From 941ddaee749aedb9ebe7401ce434b8316e07ae6f Mon Sep 17 00:00:00 2001
From: chirag <chv@odoo.com>
Date: Tue, 13 Mar 2018 17:33:18 +0530
Subject: [PATCH 01/34] [FIX] purchase: pickings stat button visibility

When you create a purchase order for a product of service type, the
picking stat button is displayed but there's no linked pickings. When
clicking on the stat button, all pickings were displayed, which is
wrong.

Issue:#9181
Task:#1817421
---
 addons/purchase/purchase_view.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/addons/purchase/purchase_view.xml b/addons/purchase/purchase_view.xml
index 254985748d2..27465fffb1f 100644
--- a/addons/purchase/purchase_view.xml
+++ b/addons/purchase/purchase_view.xml
@@ -158,7 +158,7 @@
                         <button type="object"
                             name="action_view_picking"
                             class="oe_stat_button"
-                            icon="fa-truck">
+                            icon="fa-truck" attrs="{'invisible':[('picking_count','=', 0)]}">
                             <field name="picking_count" widget="statinfo" string="Shipment" help="Incoming Shipments"/>
                         </button>
                         <button type="object"  name="action_view_invoice"

From cb6e3b9b765d0c1fd82594e4b8f9e2fcc9688415 Mon Sep 17 00:00:00 2001
From: Toufik Benjaa <tbe@odoo.com>
Date: Mon, 16 Apr 2018 18:52:31 +0200
Subject: [PATCH 02/34] [FIX] account_payment: make partner_type required only
 when draft

As for commit 3f975f97693dfe046dba0d88aaf2bbf2bafa62b6, the partner_type field is readonly and cannot be modified when not in draft.
It makes the form invalid, so form buttons cannot be used, e.g. to access the journal items, etc.
---
 addons/account/views/account_payment_view.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/addons/account/views/account_payment_view.xml b/addons/account/views/account_payment_view.xml
index 9528a20787a..23e7d52cfcb 100644
--- a/addons/account/views/account_payment_view.xml
+++ b/addons/account/views/account_payment_view.xml
@@ -144,7 +144,7 @@
                         <group>
                             <group>
                                 <field name="payment_type" widget="radio" attrs="{'readonly': [('state', '!=', 'draft')]}"/>
-                                <field name="partner_type" widget="selection" attrs="{'required': [('payment_type', 'in', ('inbound', 'outbound'))], 'invisible': [('payment_type', 'not in', ('inbound', 'outbound'))], 'readonly': [('state', '!=', 'draft')]}"/>
+                                <field name="partner_type" widget="selection" attrs="{'required': [('state', '=', 'draft'), ('payment_type', 'in', ('inbound', 'outbound'))], 'invisible': [('payment_type', 'not in', ('inbound', 'outbound'))], 'readonly': [('state', '!=', 'draft')]}"/>
                                 <field name="partner_id" attrs="{'required': [('state', '=', 'draft'), ('payment_type', 'in', ('inbound', 'outbound'))], 'invisible': [('payment_type', 'not in', ('inbound', 'outbound'))], 'readonly': [('state', '!=', 'draft')]}" context="{'default_is_company': True, 'default_supplier': payment_type == 'outbound', 'default_customer': payment_type == 'inbound'}"/>
                                 <label for="amount"/>
                                 <div name="amount_div" class="o_row">

From 58c45bdf4d50f18054e25e909147dcb17289c303 Mon Sep 17 00:00:00 2001
From: Olivier Dony <odo@odoo.com>
Date: Tue, 17 Apr 2018 02:34:49 +0200
Subject: [PATCH 03/34] [IMP] doc: setup/deploy: add security recommendations

Extra recommendations about remote SSH access and demo data on
internet-facing servers, in light of issue #24120.
---
 doc/setup/deploy.rst | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/doc/setup/deploy.rst b/doc/setup/deploy.rst
index 5aea431caf4..13d4198cceb 100644
--- a/doc/setup/deploy.rst
+++ b/doc/setup/deploy.rst
@@ -442,6 +442,10 @@ security-related topics:
   only for controlling/managing the installation.
   *Never* use any default passwords like admin/admin, even for test/staging databases.
 
+- Do **not** install demo data on internet-facing servers. Databases with demo data contain
+  default logins and passwords that can be used to get into your systems and cause significant
+  trouble, even on staging/dev systems.
+
 - Use appropriate database filters ( :option:`--db-filter <odoo-bin --db-filter>`)
   to restrict the visibility of your databases according to the hostname.
   See :ref:`db_filter`.
@@ -474,6 +478,12 @@ security-related topics:
   and then enable the :option:`proxy mode <odoo-bin --proxy-mode>` option.
   See also :ref:`https_proxy`.
 
+- If you need to allow remote SSH access to your servers, make sure to set a strong password
+  for **all** accounts, not just `root`. It is strongly recommended to entirely disable
+  password-based authentication, and only allow public key authentication. Also consider
+  restricting access via a VPN, allowing only trusted IPs in the firewall, and/or
+  running a brute-force detection system such as `fail2ban` or equivalent.
+
 - Whenever possible, host your public-facing demo/test/staging instances on different
   machines than the production ones. And apply the same security precautions as for
   production.

From 57808c44827852d40bbfc8cb0eb2c0d35b210d12 Mon Sep 17 00:00:00 2001
From: "Edilianny Sanchez - https://www.vauxoo.com/" <esanchez@vauxoo.com>
Date: Tue, 17 Apr 2018 02:56:19 -0400
Subject: [PATCH 04/34] [CLA] add edy1192 to Vauxoo's CCLA

Closes #24264
---
 doc/cla/corporate/vauxoo.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/cla/corporate/vauxoo.md b/doc/cla/corporate/vauxoo.md
index 8606676069d..016a2995e33 100644
--- a/doc/cla/corporate/vauxoo.md
+++ b/doc/cla/corporate/vauxoo.md
@@ -38,3 +38,4 @@ Jesus Zapata jesus@vauxoo.com https://github.com/JesusZapata
 Germana Oliveira germana@vauxoo.com https://github.com/goliveirab
 Mariano Fernandez mariano@vauxoo.com https://github.com/Batuto
 Edgar Rivero edgar@vauxoo.com https://github.com/egrivero
+Edilianny Sánchez esanchez@vauxoo.com https://github.com/edy1192

From 48515d3c2e62d0a532e0c9a28ededbe6e1c6a1ea Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?G=C3=A9ry=20Debongnie?= <ged@odoo.com>
Date: Mon, 16 Apr 2018 16:22:47 +0200
Subject: [PATCH 05/34] [FIX] web: fix issue with initial action in web client

Here is a scenario that could happen before this commit:
1. web client is started
2. it binds a callback on hashchange
3. it performs some async work (read initial action for user)
4. the user (or more likely, a tour) changes the url
5. the hashchange handler is called, and it starts a new action
6. the async work for the web client is over, it then executes the
default action and/or clicks on the first menu
7. we are now in the default action state, instead of the desired action
state (the one from the new url)

With this fix, we simply do nothing when there was an hashchange before
the initial action was done.
---
 addons/web/static/src/js/chrome/web_client.js | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/addons/web/static/src/js/chrome/web_client.js b/addons/web/static/src/js/chrome/web_client.js
index dbdaedfddf2..9b71db30b6f 100644
--- a/addons/web/static/src/js/chrome/web_client.js
+++ b/addons/web/static/src/js/chrome/web_client.js
@@ -93,6 +93,10 @@ return AbstractWebClient.extend({
     bind_hashchange: function() {
         var self = this;
         $(window).bind('hashchange', this.on_hashchange);
+        var didHashChanged = false;
+        $(window).one('hashchange', function () {
+            didHashChanged = true;
+        });
 
         var state = $.bbq.getState(true);
         if (_.isEmpty(state) || state.action === "login") {
@@ -103,6 +107,9 @@ return AbstractWebClient.extend({
                         args: [[session.uid], ['action_id']],
                     })
                     .done(function(result) {
+                        if (didHashChanged) {
+                            return;
+                        }
                         var data = result[0];
                         if(data.action_id) {
                             self.action_manager.do_action(data.action_id[0]);

From 866b48a267d9af31da877fb3b67ab1da1c8cfe70 Mon Sep 17 00:00:00 2001
From: Nicolas Martinelli <nim@odoo.com>
Date: Mon, 16 Apr 2018 13:19:32 +0200
Subject: [PATCH 06/34] [FIX] mass_mailing: sanitize test email

When sending the test email of a mass mailing campaign, it might be
observed that the result is different from the final email sent to
customers.

