From b1a373c6649b206dd417b108a39dd214dcb106bc Mon Sep 17 00:00:00 2001 From: Damien Bouvy Date: Fri, 6 Jul 2018 08:47:40 +0200 Subject: [PATCH 1/3] Revert "[FIX] stock: do_new_transfer callable in xml-rpc" This reverts commit ef444da57a0e5b3a8426a6fac8cef3f6d856b148. Changing a function signature is not supposed to happen in stable; we have already received 3 opw's about broken customizations or modules that extend the stock because code such as: res = self.do_next_transfer() if not res: stops without any warning. --- addons/sale_stock/tests/test_sale_stock.py | 4 ++-- addons/stock/stock.py | 4 +--- 2 files changed, 3 insertions(+), 5 deletions(-) diff --git a/addons/sale_stock/tests/test_sale_stock.py b/addons/sale_stock/tests/test_sale_stock.py index a19cdcd268f..6085c639f6e 100644 --- a/addons/sale_stock/tests/test_sale_stock.py +++ b/addons/sale_stock/tests/test_sale_stock.py @@ -51,7 +51,7 @@ class TestSaleStock(TestSale): pick_2 = self.so.picking_ids[0] pick_2.force_assign() pick_2.pack_operation_product_ids.write({'qty_done': 1}) - self.assertTrue(pick_2.do_new_transfer(), 'Sale Stock: second picking should be final without need for a backorder') + self.assertIsNone(pick_2.do_new_transfer(), 'Sale Stock: second picking should be final without need for a backorder') self.assertEqual(self.so.invoice_status, 'to invoice', 'Sale Stock: so invoice_status should be "to invoice" after complete delivery') del_qties = [sol.qty_delivered for sol in self.so.order_line] del_qties_truth = [2.0 if sol.product_id.type in ['product', 'consu'] else 0.0 for sol in self.so.order_line] @@ -98,7 +98,7 @@ class TestSaleStock(TestSale): pick = self.so.picking_ids pick.force_assign() pick.pack_operation_product_ids.write({'qty_done': 2}) - self.assertTrue(pick.do_new_transfer(), 'Sale Stock: complete delivery should not need a backorder') + self.assertIsNone(pick.do_new_transfer(), 'Sale Stock: complete delivery should not need a backorder') del_qties = [sol.qty_delivered for sol in self.so.order_line] del_qties_truth = [2.0 if sol.product_id.type in ['product', 'consu'] else 0.0 for sol in self.so.order_line] self.assertEqual(del_qties, del_qties_truth, 'Sale Stock: delivered quantities are wrong after partial delivery') diff --git a/addons/stock/stock.py b/addons/stock/stock.py index 06bafd6a341..45fe1e380d9 100644 --- a/addons/stock/stock.py +++ b/addons/stock/stock.py @@ -1589,8 +1589,6 @@ class stock_picking(models.Model): def do_new_transfer(self, cr, uid, ids, context=None): pack_op_obj = self.pool['stock.pack.operation'] data_obj = self.pool['ir.model.data'] - if not context: - context = {} for pick in self.browse(cr, uid, ids, context=context): to_delete = [] if not pick.move_lines and not pick.pack_operation_ids: @@ -1644,7 +1642,7 @@ class stock_picking(models.Model): if to_delete: pack_op_obj.unlink(cr, uid, to_delete, context=context) self.do_transfer(cr, uid, ids, context=context) - return True + return def check_backorder(self, cr, uid, picking, context=None): need_rereserve, all_op_processed = self.picking_recompute_remaining_quantities(cr, uid, picking, done_qtys=True, context=context) From 95990a31b4d44818d66864253725bf37e47c6bce Mon Sep 17 00:00:00 2001 From: Florent de Labarre Date: Mon, 9 Jul 2018 12:31:32 +0200 Subject: [PATCH 2/3] [FIX] ir.autovacuum: should be executed by the admin Closes #23453 --- openerp/addons/base/ir/ir_autovacuum.py | 3 +++ 1 file changed, 3 insertions(+) diff --git a/openerp/addons/base/ir/ir_autovacuum.py b/openerp/addons/base/ir/ir_autovacuum.py index e2a647e456a..60cfb132239 100644 --- a/openerp/addons/base/ir/ir_autovacuum.py +++ b/openerp/addons/base/ir/ir_autovacuum.py @@ -4,6 +4,7 @@ import logging from openerp import models +from openerp.exceptions import AccessDenied _logger = logging.getLogger(__name__) @@ -28,6 +29,8 @@ class AutoVacuum(models.TransientModel): _logger.info("GC'd %d user log entries", cr.rowcount) def power_on(self, cr, uid, *args, **kwargs): + if not self.pool['res.users']._is_admin(cr, uid, [uid]): + raise AccessDenied() self._gc_transient_models(cr, uid, *args, **kwargs) self._gc_user_logs(cr, uid, *args, **kwargs) return True From 8b25099aea6345c711eaff1d3363c47020653f99 Mon Sep 17 00:00:00 2001 From: Andreas Perhab Date: Mon, 9 Jul 2018 18:49:43 +0200 Subject: [PATCH 3/3] [FIX] auth_oauth: validate db against db_filter --- addons/auth_oauth/controllers/main.py | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/addons/auth_oauth/controllers/main.py b/addons/auth_oauth/controllers/main.py index 3c3ddf84559..46d37d3cbb0 100644 --- a/addons/auth_oauth/controllers/main.py +++ b/addons/auth_oauth/controllers/main.py @@ -133,6 +133,8 @@ class OAuthController(http.Controller): def signin(self, **kw): state = json.loads(kw['state']) dbname = state['d'] + if not http.db_filter([dbname]): + return BadRequest() provider = state['p'] context = state.get('c', {}) registry = RegistryManager.get(dbname) @@ -182,6 +184,8 @@ class OAuthController(http.Controller): dbname = db_monodb() if not dbname: return BadRequest() + if not http.db_filter([dbname]): + return BadRequest() registry = RegistryManager.get(dbname) with registry.cursor() as cr: