From 6ac32c655e66e6e70c85391cad60d3ed4db64af1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Manuel=20V=C3=A1zquez=20Acosta?=
 <mvaled@users.noreply.github.com>
Date: Wed, 16 Jan 2019 06:51:43 -0500
Subject: [PATCH 1/8] [FIX] survey: don't disclose the survey via print

To avoid bigger changes, only verify if the login is required.
A proper refactoring has been implemented in master at 9771fdfe8f658fd0f

Closes odoo/odoo#30166
---
 addons/survey/controllers/main.py | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/addons/survey/controllers/main.py b/addons/survey/controllers/main.py
index 553fc5ad4b2..331b8a8642c 100644
--- a/addons/survey/controllers/main.py
+++ b/addons/survey/controllers/main.py
@@ -252,6 +252,10 @@ class WebsiteSurvey(http.Controller):
     def print_survey(self, survey, token=None, **post):
         '''Display an survey in printable view; if <token> is set, it will
         grab the answers of the user_input_id that has <token>.'''
+
+        if survey.auth_required and request.env.user == request.website.user_id:
+            return request.render("survey.auth_required", {'survey': survey, 'token': token})
+
         return request.render('survey.survey_print',
                                       {'survey': survey,
                                        'token': token,

From 92e4c4c347c9ca84d265c81ca9ab3e5a4620b593 Mon Sep 17 00:00:00 2001
From: Iryna Vyshnevska <i.vyshnevska@mobilunity.com>
Date: Wed, 9 Jan 2019 13:42:50 +0000
Subject: [PATCH 2/8] [CLA] signature for ivyshnevska

Backport to 10.0 of 3b14a7daa6c5a4d92b0

closes odoo/odoo#30090
---
 doc/cla/individual/i-vyshnevska.md | 9 +++++++++
 1 file changed, 9 insertions(+)
 create mode 100644 doc/cla/individual/i-vyshnevska.md

diff --git a/doc/cla/individual/i-vyshnevska.md b/doc/cla/individual/i-vyshnevska.md
new file mode 100644
index 00000000000..0df4e78944d
--- /dev/null
+++ b/doc/cla/individual/i-vyshnevska.md
@@ -0,0 +1,9 @@
+Ukraine, 2019-01-09
+
+I hereby agree to the terms of the Odoo Individual Contributor License Agreement v1.0.
+
+I declare that I am authorized and able to make this agreement and sign this declaration.
+
+Signed,
+
+Vyshnevska Iryna i.vyshnevska@mobilunity.com https://github.com/i-vyshnevska/
\ No newline at end of file

From 614babd1e78e4ea329c3628bedbca652207b7867 Mon Sep 17 00:00:00 2001
From: Nicolas Martinelli <nim@odoo.com>
Date: Wed, 16 Jan 2019 11:09:21 +0000
Subject: [PATCH 3/8] [FIX] account: bank statement with many AML

- Create a bank statement with more than 80 lines (therefore more than
  80 AML)
- Reconcile the lines
- Go back to the bank statement, and try to add a new line

An error arise:
"You cannot do this modification on a posted journal entry, you can just
change some non legal fields"

The error arise on the `move_line_ids` field on which the web client
tries to write.

Actually, this field is hidden since it is only used in the domain of a
stat button. We can make it read-only.

opw-1921138

closes odoo/odoo#30266
---
 addons/account/views/account_view.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/addons/account/views/account_view.xml b/addons/account/views/account_view.xml
index 6d7434b65bd..6973755853b 100644
--- a/addons/account/views/account_view.xml
+++ b/addons/account/views/account_view.xml
@@ -559,7 +559,7 @@
                         <button class="oe_stat_button" name="button_journal_entries"
                                 string="Journal Entries" type="object"
                                 attrs="{'invisible':[('move_line_ids','=',[])]}" icon="fa-bars"/>
-                        <field name="move_line_ids" invisible="1"/>
+                        <field name="move_line_ids" invisible="1" readonly="1"/>
                     </div>
                     <div class="oe_title oe_inline">
                         <label for="name" class="oe_edit_only"/>

From 302d8a526441b85120f1b4501bae3efcbe700d47 Mon Sep 17 00:00:00 2001
From: Joren Van Onder <jov@odoo.com>
Date: Fri, 2 Feb 2018 01:34:53 +0000
Subject: [PATCH 4/8] [FIX] point_of_sale: allow refunds on non-cash journals

Cherry pick of 5b769650d6416be123e972aa8f4b2b2c25ce438f in version 11.0

A customer can pay an order with a non-cash journal (e.g. a credit
card through a stand-alone terminal).