This is because the `body` field of the final mail message is an `Html`
field with options `sanitize_style=True` and `strip_classes=True`. On
the other hand, the `body_html` field the test mail is a simple `Text`
field which is not sanitized.

We sanitize the `body_html` field with similar options.

opw-1820064
---
 addons/mass_mailing/wizard/test_mailing.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/addons/mass_mailing/wizard/test_mailing.py b/addons/mass_mailing/wizard/test_mailing.py
index 130827e1fe4..601e5ac62e5 100644
--- a/addons/mass_mailing/wizard/test_mailing.py
+++ b/addons/mass_mailing/wizard/test_mailing.py
@@ -26,7 +26,7 @@ class TestMassMailing(models.TransientModel):
                 'reply_to': mailing.reply_to,
                 'email_to': test_mail,
                 'subject': mailing.name,
-                'body_html': mailing.body_html,
+                'body_html': tools.html_sanitize(mailing.body_html, sanitize_attributes=True, sanitize_style=True, strip_classes=True),
                 'notification': True,
                 'mailing_id': mailing.id,
                 'attachment_ids': [(4, attachment.id) for attachment in mailing.attachment_ids],

From 3310d842f68674d3bd048595ef177adf24b33ea1 Mon Sep 17 00:00:00 2001
From: Wolfgang Taferner <wtaferner@users.noreply.github.com>
Date: Tue, 17 Apr 2018 05:04:00 +0200
Subject: [PATCH 07/34] [FIX] sale: wrong key was communicating wrong
 references

---
 addons/sale/models/sale.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/addons/sale/models/sale.py b/addons/sale/models/sale.py
index c53a777a7c7..4858afdaa19 100644
--- a/addons/sale/models/sale.py
+++ b/addons/sale/models/sale.py
@@ -424,7 +424,7 @@ class SaleOrder(models.Model):
 
             if references.get(invoices.get(group_key)):
                 if order not in references[invoices[group_key]]:
-                    references[invoice] = references[invoice] | order
+                    references[invoices[group_key]] |= order
 
         if not invoices:
             raise UserError(_('There is no invoiceable line.'))

From b26ad79a8c3f02726ed3f22f73faf49a2a272d1d Mon Sep 17 00:00:00 2001
From: Christophe Matthieu <chm@odoo.com>
Date: Tue, 20 Feb 2018 14:07:52 +0100
Subject: [PATCH 08/34] [FIX] web_editor,mail: send email's attachments without
 write access

Before this fix, when a user don't have write access on a document, he
can't send an email with attachment because, the attachments is added on
the document.

The change improving security was introduced by the commit:
https://github.com/odoo/odoo/commit/6494f511718893eec3573c60c0a62e04d386359d

With this fix, for mail, the attachments is added on the
'mail.compose.message' and re-render the fields attachments displayed in
the current view. This change respect the access rules like all others
attachment of 'mail.compose.message' (can send an email when the user have
read access on the document).
The media dialog of the html widget display all documents attachments and
the added attachments Allowing users to use these in the body of their
message.
---
 addons/web_editor/controllers/main.py         |  4 +-
 .../static/src/js/backend/fields.js           | 84 ++++++++++++++++++-
 .../static/src/js/editor/rte.summernote.js    | 12 +++
 .../static/src/js/widgets/widgets.js          | 15 +++-
 4 files changed, 109 insertions(+), 6 deletions(-)

diff --git a/addons/web_editor/controllers/main.py b/addons/web_editor/controllers/main.py
index 502d2190d5b..91b698bf03a 100644
--- a/addons/web_editor/controllers/main.py
+++ b/addons/web_editor/controllers/main.py
@@ -160,7 +160,7 @@ class Web_Editor(http.Controller):
                 'name': name,
                 'type': 'url',
                 'url': url,
-                'public': True,
+                'public': res_model == 'ir.ui.view',
                 'res_id': res_id,
                 'res_model': res_model,
             })
@@ -187,7 +187,7 @@ class Web_Editor(http.Controller):
                         'name': c_file.filename,
                         'datas': base64.b64encode(data),
                         'datas_fname': c_file.filename,
-                        'public': True,
+                        'public': res_model == 'ir.ui.view',
                         'res_id': res_id,
                         'res_model': res_model,
                     })
diff --git a/addons/web_editor/static/src/js/backend/fields.js b/addons/web_editor/static/src/js/backend/fields.js
index d3d601bac73..d874771f939 100644
--- a/addons/web_editor/static/src/js/backend/fields.js
+++ b/addons/web_editor/static/src/js/backend/fields.js
@@ -83,12 +83,50 @@ var FieldTextHtmlSimple = basic_fields.DebouncedField.extend(TranslatableFieldMi
     // Private
     //--------------------------------------------------------------------------
 
