

xaviedoanhduy left a comment •

edited

Loading

xaviedoanhduy commented Mar 28, 2025 •

edited

Loading

xaviedoanhduy commented Apr 1, 2025 •

edited

Loading