When this order has to be refunded later it should be possible to do
so on that same journal.

Some code prevented this from happening, notably a check in
order_is_valid which explicitly prevented this for an unknown
reason. There is no explanation in the
commit (4647f896a428a19daa5b0bc3585e801110e815b4) introducing that.

This commit allows the following:

1. input what you want to refund with a negative qty
2. click 'Payment'
3. click the Credit Card (type Bank) journal
4. (amount is auto-populated)
5. click 'Validate'

opw-805302
opw-1913731

closes odoo/odoo#30218
---
 addons/point_of_sale/static/src/js/models.js  |  6 +++---
 addons/point_of_sale/static/src/js/screens.js | 11 -----------
 2 files changed, 3 insertions(+), 14 deletions(-)

diff --git a/addons/point_of_sale/static/src/js/models.js b/addons/point_of_sale/static/src/js/models.js
index dd2eb8d9596..fa6215ee0e8 100644
--- a/addons/point_of_sale/static/src/js/models.js
+++ b/addons/point_of_sale/static/src/js/models.js
@@ -2092,7 +2092,7 @@ exports.Order = Backbone.Model.extend({
         this.assert_editable();
         var newPaymentline = new exports.Paymentline({},{order: this, cashregister:cashregister, pos: this.pos});
         if(cashregister.journal.type !== 'cash' || this.pos.config.iface_precompute_cash){
-            newPaymentline.set_amount( Math.max(this.get_due(),0) );
+            newPaymentline.set_amount( this.get_due() );
         }
         this.paymentlines.add(newPaymentline);
         this.select_paymentline(newPaymentline);
@@ -2256,10 +2256,10 @@ exports.Order = Backbone.Model.extend({
                 }
             }
         }
-        return round_pr(Math.max(0,due), this.pos.currency.rounding);
+        return round_pr(due, this.pos.currency.rounding);
     },
     is_paid: function(){
-        return this.get_due() === 0;
+        return this.get_due() <= 0;
     },
     is_paid_with_cash: function(){
         return !!this.paymentlines.find( function(pl){
diff --git a/addons/point_of_sale/static/src/js/screens.js b/addons/point_of_sale/static/src/js/screens.js
index 7c1cb9559a6..82e6fa0e7b2 100644
--- a/addons/point_of_sale/static/src/js/screens.js
+++ b/addons/point_of_sale/static/src/js/screens.js
@@ -1943,17 +1943,6 @@ var PaymentScreenWidget = ScreenWidget.extend({
             return false;
         }
 
-        var plines = order.get_paymentlines();
-        for (var i = 0; i < plines.length; i++) {
-            if (plines[i].get_type() === 'bank' && plines[i].get_amount() < 0) {
-                this.gui.show_popup('error',{
-                    'message': _t('Negative Bank Payment'),
-                    'comment': _t('You cannot have a negative amount in a Bank payment. Use a cash payment method to return money to the customer.'),
-                });
-                return false;
-            }
-        }
-
         if (!order.is_paid() || this.invoicing) {
             return false;
         }

From 180ace7b1bcef74149bc85cf2e68a0b9acdcbc09 Mon Sep 17 00:00:00 2001
From: Nicolas Martinelli <nim@odoo.com>
Date: Wed, 16 Jan 2019 14:39:23 +0000
Subject: [PATCH 5/8] [FIX] product: unwanted attribute values in name

- Create the following attributes with values:
  Size: S, M, L, XL
  Color: Black, White
- Create a product template with the following attribute values:
  Size: S, M, L, XL
  Color: Black

The `name_get` of `product.product` returns `Name (SIZE, Black)` while
it should only return `Name (SIZE)`.