+    /**
+     * Returns the domain for attachments used in media dialog.
+     * We look for attachments related to the current document. If there is a value for the model
+     * field, it is used to search attachments, and the attachments from the current document are
+     * filtered to display only user-created documents.
+     * In the case of a wizard such as mail, we have the documents uploaded and those of the model
+     *
+     * @private
+     * @returns {Array} "ir.attachment" odoo domain.
+     */
+    _getAttachmentsDomain: function () {
+        var domain = ['|', ['id', 'in', _.pluck(this.attachments, 'id')]];
+        var attachedDocumentDomain = [
+            '&',
+            ['res_model', '=', this.model],
+            ['res_id', '=', this.res_id|0]
+        ];
+        // if the document is not yet created, do not see the documents of other users
+        if (!this.res_id) {
+            attachedDocumentDomain.unshift('&');
+            attachedDocumentDomain.push(['create_uid', '=', session.uid]);
+        }
+        if (this.recordData.model) {
+            var relatedDomain = ['&',
+                ['res_model', '=', this.recordData.model],
+                ['res_id', '=', this.recordData.res_id|0]];
+            if (!this.recordData.res_id) {
+                relatedDomain.unshift('&');
+                relatedDomain.push(['create_uid', '=', session.uid]);
+            }
+            domain = domain.concat(['|'], attachedDocumentDomain, relatedDomain);
+        } else {
+            domain = domain.concat(attachedDocumentDomain);
+        }
+        return domain;
+    },
     /**
      * @private
      * @returns {Object} the summernote configuration
      */
     _getSummernoteConfig: function () {
         var summernoteConfig = {
+            model: this.model,
+            id: this.res_id,
             focus: false,
             height: 180,
             toolbar: [
@@ -107,6 +145,22 @@ var FieldTextHtmlSimple = basic_fields.DebouncedField.extend(TranslatableFieldMi
             lang: "odoo",
             onChange: this._doDebouncedAction.bind(this),
         };
+
+        var fieldNameAttachment =_.chain(this.recordData)
+            .pairs()
+            .find(function (value) {
+                return _.isObject(value[1]) && value[1].model === "ir.attachment";
+            })
+            .first()
+            .value();
+
+        if (fieldNameAttachment) {
+            this.fieldNameAttachment = fieldNameAttachment;
+            this.attachments = [];
+            summernoteConfig.onImageUpload = this._onImageUpload.bind(this);
+            summernoteConfig.getMediaDomain = this._getAttachmentsDomain.bind(this);
+        }
+
         if (config.debug) {
             summernoteConfig.toolbar.splice(7, 0, ['view', ['codeview']]);
         }
@@ -124,6 +178,34 @@ var FieldTextHtmlSimple = basic_fields.DebouncedField.extend(TranslatableFieldMi
         }
         return this.$content.html();
     },
+    /**
+     * trigger_up 'field_changed' add record into the "ir.attachment" field found in the view.
+     * This method is called when an image is uploaded by the media dialog.
+     *
+     * For e.g. when sending email, this allows people to add attachments with the content
+     * editor interface and that they appear in the attachment list.
+     * The new documents being attached to the email, they will not be erased by the CRON
+     * when closing the wizard.
+     *
+     * @private
+     */
+    _onImageUpload: function (attachments) {
+        var self = this;
+        attachments = _.filter(attachments, function (attachment) {
+            return !_.findWhere(self.attachments, {id: attachment.id});
+        });
+        if (!attachments.length) {
+            return;
+        }
+        this.attachments = this.attachments.concat(attachments);
+        this.trigger_up('field_changed', {
+            dataPointID: this.dataPointID,
+            changes: _.object([this.fieldNameAttachment], [{
+                operation: 'ADD_M2M',
+                ids: attachments
+            }])
+        });
+    },
     /**
      * @override
      * @private
@@ -134,8 +216,6 @@ var FieldTextHtmlSimple = basic_fields.DebouncedField.extend(TranslatableFieldMi
         this.$textarea.summernote(this._getSummernoteConfig());
         this.$content = this.$('.note-editable:first');
         this.$content.html(this._textToHtml(this.value));
-        this.$content.data('oe-id', this.recordData.res_id || this.res_id);
-        this.$content.data('oe-model', this.recordData.model || this.model);
         // trigger a mouseup to refresh the editor toolbar
         this.$content.trigger('mouseup');
         if (this.nodeOptions['style-inline']) {
diff --git a/addons/web_editor/static/src/js/editor/rte.summernote.js b/addons/web_editor/static/src/js/editor/rte.summernote.js
index 71982f8137b..9a2d04eeca5 100644
--- a/addons/web_editor/static/src/js/editor/rte.summernote.js
+++ b/addons/web_editor/static/src/js/editor/rte.summernote.js
@@ -394,6 +394,9 @@ eventHandler.modules.imageDialog.showImageDialog = function ($editable) {
     core.bus.trigger('media_dialog_demand', {
         $editable: $editable,
         media: media,
+        options : {
+            onUpload: $editable.data('callbacks').onImageUpload,
+        },
     });
     return new $.Deferred().reject();
 };
@@ -784,6 +787,14 @@ eventHandler.attach = function (oLayoutInfo, options) {
     $(document).on("keyup", reRangeSelectKey);
 
     var clone_data = false;
+
+    if (options.model) {
+        oLayoutInfo.editable().data({'oe-model': options.model, 'oe-id': options.id});
+    }
+    if (options.getMediaDomain) {
+        oLayoutInfo.editable().data('oe-media-domain', options.getMediaDomain);
+    }
+
     var $node = oLayoutInfo.editor();
     if ($node.data('oe-model') || $node.data('oe-translation-id')) {
         $node.on('content_changed', function () {
@@ -1085,6 +1096,7 @@ var SummernoteManager = Class.extend(mixins.EventDispatcherMixin, {
             _.extend({
                 res_model: data.$editable.data('oe-model'),
                 res_id: data.$editable.data('oe-id'),
+                domain: data.$editable.data('oe-media-domain'),
             }, data.options),
             data.$editable,
             data.media
diff --git a/addons/web_editor/static/src/js/widgets/widgets.js b/addons/web_editor/static/src/js/widgets/widgets.js
index 371f35a99de..7854c1852c6 100644
--- a/addons/web_editor/static/src/js/widgets/widgets.js
+++ b/addons/web_editor/static/src/js/widgets/widgets.js
@@ -122,9 +122,11 @@ var ImageDialog = Widget.extend({
         this._super.apply(this, arguments);
         this.options = options || {};
         this.accept = this.options.accept || this.options.document ? "*/*" : "image/*";
-        if (this.options.res_id) {
+        if (options.domain) {
+            this.domain = typeof options.domain === 'function' ? options.domain() : options.domain;
+        } else if (options.res_id) {
             this.domain = ['|',
-                '&', ['res_model', '=', this.options.res_model], ['res_id', '=', this.options.res_id],
+                '&', ['res_model', '=', options.res_model], ['res_id', '=', options.res_id],
                 ['res_model', '=', 'ir.ui.view']];
         } else {
             this.domain = [['res_model', '=', 'ir.ui.view']];
@@ -239,6 +241,11 @@ var ImageDialog = Widget.extend({
             var style = self.style;
             if (style) { $(self.media).css(style); }
 
+            if (self.options.onUpload) {
+                // We consider that when selecting an image it is as if we upload it in the html content.
+                self.options.onUpload([img]);
+            }
+
             return self.media;
         });
     },
@@ -290,6 +297,10 @@ var ImageDialog = Widget.extend({
             for (var i=0; i<attachments.length; i++) {
                 self.file_selected(attachments[i], error);
             }
+
+            if (self.options.onUpload) {
+                self.options.onUpload(attachments);
+            }
         };
     },
     file_selection: function () {

From 8456f425bc6994c3ef342f075bd59d9a4262b980 Mon Sep 17 00:00:00 2001
From: Nicolas Martinelli <nim@odoo.com>
Date: Tue, 17 Apr 2018 10:08:34 +0200
Subject: [PATCH 09/34] [FIX] stock: company on Procurement Rules

Add the `company_id` field on the `procurement.rule` form view, and set
the default value to be the company of the `stock.location.route`.

opw-1824570
---
 addons/stock/views/procurement_views.xml    | 1 +
 addons/stock/views/stock_location_views.xml | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/addons/stock/views/procurement_views.xml b/addons/stock/views/procurement_views.xml
index e7f846a69b8..b22a7ff849d 100644
--- a/addons/stock/views/procurement_views.xml
+++ b/addons/stock/views/procurement_views.xml
@@ -78,6 +78,7 @@
                         <group string="Applied On">
                             <field name="location_id"/>
                             <field name="warehouse_id" groups="base.group_no_one"/>
+                            <field name="company_id" options="{'no_create': True}" groups="base.group_multi_company"/>
                         </group>
                         <group string="Creates">
                             <field name="location_src_id" attrs="{'required': [('action', '=', 'move')], 'invisible':[('action', '!=', 'move')]}"  domain="[('usage','!=','view')]"/>
diff --git a/addons/stock/views/stock_location_views.xml b/addons/stock/views/stock_location_views.xml
index 89fc9e1b818..4f3cf4998ad 100644
--- a/addons/stock/views/stock_location_views.xml
+++ b/addons/stock/views/stock_location_views.xml
@@ -272,7 +272,7 @@
                         <field name="push_ids" colspan="4" nolabel="1"/>
                     </group>
                     <group string="Procurement Rules" colspan="4" >
-                        <field name="pull_ids" colspan="4" nolabel="1"/>
+                        <field name="pull_ids" colspan="4" nolabel="1" context="{'default_company_id': company_id}"/>
                     </group>
                     </sheet>
                 </form>

From ec02710b86a80f448ff6732f62b1973d2b18d829 Mon Sep 17 00:00:00 2001
From: len-odoo <len@odoo.com>
Date: Mon, 16 Apr 2018 15:00:31 +0200
Subject: [PATCH 10/34] [FIX]mrp: Byproducts are produced twice

When producing a byproduct in a BoM, the quantity for the byproduct was
increased by twice its produced quantity.

