Reported: clicking "Post a Listing" on /classifieds while logged out threw
a raw 500 instead of prompting login.
Root cause is upstream, in this Odoo 19 build's own http.py: when
auth='user' raises SessionExpiredException for an anonymous visitor,
Request._serve_db's `finally: self.env = None` clears the request env
before the exception reaches the website error handler, which then tries
to build the login redirect via self.env['ir.http']._redirect(...) and
crashes with TypeError: 'NoneType' object is not subscriptable. This
isn't specific to any one route - it reproduces on every auth='user' +
website=True page hit anonymously, including stock Odoo's own /my (traced
this back to the true cause rather than continuing to treat it as an
unrelated environment quirk, since it now has a real reported symptom).
Since core can't be patched here, worked around it at the route level
across all 9 affected pages (classifieds new/my/renew, membership
my/renew/card, benefits my, school attendance, portal my/school, event
checkin): switched from auth='user' to auth='public' and added an
explicit `if request.env.user._is_public(): return request.redirect(...)`
check at the top of each handler, before Odoo's own auth layer ever gets
a chance to raise. The jsonrpc AJAX endpoints (attendance save, checkin
scan/dashboard) were left on auth='user' since they return a JSON error
rather than attempting an HTML redirect, so they don't hit this path.
Verified against a live Odoo 19 + Postgres 16 container: reproduced the
original crash pre-fix, then confirmed all 9 previously-broken routes now
303-redirect to /web/login?redirect=<path> when hit anonymously, that the
login page carries the redirect target, that logged-in access is
unaffected (200), and that the separate "logged in but lacking a required
group" case (event check-in without Registration Desk) still degrades
gracefully to a clean 403 rather than a crash. Full regression: 48/48
tests pass across the six touched modules.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
community_theme_base: brand tokens (primary/secondary/accent colour, logo,
heading/body font) exposed via res.config.settings, backed by
ir.config_parameter with a neutral default palette. A theme_css_vars QWeb
template renders them as CSS custom properties and is injected into both
website.layout (xpath into //head) and web.basic_layout (used by every
PDF report, including community_membership's card and event_qr_ticketing's
ticket) - so any deployment rebrands with data only. Confirmed env['model']
is accessible bare inside arbitrary QWeb templates (checked core usage in
web/report_templates.xml and website_templates.xml first) before relying
on it for the injection.
community_portal: extends portal.portal_my_home with cards for Membership,
Events, School, Benefits, and Classifieds, each gated by an inline
ir.module.module installed-check so a card is fully absent (not just
zero-count) when its module isn't installed - this is the piece that
finally wires up community_membership's membership_count counter, which
Session 1-C had already implemented but nothing was rendering yet. Adds
counters for the other four product modules (none of which had their own
portal home counter) and a new /my/school page listing a parent's
children's enrollments and attendance.
Verified against a live Odoo 19 + Postgres 16 container, automated (6
tests) and manually per the Phase 6 gate exactly: set a custom primary
colour via config parameter and confirmed it appears both on a real public
page (HttpCase hitting '/') and the live /my dashboard; then uninstalled
community_classifieds via button_immediate_uninstall and confirmed /my
still returned 200 with the "My Classifieds" card gone and no error,
before reinstalling it to restore the dev environment.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