When using `attribute_id.value_ids`, the list of values contains all
possible values of the attribute, not only the values which apply to the
given product. In this case, it contains 'Black' and 'White', therefore
the condition `> 1` is verified and the attribute is kept for display.

We go back to the original filtering, and add `attribute_line_ids` in
the list fields read in order to avoid prefetching.

opw-1922140
opw-1922447

closes odoo/odoo#30273
---
 addons/product/models/product.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/addons/product/models/product.py b/addons/product/models/product.py
index 258f27d1ade..ecf48deeb33 100644
--- a/addons/product/models/product.py
+++ b/addons/product/models/product.py
@@ -398,7 +398,7 @@ class ProductProduct(models.Model):
 
         # Prefetch the fields used by the `name_get`, so `browse` doesn't fetch other fields
         # Use `load=False` to not call `name_get` for the `product_tmpl_id`
-        self.sudo().read(['name', 'default_code', 'product_tmpl_id', 'attribute_value_ids'], load=False)
+        self.sudo().read(['name', 'default_code', 'product_tmpl_id', 'attribute_value_ids', 'attribute_line_ids'], load=False)
 
         product_template_ids = self.sudo().mapped('product_tmpl_id').ids
 
@@ -415,7 +415,7 @@ class ProductProduct(models.Model):
                 supplier_info_by_template.setdefault(r.product_tmpl_id, []).append(r)
         for product in self.sudo():
             # display only the attributes with multiple possible values on the template
-            variable_attributes = product.attribute_value_ids.filtered(lambda v: len(v.attribute_id.value_ids) > 1).mapped('attribute_id')
+            variable_attributes = product.attribute_line_ids.filtered(lambda l: len(l.value_ids) > 1).mapped('attribute_id')
             variant = product.attribute_value_ids._variant_name(variable_attributes)
 
             name = variant and "%s (%s)" % (product.name, variant) or product.name

From 357b374a7e1be3ab8e3778aeb962bd396fe6f419 Mon Sep 17 00:00:00 2001
From: "Julien (juc) Castiaux" <juc@odoo.com>
Date: Mon, 14 Jan 2019 15:26:29 +0000
Subject: [PATCH 6/8] [FIX] mail: URL with semi-colon

When posting a URL containing a semicolon, odoo stops the link
before the semicolon instead of continuing the link to the end
although it is a valid characters in URL (see RFC-3986)

e.g. the url "example.com&foo;bar" matches "example.com&foo"
     instead of the whole link

opw-1918367

closes odoo/odoo#30198
---
 addons/mail/static/src/js/utils.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/addons/mail/static/src/js/utils.js b/addons/mail/static/src/js/utils.js
index b4e0c01a23a..a735d261d93 100644
--- a/addons/mail/static/src/js/utils.js
+++ b/addons/mail/static/src/js/utils.js
@@ -61,7 +61,7 @@ function _parse_and_transform(nodes, transform_function) {
 
 // Suggested URL Javascript regex of http://stackoverflow.com/questions/3809401/what-is-a-good-regular-expression-to-match-a-url
 // Adapted to make http(s):// not required if (and only if) www. is given. So `should.notmatch` does not match.
-var url_regexp = /\b(?:https?:\/\/|(www\.))[-a-zA-Z0-9@:%._\+~#=]{2,256}\.[a-z]{2,13}\b([-a-zA-Z0-9@:%_\+.~#?&//=]*)/gi;
+var url_regexp = /\b(?:https?:\/\/|(www\.))[-a-zA-Z0-9@:%._\+~#=]{2,256}\.[a-z]{2,13}\b([-a-zA-Z0-9@:%_\+.~#?&//=;]*)/gi;
 function linkify(text, attrs) {
     attrs = attrs || {};
     if (attrs.target === undefined) {