This is essentially a revert of commit d7fdb636b81a99519d1e186edaf42d36ecee3b5f
which was erroneously forward-ported to 11.0,
where byproducts were already correctly counted.

opw:1834226
---
 addons/mrp/models/mrp_workorder.py | 39 ++++++++++++++----------------
 1 file changed, 18 insertions(+), 21 deletions(-)

diff --git a/addons/mrp/models/mrp_workorder.py b/addons/mrp/models/mrp_workorder.py
index f4aaa390192..f7db1a6e8c3 100644
--- a/addons/mrp/models/mrp_workorder.py
+++ b/addons/mrp/models/mrp_workorder.py
@@ -339,28 +339,25 @@ class MrpWorkorder(models.Model):
         # If last work order, then post lots used
         # TODO: should be same as checking if for every workorder something has been done?
         if not self.next_work_order_id:
-            production_moves = self.production_id.move_finished_ids.filtered(lambda x: (x.state not in ('done', 'cancel')))
-            for production_move in production_moves:
-                if production_move.product_id.id == self.production_id.product_id.id and production_move.has_tracking != 'none':
-                    move_line = production_move.move_line_ids.filtered(lambda x: x.lot_id.id == self.final_lot_id.id)
-                    if move_line:
-                        move_line.product_uom_qty += self.qty_producing
-                    else:
-                        move_line.create({'move_id': production_move.id,
-                                 'product_id': production_move.product_id.id,
-                                 'lot_id': self.final_lot_id.id,
-                                 'product_uom_qty': self.qty_producing,
-                                 'product_uom_id': production_move.product_uom.id,
-                                 'qty_done': self.qty_producing,
-                                 'workorder_id': self.id,
-                                 'location_id': production_move.location_id.id, 
-                                 'location_dest_id': production_move.location_dest_id.id,
-                        })
-                elif production_move.unit_factor:
-                    rounding = production_move.product_uom.rounding
-                    production_move.quantity_done += float_round(self.qty_producing * production_move.unit_factor, precision_rounding=rounding)
+            production_move = self.production_id.move_finished_ids.filtered(
+                                lambda x: (x.product_id.id == self.production_id.product_id.id) and (x.state not in ('done', 'cancel')))
+            if production_move.product_id.tracking != 'none':
+                move_line = production_move.move_line_ids.filtered(lambda x: x.lot_id.id == self.final_lot_id.id)
+                if move_line:
+                    move_line.product_uom_qty += self.qty_producing
                 else:
-                    production_move.quantity_done += self.qty_producing
+                    move_line.create({'move_id': production_move.id,
+                             'product_id': production_move.product_id.id,
+                             'lot_id': self.final_lot_id.id,
+                             'product_uom_qty': self.qty_producing,
+                             'product_uom_id': production_move.product_uom.id,
+                             'qty_done': self.qty_producing,
+                             'workorder_id': self.id,
+                             'location_id': production_move.location_id.id,
+                             'location_dest_id': production_move.location_dest_id.id,
+                    })
+            else:
+                production_move.quantity_done += self.qty_producing
 
         if not self.next_work_order_id:
             for by_product_move in self.production_id.move_finished_ids.filtered(lambda x: (x.product_id.id != self.production_id.product_id.id) and (x.state not in ('done', 'cancel'))):

From 1777646d1ecd1325d4bfc5bdac5598efda8003f5 Mon Sep 17 00:00:00 2001
From: len-odoo <len@odoo.com>
Date: Tue, 17 Apr 2018 11:03:09 +0200
Subject: [PATCH 11/34] [FIX]mail: fix help command in livechat with unlogged
 user

When an unlogged user creates a livechat, typing the /help command in the
backend would result in the help command sending a traceback.
The function processing the command would assume the existence of a channel
partner name, which is not the case when the user starting the chat is unlogged.

opw:1835484
---
 addons/mail/models/mail_channel.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/addons/mail/models/mail_channel.py b/addons/mail/models/mail_channel.py
index fb33fbf1323..8be0884b346 100644
--- a/addons/mail/models/mail_channel.py
+++ b/addons/mail/models/mail_channel.py
@@ -648,7 +648,7 @@ class Channel(models.Model):
                 msg += _(" This channel is private. People must be invited to join it.")
         else:
             channel_partners = self.env['mail.channel.partner'].search([('partner_id', '!=', partner.id), ('channel_id', '=', self.id)])
-            msg = _("You are in a private conversation with <b>@%s</b>.") % channel_partners[0].partner_id.name
+            msg = _("You are in a private conversation with <b>@%s</b>.") % (channel_partners[0].partner_id.name if channel_partners else _('Anonymous'))
         msg += _("""<br><br>
             You can mention someone by typing <b>@username</b>, this will grab its attention.<br>
             You can mention a channel by typing <b>#channel</b>.<br>

From b5d026be7f68f092fdded58429097f02d3fc44ae Mon Sep 17 00:00:00 2001
From: Yannick Tivisse <yti@odoo.com>
Date: Tue, 17 Apr 2018 13:26:54 +0200
Subject: [PATCH 12/34] [FIX] l10n_be_hr_payroll_fleet: Don't display costs in
 model name

This is confusing for end users because on the fleet form/kanban view the
model is displayed. The information displayed in the name is the default
depreciated cost on the model. But in reality the depreciated cost of the
car could be different.
---
 addons/l10n_be_hr_payroll_fleet/models/fleet.py | 13 -------------
 1 file changed, 13 deletions(-)

diff --git a/addons/l10n_be_hr_payroll_fleet/models/fleet.py b/addons/l10n_be_hr_payroll_fleet/models/fleet.py
index 36812db24b5..d7bf8c3decb 100644
--- a/addons/l10n_be_hr_payroll_fleet/models/fleet.py
+++ b/addons/l10n_be_hr_payroll_fleet/models/fleet.py
@@ -139,19 +139,6 @@ class FleetVehicleModel(models.Model):
         for model in self:
             model.default_total_depreciated_cost = model.co2_fee + model.default_recurring_cost_amount_depreciated
 
-    @api.multi
-    @api.depends('name', 'brand_id', 'default_total_depreciated_cost')
-    def name_get(self):
-        res = super(FleetVehicleModel, self).name_get()
-        new_res = []
-        for res_item in res:
-            model = self.browse(res_item[0])
-            if model.default_total_depreciated_cost != 0.0:
-                new_res.append((res_item[0], res_item[1] + u" \u2022 " + str(round(model.default_total_depreciated_cost, 2))))
-            else:
-                new_res.append(res_item)
-        return new_res
-
     @api.depends('default_co2')
     def _compute_co2_fee(self):
         for model in self:

From 5d13a2f431e1c96e075b04d0eb07d98b912a6547 Mon Sep 17 00:00:00 2001
From: qsm-odoo <qsm@odoo.com>
Date: Tue, 17 Apr 2018 11:22:45 +0200
Subject: [PATCH 13/34] [FIX] web: properly right-align numbers in grouped list
 views' rows

The 'oe_number' class was replaced by 'o_list_number' but this was not
properly done for grouped list views. As a fix, the new class is added
on top of the old one to not break potential customizations.

