From 67449ced6641492c46676d403e3c8f7a8368102e Mon Sep 17 00:00:00 2001
From: Goffin Simon <sig@odoo.com>
Date: Thu, 19 Jul 2018 10:50:40 +0200
Subject: [PATCH 1/4] [FIX] purchase: State 'bid' on PO doesn't exist

Since this commit: https://github.com/odoo/odoo/commit/cb01be235e73cf948418e41642d4906ff84906a6
the state 'bid' doesn't exist on model 'purchase.order'

With courtesy of @rim-odoo

opw:1867594
---
 addons/purchase/purchase_view.xml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/addons/purchase/purchase_view.xml b/addons/purchase/purchase_view.xml
index 27465fffb1f..e2ebd676ce4 100644
--- a/addons/purchase/purchase_view.xml
+++ b/addons/purchase/purchase_view.xml
@@ -168,8 +168,8 @@
                         </button> 
                     </div>
                     <div class="oe_title">
-                        <label string="Request for Quotation " attrs="{'invisible': [('state','not in',('draft','sent','bid'))]}"/>
-                        <label string="Purchase Order " attrs="{'invisible': [('state','in',('draft','sent','bid'))]}"/>
+                        <label string="Request for Quotation " attrs="{'invisible': [('state','not in',('draft','sent'))]}"/>
+                        <label string="Purchase Order " attrs="{'invisible': [('state','in',('draft','sent'))]}"/>
                         <h1>
                             <field name="name" readonly="1"/>
                         </h1>
@@ -368,7 +368,7 @@
             <field name="type">ir.actions.act_window</field>
             <field name="res_model">purchase.order</field>
             <field name="context">{'search_default_todo':1}</field>
-            <field name="domain">[('state','in',('draft','sent','bid','cancel', 'confirmed'))]</field>
+            <field name="domain">[('state','in',('draft','sent','cancel', 'confirmed'))]</field>
             <field name="view_mode">tree,kanban,form,pivot,graph,calendar</field>
             <field name="search_view_id" ref="view_purchase_order_filter"/>
             <field name="help" type="html">
@@ -394,7 +394,7 @@
             <field name="res_model">purchase.order</field>
             <field name="view_mode">tree,kanban,form,pivot,graph,calendar</field>
             <field name="context">{'search_default_todo':1, 'show_purchase': True}</field>
-            <field name="domain">[('state','not in',('draft','sent','bid', 'confirmed'))]</field>
+            <field name="domain">[('state','not in',('draft','sent', 'confirmed'))]</field>
             <field name="search_view_id" ref="view_purchase_order_filter"/>
             <field name="help" type="html">
               <p class="oe_view_nocontent_create">

From 592ee660a54f648c4afcfb31cf5e8e23fd4ef876 Mon Sep 17 00:00:00 2001
From: Ivan Yelizariev <yelizariev@it-projects.info>
Date: Fri, 20 Jul 2018 18:27:10 +0800
Subject: [PATCH 2/4] [FIX] doc: remove incorrect statement

---
 doc/reference/security.rst | 2 --
 1 file changed, 2 deletions(-)

diff --git a/doc/reference/security.rst b/doc/reference/security.rst
index 98999bf415b..c3ea29c3d44 100644
--- a/doc/reference/security.rst
+++ b/doc/reference/security.rst
@@ -71,8 +71,6 @@ This means the first *group rule* restricts access, but any further
 .. warning:: record rules do not apply to the Administrator user
     :class: aphorism
 
-    although access rules do
-
 .. _reference/security/fields:
 
 Field Access

From 1e1d3ed9e61fd1520a8b8800084c8ba66bbacba7 Mon Sep 17 00:00:00 2001
From: Ivan Yelizariev <yelizariev@it-projects.info>
Date: Mon, 23 Jul 2018 13:38:15 +0500
Subject: [PATCH 3/4] [FIX] base: suggested default ACL should be safer

When there is no ACL for a model, the system emits a log with a sample
ACL entry that developers should consider adding. This proposed ACL
should be safe: a default read-only access for internal users
seems appropriate.

Closes #25919
---
 openerp/modules/loading.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/openerp/modules/loading.py b/openerp/modules/loading.py
index 3d235657712..23c921bf442 100644
--- a/openerp/modules/loading.py
+++ b/openerp/modules/loading.py
@@ -389,7 +389,7 @@ def load_modules(db, force_demo=False, status=None, update_module=False):
             cr.execute("""select model,name from ir_model where id NOT IN (select distinct model_id from ir_model_access)""")
             for (model, name) in cr.fetchall():
                 if model in registry and not registry[model].is_transient() and not isinstance(registry[model], openerp.osv.orm.AbstractModel):
-                    _logger.warning('The model %s has no access rules, consider adding one. E.g. access_%s,access_%s,model_%s,,1,0,0,0',
+                    _logger.warning('The model %s has no access rules, consider adding one. E.g. access_%s,access_%s,model_%s,base.group_user,1,0,0,0',
                         model, model.replace('.', '_'), model.replace('.', '_'), model.replace('.', '_'))
 
             # Temporary warning while we remove access rights on osv_memory objects, as they have

From af2e480e419b5817933fb5250fb84fa99e5c3839 Mon Sep 17 00:00:00 2001
From: Christophe Simonis <chs@odoo.com>
Date: Mon, 23 Jul 2018 13:25:42 +0200
Subject: [PATCH 4/4] [FIX] http: refresh request environment after
 authentication

This allow the `/web/session/authenticate` route to return correct
partner and company.

Closes #25652
---
 openerp/http.py | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/openerp/http.py b/openerp/http.py
index 22a9ce5ccf3..fb569330c64 100644
--- a/openerp/http.py
+++ b/openerp/http.py
@@ -1135,6 +1135,8 @@ class OpenERPSession(werkzeug.contrib.sessions.Session):
         request.uid = uid
         request.disable_db = False
 
+        del request.env
+
         if uid: self.get_context()
         return uid