From ba39efdfc69ceaa74ea66a3d4c7fcae046cb9d19 Mon Sep 17 00:00:00 2001
From: "Lucas Perais (lpe)" <lpe@odoo.com>
Date: Thu, 17 Jan 2019 09:59:23 +0000
Subject: [PATCH 7/8] [FIX] base: merge contacts linked to by an o2m field with
 caps

Define a field on a model as:
- o2m to res.partner
- the field's column, hence its name, has capital letters in it
(studio does that)

create two objects of that class, each one linked to a different partner with the new o2m

merge the partners

Before this commit, the object linked to the second partner, was deleted
This was because merge partner sql requests did not quote the column name

After this commit, the second object still exists

This commit is tested in v12.0 with PR #30300 only. In v10.0 it is not testable as
the model concerned is in CRM, and that no new fields in business modules can be added in stable

OPW 1925060

closes odoo/odoo#30301
---
 addons/crm/wizard/base_partner_merge.py | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/addons/crm/wizard/base_partner_merge.py b/addons/crm/wizard/base_partner_merge.py
index b6044efc990..82e980ba48c 100644
--- a/addons/crm/wizard/base_partner_merge.py
+++ b/addons/crm/wizard/base_partner_merge.py
@@ -163,14 +163,14 @@ class MergePartnerAutomatic(models.TransientModel):
                 # unique key treated
                 query = """
                     UPDATE "%(table)s" as ___tu
-                    SET %(column)s = %%s
+                    SET "%(column)s" = %%s
                     WHERE
-                        %(column)s = %%s AND
+                        "%(column)s" = %%s AND
                         NOT EXISTS (
                             SELECT 1
                             FROM "%(table)s" as ___tw
                             WHERE
-                                %(column)s = %%s AND
+                                "%(column)s" = %%s AND
                                 ___tu.%(value)s = ___tw.%(value)s
                         )""" % query_dic
                 for partner in src_partners:
@@ -178,7 +178,7 @@ class MergePartnerAutomatic(models.TransientModel):
             else:
                 try:
                     with mute_logger('odoo.sql_db'), self._cr.savepoint():
-                        query = 'UPDATE "%(table)s" SET %(column)s = %%s WHERE %(column)s IN %%s' % query_dic
+                        query = 'UPDATE "%(table)s" SET "%(column)s" = %%s WHERE "%(column)s" IN %%s' % query_dic
                         self._cr.execute(query, (dst_partner.id, tuple(src_partners.ids),))
 
                         # handle the recursivity with parent relation

From 50bae1c0c591b043ae995cafff905bffdc6f56f1 Mon Sep 17 00:00:00 2001
From: wan <wan@odoo.com>
Date: Fri, 4 Jan 2019 12:31:13 +0000
Subject: [PATCH 8/8] [FIX] account: journal dashboard graph wrong value

OPW 1918926

Current behavior:
  The sql query groups by date,id in a intermediary table instead of the result. This allows to get data in the wrong order if the statements were not produced sequentially. The fill values are computed in the wrong order and may override correct values.

Desired behavior:
  There is no override of the values correctly computed.

closes odoo/odoo#29936
---
 addons/account/models/account_journal_dashboard.py | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/addons/account/models/account_journal_dashboard.py b/addons/account/models/account_journal_dashboard.py
index bae1dee416c..31a85def5fd 100644
--- a/addons/account/models/account_journal_dashboard.py
+++ b/addons/account/models/account_journal_dashboard.py
@@ -46,9 +46,9 @@ class account_journal(models.Model):
                                 WHERE c.journal_id = %s 
                                     AND c.date > %s 
                                     AND c.date <= %s 
-                                    GROUP BY date, id 
-                                    ORDER BY date, id) AS b 
-                        WHERE a.id = b.stmt_id;"""
+                                    GROUP BY date) AS b
+                        WHERE a.id = b.stmt_id
+                        ORDER BY date;"""
 
         self.env.cr.execute(query, (self.id, last_month, today))
         bank_stmt = self.env.cr.dictfetchall()