Proper fix will be done in master.
See https://github.com/odoo/enterprise/commit/a2ce226a2a085b26174cdfd32922517dff39658c

Closes https://github.com/odoo/odoo/pull/23966
---
 addons/web/static/src/js/views/list_view.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/addons/web/static/src/js/views/list_view.js b/addons/web/static/src/js/views/list_view.js
index dddc2b1bcf3..ad07227aec4 100644
--- a/addons/web/static/src/js/views/list_view.js
+++ b/addons/web/static/src/js/views/list_view.js
@@ -1431,7 +1431,7 @@ ListView.Groups = Class.extend({
                     } else if (column.id in group.aggregates) {
                         var r = {};
                         r[column.id] = {value: group.aggregates[column.id]};
-                        $('<td class="oe_number">')
+                        $('<td class="oe_number o_list_number">')
                             .html(column.format(r, {process_modifiers: false}))
                             .appendTo($row);
                     } else {

From df02dc37fd2febd3fc899792ee25c80c0149d255 Mon Sep 17 00:00:00 2001
From: "Lucas Perais (lpe)" <lpe@odoo.com>
Date: Fri, 13 Apr 2018 10:49:35 +0200
Subject: [PATCH 14/34] [FIX] web: pivot: correctly save and restore groupbys
 on rows and cols

On a pivot view expand a field in column
another one in row
Then put a domain in the search view
Save the whole thing (ir.filter) as favorite

Before this commit, the ir.filter was not saved the right way when a domain was present
(Let alone its restoration)
This was because of
- the internal default groupbys of the pivot model was not updated, and what we got in the params was overwritten
by what existed before
- a slight typo in the code made the row updated with the col values

OPW 1835865
OPW 1829925

closes #24215
---
 .../static/src/js/views/pivot/pivot_model.js  |  3 +-
 addons/web/static/tests/views/pivot_tests.js  | 41 +++++++++++++++++++
 2 files changed, 43 insertions(+), 1 deletion(-)

diff --git a/addons/web/static/src/js/views/pivot/pivot_model.js b/addons/web/static/src/js/views/pivot/pivot_model.js
index 1c76c41ab71..6eddd44ffe7 100644
--- a/addons/web/static/src/js/views/pivot/pivot_model.js
+++ b/addons/web/static/src/js/views/pivot/pivot_model.js
@@ -250,6 +250,7 @@ var PivotModel = AbstractModel.extend({
             this.data.colGroupBys = params.context.pivot_column_groupby || this.data.colGroupBys;
             this.data.groupedBy = params.context.pivot_row_groupby || this.data.groupedBy;
             this.data.measures = this._processMeasures(params.context.pivot_measures) || this.data.measures;
+            this.defaultGroupedBy = this.data.groupedBy.length ? this.data.groupedBy : this.defaultGroupedBy;
         }
         if ('domain' in params) {
             this.data.domain = params.domain;
@@ -278,7 +279,7 @@ var PivotModel = AbstractModel.extend({
 
             self._updateTree(old_col_root, self.data.main_col.root);
             new_groupby_length = self._getHeaderDepth(self.data.main_col.root) - 1;
-            self.data.main_row.groupbys = old_col_root.groupbys.slice(0, new_groupby_length);
+            self.data.main_row.groupbys = old_row_root.groupbys.slice(0, new_groupby_length);
         });
     },
     /**
diff --git a/addons/web/static/tests/views/pivot_tests.js b/addons/web/static/tests/views/pivot_tests.js
index 3e77d7aa8b9..198fd0189ae 100644
--- a/addons/web/static/tests/views/pivot_tests.js
+++ b/addons/web/static/tests/views/pivot_tests.js
@@ -960,4 +960,45 @@ QUnit.module('Views', {
 
         pivot.destroy();
     });
+
+    QUnit.test('Row and column groupbys plus a domain', function (assert) {
+        assert.expect(3);
+
+        var pivot = createView({
+            View: PivotView,
+            model: "partner",
+            data: this.data,
+            arch: '<pivot>' +
+                        '<field name="foo" type="measure"/>' +
+                '</pivot>',
+        });
+
+        // Set a column groupby
+        pivot.$('thead .o_pivot_header_cell_closed').click();
+        pivot.$('.o_field_selection li[data-field=customer] a').click();
+
+        // Set a Row groupby
+        pivot.$('tbody .o_pivot_header_cell_closed').click();
+        pivot.$('.o_pivot_field_menu li[data-field=product_id] a').click();
+
+        // Set a domain
+        pivot.update({domain: [['product_id', '=', 41]]});
+
+        var expectedContext = {pivot_column_groupby: ['customer'],
+                               pivot_measures: ['foo'],
+                               pivot_row_groupby: ['product_id']};
+
+        // Mock 'save as favorite'
+        assert.deepEqual(pivot.getContext(), expectedContext,
+            'The pivot view should have the right context');
+
+        var $xpadHeader = pivot.$('tbody .o_pivot_header_cell_closed[data-original-title=Product]');
+        assert.equal($xpadHeader.length, 1,
+            'There should be only one product line because of the domain');
+
+        assert.equal($xpadHeader.text(), 'xpad',
+            'The product should be the right one');
+
+        pivot.destroy();
+    });
 });});

From f27e86bdde67048b2e73fbc808743093bda146d3 Mon Sep 17 00:00:00 2001
From: tgroutars <tgroutars@gmail.com>
Date: Tue, 17 Apr 2018 12:11:56 +0200
Subject: [PATCH 15/34] [FIX] base: no crash when setting wrong relation to m2m

Before this rev., in the ir.model.fields form view, it crashed
when the user specified an invalid model name as a relation for
fields of type many2many (the onchange crashed). This rev. displays
a warning instead.

opw 1837401
---
 openerp/addons/base/ir/ir_model.py | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/openerp/addons/base/ir/ir_model.py b/openerp/addons/base/ir/ir_model.py
index cefe5004e2a..8b653701679 100644
--- a/openerp/addons/base/ir/ir_model.py
+++ b/openerp/addons/base/ir/ir_model.py
@@ -376,6 +376,13 @@ class ir_model_fields(osv.osv):
     def _onchange_ttype(self):
         self.copy = (self.ttype != 'one2many')
         if self.ttype == 'many2many' and self.model_id and self.relation:
+            if self.relation not in self.env:
+                return {
+                    'warning': {
+                        'title': _('Model %s does not exist' % self.relation),
+                        'message': _('Please specify a valid model for the object relation'),
+                    }
+                }
             names = self._custom_many2many_names(self.model_id.model, self.relation)
             self.relation_table, self.column1, self.column2 = names
         else:

From 9e6c616130622eabc5a43f84eca80c6326ded20b Mon Sep 17 00:00:00 2001
From: Martin Geubelle <mge@odoo.com>
Date: Wed, 11 Apr 2018 17:19:45 +0200
Subject: [PATCH 16/34] [FIX] web: focus select in reference widget

In the reference widget, the focus was always on the input (many2one) even
though the first select (with the model) was not set.

Thanks to @kaerdsar for the original PR.

