| Availability |
Odoo Online
Odoo.sh
On Premise
|
| Odoo Apps Dependencies |
•
CRM (crm)
• Discuss (mail) • Calendar (calendar) • Contacts (contacts) |
| Lines of code | 1474 |
| Technical Name |
onlinepbx_integration |
| License | OPL-1 |
| Website | https://todoo.uz |
| Availability |
Odoo Online
Odoo.sh
On Premise
|
| Odoo Apps Dependencies |
•
CRM (crm)
• Discuss (mail) • Calendar (calendar) • Contacts (contacts) |
| Lines of code | 1474 |
| Technical Name |
onlinepbx_integration |
| License | OPL-1 |
| Website | https://todoo.uz |
OnlinePBX Integration
Webhook-based call tracking for Odoo 19 — automatic lead linking, recordings, hangup analytics. No click-to-call agent, no extra services to install.
What it does
The module receives call_end and call_missed webhooks from your OnlinePBX (onpbx.ru) tenant, deduplicates retried events, links each call to a CRM lead or opportunity by phone number, and posts an XSS-safe chatter notification with direction, duration, hangup cause, operator extension, and a link to the call recording.
🔐 Hardened security
Timing-safe hmac.compare_digest, POST-only endpoint, recording URL whitelist, IP allow-list, per-IP rate limit, audited key rotation.
♻️ Race-safe dedupe
UUID-first dedupe key with PostgreSQL advisory locks. Concurrent retries of the same call collapse to one record.
📞 Smart lead matching
Operator extension → partner salesperson → default sales team. Uses Odoo's phone_sanitized (E.164) for the lookup.
📊 Built-in analytics
List, Kanban, Form, Pivot and Graph views. Group by status, direction, hangup cause, operator, PBX domain.
👥 3-tier access
User (own/team), Manager (all + configure), Administrator (delete logs + rotate key). Record rules + ACL.
🌍 Fully localized
Uzbek, Russian, English. Every user-visible string is translated — including chatter, selection labels, and search filters.
Screenshots
t-out escape — never t-raw.
Technical specs
| Odoo version | 19.0 |
|---|---|
| Dependencies | crm, mail, phone_validation |
| Webhook endpoint | POST /call/webhook?key=... (query-parameter auth) |
| Auth | Timing-safe hmac.compare_digest, no fallback (invalid key → 403) |
| Dedupe | UUID-first, PostgreSQL advisory lock, MD5+bigint key |
| Recording URL | Whitelist: *.onlinepbx.ru and *.onpbx.ru over https:// only |
| Rate limit | Configurable per IP, default 60/min |
| Data retention | Cron clears raw payload after 90 days (configurable). Structured columns kept indefinitely. |
| Translations | Uzbek, Russian, English — fully translated .po files included |
| Tests | 7 test files covering auth, dedupe, XSS, lead resolution, phone normalization, hangup parsing, access rights |
| License | OPL-1 |
Security checklist
- No auth fallback — invalid or missing key always returns HTTP 403
- POST only — GET / PUT / DELETE rejected
- Timing-safe key comparison with
hmac.compare_digest - Recording URL validated: scheme + domain whitelist
- Chatter rendered via QWeb
t-out— stored XSS impossible - Webhook key shown as a password field in Odoo; delivered to OnlinePBX as a query parameter on the URL (their UI exposes no header option) — combine with IP whitelist for defense in depth, rotate via the audited rotation flow
- Optional IP CIDR whitelist + per-IP sliding-window rate limit
- Key rotation audited in
webhook.configchatter - 3-tier permissions enforced via
ir.model.access.csvand record rules
What's NOT included (be clear)
- No click-to-call dialer — this is a receive-only integration.
- No outbound call origination from Odoo.
- No softphone / WebRTC component.
- The recording URL is stored and linked; the recording itself is hosted on OnlinePBX's CDN.
Setup
- Install the module from your Odoo Apps menu.
- The post-install hook auto-promotes every system administrator to the OnlinePBX / Administrator group. Assign the lower-tier User and Manager roles to your team from Settings → Users.
- In Odoo open Call Logs → Configuration → Webhook. Copy the Webhook URL — the security key is already embedded in it.
- In your OnlinePBX admin panel (
panel.onlinepbx.ru):- Open Сервисы → Интеграция → Webhooks.
- Click + Добавить.
- Paste the Webhook URL into the URL-Адрес field.
- Tick only the events the module needs: Завершили (call ended) and Пропущенный (missed). Leave the rest unchecked — the module ignores them.
- Click Сохранить.
- Optionally tighten things under Settings → OnlinePBX in Odoo: IP whitelist (recommended — restrict to OnlinePBX's IP range), rate limit, default sales team, raw data retention.
- Place a test call. The first
call.logrecord appears within seconds.
A note on the webhook key
The OnlinePBX webhook UI accepts only a URL and event checkboxes — there is no HTTP header field. The module therefore embeds the security key in the URL as a query parameter. To protect the key, combine it with the optional IP whitelist (under Settings → OnlinePBX) so that even a leaked URL won't accept requests from anywhere else. Rotate the key from the Webhook screen whenever needed — the previous key is invalidated immediately and the rotation is logged in the chatter.
Support
Bug reports, configuration help and customization requests: info@todoo.uz. Average response time: 1 business day.
Odoo Proprietary License v1.0 This software and associated files (the "Software") may only be used (executed, modified, executed after modifications) if you have purchased a valid license from the authors, typically via Odoo Apps, or if you have received a written agreement from the authors of the Software (see the COPYRIGHT file). You may develop Odoo modules that use the Software as a library (typically by depending on it, importing it and using its resources), but without copying any source code or material from the Software. You may distribute those modules under the license of your choice, provided that this license is compatible with the terms of the Odoo Proprietary License (For example: LGPL, MIT, or proprietary licenses similar to this one). It is forbidden to publish, distribute, sublicense, or sell copies of the Software or modified copies of the Software. The above copyright notice and this permission notice must be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
Please log in to comment on this module