Partially closes #24070
---
 .../static/src/js/fields/relational_fields.js | 15 +++++++++++
 .../tests/fields/relational_fields_tests.js   | 26 +++++++++++++++++++
 2 files changed, 41 insertions(+)

diff --git a/addons/web/static/src/js/fields/relational_fields.js b/addons/web/static/src/js/fields/relational_fields.js
index bc44d6b659a..5c670e11c73 100644
--- a/addons/web/static/src/js/fields/relational_fields.js
+++ b/addons/web/static/src/js/fields/relational_fields.js
@@ -2280,6 +2280,21 @@ var FieldReference = FieldMany2One.extend({
         return this._super.apply(this, arguments);
     },
 
+    //--------------------------------------------------------------------------
+    // Public
+    //--------------------------------------------------------------------------
+
+    /**
+     * @override
+     * @returns {jQuery}
+     */
+    getFocusableElement: function () {
+        if (this.mode === 'edit' && !this.field.relation) {
+            return this.$('select');
+        }
+        return this._super.apply(this, arguments);
+    },
+
     //--------------------------------------------------------------------------
     // Private
     //--------------------------------------------------------------------------
diff --git a/addons/web/static/tests/fields/relational_fields_tests.js b/addons/web/static/tests/fields/relational_fields_tests.js
index b855f827c97..b28ddfafb0a 100644
--- a/addons/web/static/tests/fields/relational_fields_tests.js
+++ b/addons/web/static/tests/fields/relational_fields_tests.js
@@ -11298,6 +11298,32 @@ QUnit.module('relational_fields', {
         form.destroy();
     });
 
+    QUnit.test('reference and list navigation', function (assert) {
+        assert.expect(2);
+
+        var list = createView({
+            View: ListView,
+            model: 'partner',
+            data: this.data,
+            arch: '<tree editable="bottom"><field name="reference"/></tree>',
+        });
+
+        // edit first row
+        list.$('.o_data_row .o_data_cell').first().click();
+        assert.strictEqual(list.$('.o_data_row:eq(0) .o_field_widget[name="reference"] input')[0], document.activeElement,
+            'input of first data row should be selected');
+
+        // press TAB to go to next line
+        list.$('.o_data_row:eq(0) input').trigger($.Event('keydown', {
+            which: $.ui.keyCode.TAB,
+            keyCode: $.ui.keyCode.TAB,
+        }));
+        assert.strictEqual(list.$('.o_data_row:eq(1) .o_field_widget[name="reference"] select')[0], document.activeElement,
+            'select of second data row should be selected');
+
+        list.destroy();
+    });
+
     QUnit.test('one2many with extra field from server not in form', function (assert) {
         assert.expect(6);
 

From cd934f307de19b247bf88b9dc41a8fdea15fd23c Mon Sep 17 00:00:00 2001
From: Martin Geubelle <mge@odoo.com>
Date: Tue, 17 Apr 2018 11:46:12 +0200
Subject: [PATCH 17/34] [FIX] web: handle x2m commands with reference as
 default

Before this rev. it was not possible to define a value for a reference field
in x2m commands as default value.

Courtesy of @kaerdsar.

Closes #24070
---
 .../static/src/js/views/basic/basic_model.js  | 13 +++++++-
 .../tests/fields/relational_fields_tests.js   | 32 +++++++++++++++++++
 2 files changed, 44 insertions(+), 1 deletion(-)

diff --git a/addons/web/static/src/js/views/basic/basic_model.js b/addons/web/static/src/js/views/basic/basic_model.js
index 4180acae602..8fdcb305ddc 100644
--- a/addons/web/static/src/js/views/basic/basic_model.js
+++ b/addons/web/static/src/js/views/basic/basic_model.js
@@ -3613,8 +3613,9 @@ var BasicModel = AbstractModel.extend({
                     if (isFieldInView) {
                         var field = r.fields[fieldName];
                         var fieldType = field.type;
+                        var rec;
                         if (fieldType === 'many2one') {
-                            var rec = self._makeDataPoint({
+                            rec = self._makeDataPoint({
                                 context: r.context,
                                 modelName: field.relation,
                                 data: {id: r._changes[fieldName]},
@@ -3622,6 +3623,16 @@ var BasicModel = AbstractModel.extend({
                             });
                             r._changes[fieldName] = rec.id;
                             many2ones[fieldName] = true;
+                        } else if (fieldType === 'reference') {
+                            var reference = r._changes[fieldName].split(',');
+                            rec = self._makeDataPoint({
+                                context: r.context,
+                                modelName: reference[0],
+                                data: {id: parseInt(reference[1])},
+                                parentID: r.id,
+                            });
+                            r._changes[fieldName] = rec.id;
+                            many2ones[fieldName] = true;
                         } else if (_.contains(['one2many', 'many2many'], fieldType)) {
                             var x2mCommands = commands[0][2][fieldName];
                             defs.push(self._processX2ManyCommands(r, fieldName, x2mCommands));
diff --git a/addons/web/static/tests/fields/relational_fields_tests.js b/addons/web/static/tests/fields/relational_fields_tests.js
index b28ddfafb0a..8fb1780489a 100644
--- a/addons/web/static/tests/fields/relational_fields_tests.js
+++ b/addons/web/static/tests/fields/relational_fields_tests.js
@@ -11248,6 +11248,38 @@ QUnit.module('relational_fields', {
         form.destroy();
     });
 
+    QUnit.test('default_get a reference field in a x2m', function (assert) {
+        assert.expect(1);
+
+        this.data.partner.fields.turtles.default = [
+            [0, false, {turtle_ref: 'product,37'}]
+        ];
+
+        var form = createView({
+            View: FormView,
+            model: 'partner',
+            data: this.data,
+            arch: '<form string="Partners">' +
+                    '<sheet>' +
+                        '<field name="turtles">' +
+                            '<tree>' +
+                                '<field name="turtle_ref"/>' +
+                            '</tree>' +
+                        '</field>' +
+                    '</sheet>' +
+                '</form>',
+            viewOptions: {
+                mode: 'edit',
+            },
+            archs: {
+                'turtle,false,form': '<form><field name="display_name"/><field name="turtle_ref"/></form>',
+            },
+        });
+        assert.strictEqual(form.$('.o_field_one2many[name="turtles"] .o_data_row:first').text(), "xphone",
+            "the default value should be correctly handled");
+        form.destroy();
+    });
+
     QUnit.test('widget reference on char field, reset by onchange', function (assert) {
         assert.expect(4);
 

From 74e208eabf950e0502d35f2c0c69bc212fdaed5b Mon Sep 17 00:00:00 2001
From: Aaron Bohy <aab@odoo.com>
Date: Tue, 17 Apr 2018 14:58:52 +0200
Subject: [PATCH 18/34] [FIX] base: export translations for added terms

in commit f27e86b
---
 openerp/addons/base/i18n/base.pot  | 12 ++++++++++++
 openerp/addons/base/ir/ir_model.py |  2 +-
 2 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/openerp/addons/base/i18n/base.pot b/openerp/addons/base/i18n/base.pot
index 2ba555c79bb..64ca4d05ef0 100644
--- a/openerp/addons/base/i18n/base.pot
+++ b/openerp/addons/base/i18n/base.pot
@@ -11464,6 +11464,18 @@ msgstr ""
 msgid "Model"
 msgstr ""
 
+#. module: base
+#: code:addons/base/ir/ir_model.py:382
+#, python-format
+msgid "Model %s does not exist"
+msgstr ""
+
+#. module: base
+#: code:addons/base/ir/ir_model.py:383
+#, python-format
+msgid "Please specify a valid model for the object relation"
+msgstr ""
+
 #. module: base
 #: code:addons/base/ir/ir_model.py:454
 #, python-format
diff --git a/openerp/addons/base/ir/ir_model.py b/openerp/addons/base/ir/ir_model.py
index 8b653701679..cdf29de31c6 100644
--- a/openerp/addons/base/ir/ir_model.py
+++ b/openerp/addons/base/ir/ir_model.py
@@ -379,7 +379,7 @@ class ir_model_fields(osv.osv):
             if self.relation not in self.env:
                 return {
                     'warning': {
-                        'title': _('Model %s does not exist' % self.relation),
+                        'title': _('Model %s does not exist') % self.relation,
                         'message': _('Please specify a valid model for the object relation'),
                     }
                 }

From 91ca846447628084f5a089e986319ef18581ddf2 Mon Sep 17 00:00:00 2001
From: Nicolas Lempereur <nle@odoo.com>
Date: Tue, 17 Apr 2018 16:29:15 +0200
Subject: [PATCH 19/34] [FIX] account_check_printing: write payment not journal

When we make a payment, we need the write access on account.journal
because check_manual_sequencing on account.payment is a related field
of account.journal and was used to decide on numbering the check or not.

With this change, the write access is not required.

opw-1834343
opw-1835888
closes #24281
---
 .../account_check_printing/models/account_payment.py   | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/addons/account_check_printing/models/account_payment.py b/addons/account_check_printing/models/account_payment.py
index ab6623b3068..d4ab83da890 100644
--- a/addons/account_check_printing/models/account_payment.py
+++ b/addons/account_check_printing/models/account_payment.py
@@ -45,7 +45,7 @@ class AccountPayment(models.Model):
     _inherit = "account.payment"
 
     check_amount_in_words = fields.Char(string="Amount in Words")
-    check_manual_sequencing = fields.Boolean(related='journal_id.check_manual_sequencing')
+    check_manual_sequencing = fields.Boolean(related='journal_id.check_manual_sequencing', readonly=1)
     check_number = fields.Integer(string="Check Number", readonly=True, copy=False,
         help="The selected journal is configured to print check numbers. If your pre-printed check paper already has numbers "
              "or if the current numbering is wrong, you can change it in the journal configuration page.")
@@ -82,10 +82,10 @@ class AccountPayment(models.Model):
 
     @api.model
     def create(self, vals):
-        if vals['payment_method_id'] == self.env.ref('account_check_printing.account_payment_method_check').id\
-                and vals.get('check_manual_sequencing'):
-            sequence = self.env['account.journal'].browse(vals['journal_id']).check_sequence_id
-            vals.update({'check_number': sequence.next_by_id()})
+        if vals['payment_method_id'] == self.env.ref('account_check_printing.account_payment_method_check').id:
+            journal = self.env['account.journal'].browse(vals['journal_id'])
+            if journal.check_manual_sequencing:
+                vals.update({'check_number': journal.check_sequence_id.next_by_id()})
         return super(AccountPayment, self).create(vals)
 
     @api.multi

From b15e805b5ad40e1e8e08e9be1ba248da66158bc9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alexandre=20K=C3=BChn?= <aku@odoo.com>
Date: Mon, 16 Apr 2018 14:16:24 +0200
Subject: [PATCH 20/34] [FIX] board,web: edit custom views in place

Before this commit, whenever we do an operation on any of these custom views,
such as folding it, the custom view was saved by creating a new one.

This behaviour comes from a lost feature to undo operations on custom views.
Since we do not have this feature anymore, it makes no sense to create new
custom views on save, instead of applying the changes in place.

With this commit, custom views are edited in place.

Fixes #23712
---
 addons/board/static/src/js/dashboard.js      |  8 ++++----
 addons/board/static/tests/dashboard_tests.js | 16 ++++++++--------
 addons/web/controllers/main.py               | 19 +++++++++++--------
 3 files changed, 23 insertions(+), 20 deletions(-)

diff --git a/addons/board/static/src/js/dashboard.js b/addons/board/static/src/js/dashboard.js
index ee8f720a9df..09c9c4e2559 100644
--- a/addons/board/static/src/js/dashboard.js
+++ b/addons/board/static/src/js/dashboard.js
@@ -20,7 +20,7 @@ FormView.include({
      */
     init: function (viewInfo) {
         this._super.apply(this, arguments);
-        this.controllerParams.viewID = viewInfo.view_id;
+        this.controllerParams.customViewID = viewInfo.custom_view_id;
     },
 });
 
@@ -33,7 +33,7 @@ FormController.include({
     }),
     init: function (parent, model, renderer, params) {
         this._super.apply(this, arguments);
-        this.viewID = params.viewID;
+        this.customViewID = params.customViewID;
     },
 
     //--------------------------------------------------------------------------
@@ -63,9 +63,9 @@ FormController.include({
         var board = this.renderer.getBoard();
         var arch = QWeb.render('DashBoard.xml', _.extend({}, board));
         return this._rpc({
-                route: '/web/view/add_custom',
+                route: '/web/view/edit_custom',
                 params: {
-                    view_id: this.viewID,
+                    custom_id: this.customViewID,
                     arch: arch,
                 }
             }).then(dataManager.invalidate.bind(dataManager));
diff --git a/addons/board/static/tests/dashboard_tests.js b/addons/board/static/tests/dashboard_tests.js
index 4a6f25f5950..505883a5f4b 100644
--- a/addons/board/static/tests/dashboard_tests.js
+++ b/addons/board/static/tests/dashboard_tests.js
@@ -124,8 +124,8 @@ QUnit.test('basic functionality, with one sub action', function (assert) {
             if (route === '/web/dataset/search_read') {
                 assert.deepEqual(args.domain, [['foo', '!=', 'False']], "the domain should be passed");
             }
-            if (route === '/web/view/add_custom') {
-                assert.step('add custom');
+            if (route === '/web/view/edit_custom') {
+                assert.step('edit custom');
                 return $.when(true);
             }
             return this._super.apply(this, arguments);
@@ -156,7 +156,7 @@ QUnit.test('basic functionality, with one sub action', function (assert) {
     form.$('.oe_fold').click();
 
     assert.ok(form.$('.oe_content').is(':visible'), "content is visible again");
-    assert.verifySteps(['load action', 'add custom', 'add custom']);
+    assert.verifySteps(['load action', 'edit custom', 'edit custom']);
 
     assert.strictEqual($('.modal').length, 0, "should have no modal open");
 
@@ -184,7 +184,7 @@ QUnit.test('basic functionality, with one sub action', function (assert) {
     assert.strictEqual($('.modal').length, 0, "should have no modal open");
     assert.strictEqual(form.$('.oe_action').length, 0, "should have no displayed action");
 
-    assert.verifySteps(['load action', 'add custom', 'add custom', 'add custom', 'add custom']);
+    assert.verifySteps(['load action', 'edit custom', 'edit custom', 'edit custom', 'edit custom']);
     form.destroy();
 });
 
@@ -293,8 +293,8 @@ QUnit.test('can drag and drop a view', function (assert) {
                     views: [[4, 'list']],
                 });
             }
-            if (route === '/web/view/add_custom') {
-                assert.step('add custom');
+            if (route === '/web/view/edit_custom') {
+                assert.step('edit custom');
                 return $.when(true);
             }
             return this._super.apply(this, arguments);
@@ -340,8 +340,8 @@ QUnit.test('twice the same action in a dashboard', function (assert) {
                     views: [[4, 'list'],[5, 'kanban']],
                 });
             }
-            if (route === '/web/view/add_custom') {
-                assert.step('add custom');
+            if (route === '/web/view/edit_custom') {
+                assert.step('edit custom');
                 return $.when(true);
             }
             return this._super.apply(this, arguments);
diff --git a/addons/web/controllers/main.py b/addons/web/controllers/main.py
index 6b73f28ca7d..91d178bc69c 100644
--- a/addons/web/controllers/main.py
+++ b/addons/web/controllers/main.py
@@ -961,14 +961,17 @@ class DataSet(http.Controller):
 
 class View(http.Controller):
 
-    @http.route('/web/view/add_custom', type='json', auth="user")
-    def add_custom(self, view_id, arch):
-        CustomView = request.env['ir.ui.view.custom']
-        CustomView.create({
-            'user_id': request.session.uid,
-            'ref_id': view_id,
-            'arch': arch
-        })
+    @http.route('/web/view/edit_custom', type='json', auth="user")
+    def edit_custom(self, custom_id, arch):
+        """
+        Edit a custom view
+
+        :param int custom_id: the id of the edited custom view
+        :param str arch: the edited arch of the custom view
+        :returns: dict with acknowledged operation (result set to True)
+        """
+        custom_view = request.env['ir.ui.view.custom'].browse(custom_id)
+        custom_view.write({ 'arch': arch })
         return {'result': True}
 
 class Binary(http.Controller):

From cf163d19eefb8049c8bbd443cd9d1f3260cf3774 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alexandre=20Ku=CC=88hn?= <alex.e.kuhn@gmail.com>
Date: Mon, 16 Apr 2018 12:44:16 +0200
Subject: [PATCH 21/34] [FIX] board,web: edit custom views in place

Before this commit, whenever we do an operation on any of these custom views,
such as folding it, the custom view was saved by creating a new one.

This behaviour comes from a lost feature to undo operations on custom views.
Since we do not have this feature anymore, it makes no sense to create new
custom views on save, instead of applying the changes in place.

With this commit, custom views are edited in place.

Fixes #23712
---
 addons/board/static/src/js/dashboard.js |  4 ++--
 addons/web/controllers/main.py          | 20 ++++++++++++--------
 2 files changed, 14 insertions(+), 10 deletions(-)

diff --git a/addons/board/static/src/js/dashboard.js b/addons/board/static/src/js/dashboard.js
index 4bdf33c3d32..b3055637ffb 100644
--- a/addons/board/static/src/js/dashboard.js
+++ b/addons/board/static/src/js/dashboard.js
@@ -169,8 +169,8 @@ var DashBoard = form_common.FormWidget.extend({
             board.columns.push(actions);
         });
         var arch = QWeb.render('DashBoard.xml', board);
-        this.rpc('/web/view/add_custom', {
-            view_id: this.view.fields_view.view_id,
+        this.rpc('/web/view/edit_custom', { // do not forward-port > saas-15
+            custom_id: this.view.fields_view.custom_view_id, // do not forward-port > saas-15
             arch: arch
         });
     },
diff --git a/addons/web/controllers/main.py b/addons/web/controllers/main.py
index 2ac11d1c1e4..d8cb0e6a36f 100644
--- a/addons/web/controllers/main.py
+++ b/addons/web/controllers/main.py
@@ -930,14 +930,18 @@ class DataSet(http.Controller):
 
 class View(http.Controller):
 
-    @http.route('/web/view/add_custom', type='json', auth="user")
-    def add_custom(self, view_id, arch):
-        CustomView = request.session.model('ir.ui.view.custom')
-        CustomView.create({
-            'user_id': request.session.uid,
-            'ref_id': view_id,
-            'arch': arch
-        }, request.context)
+    @http.route('/web/view/edit_custom', type='json', auth="user")
+    def edit_custom(self, custom_id, arch):
+        """
+        Edit a custom view
+
+        :param int custom_id: the id of the edited custom view
+        :param str arch: the edited arch of the custom view
+        :returns: dict with acknowledged operation (result set to True)
+        """
+
+        custom_view = request.env['ir.ui.view.custom'].browse(custom_id)
+        custom_view.write({ 'arch': arch })
         return {'result': True}
 
 class TreeView(View):

From ffdfbed42c48a4b85c26f224f32003b8bda2ce78 Mon Sep 17 00:00:00 2001
From: Nicolas Martinelli <nim@odoo.com>
Date: Tue, 17 Apr 2018 19:02:10 +0200
Subject: [PATCH 22/34] [FIX] calendar: avoid memory overflow

On a DB with thousands of events including recurring ones, fetching the
complete list of events might lead to a memory overflow due to the
prefetching of all virtual events.

We reduce the memory footprint by handling no more than 50,000 records
at a time and clearing the cache at each step. This limit is purely
arbitrary, but seems to be a good compromise between performance and
memory usage.

opw-1832482
---
 addons/calendar/models/calendar.py | 22 +++++++++++++++-------
 1 file changed, 15 insertions(+), 7 deletions(-)

diff --git a/addons/calendar/models/calendar.py b/addons/calendar/models/calendar.py
index f105ea7095c..4d377e295d8 100644
--- a/addons/calendar/models/calendar.py
+++ b/addons/calendar/models/calendar.py
@@ -617,13 +617,21 @@ class Meeting(models.Model):
             event_date = event_date.astimezone(timezone)  # transform "+hh:mm" timezone
             rset1 = rrule.rrulestr(str(self.rrule), dtstart=event_date, forceset=True, tzinfos={})
         recurring_meetings = self.search([('recurrent_id', '=', self.id), '|', ('active', '=', False), ('active', '=', True)])
-        for meeting in recurring_meetings:
-            recurring_date = fields.Datetime.from_string(meeting.recurrent_id_date)
-            if use_naive_datetime:
-                recurring_date = recurring_date.replace(tzinfo=None)
-            else:
-                recurring_date = todate(meeting.recurrent_id_date)
-            rset1.exdate(recurring_date)
+
+        # We handle a maximum of 50,000 meetings at a time, and clear the cache at each step to
+        # control the memory usage.
+        invalidate = False
+        for meetings in self.env.cr.split_for_in_conditions(recurring_meetings, size=50000):
+            if invalidate:
+                self.invalidate_cache()
+            for meeting in meetings:
+                recurring_date = fields.Datetime.from_string(meeting.recurrent_id_date)
+                if use_naive_datetime:
+                    recurring_date = recurring_date.replace(tzinfo=None)
+                else:
+                    recurring_date = todate(meeting.recurrent_id_date)
+                rset1.exdate(recurring_date)
+            invalidate = True
         return [d.astimezone(pytz.UTC) if d.tzinfo else d for d in rset1]
 
     @api.multi

From 20f5f625f49040cc6bd9758a0dc7a2fb46bb6367 Mon Sep 17 00:00:00 2001
From: "Lucas Perais (lpe)" <lpe@odoo.com>
Date: Mon, 16 Apr 2018 16:22:31 +0200
Subject: [PATCH 23/34] [FIX] pad: prevent concat bool and string

Before installing pads, create a second company
On the first company, create a task and initialize its pad

Switch companies and try to edit the task

Before this commit:
There is a traceback because since the pad credentials of the second company are not set,
the url cannot be computed

After this commit, we prevent the Null field to concat with a string
hence there is no traceback

OPW 1837059
closes #24263
---
 addons/pad/models/pad.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/addons/pad/models/pad.py b/addons/pad/models/pad.py
index deb920ec69e..9cdcbec12af 100644
--- a/addons/pad/models/pad.py
+++ b/addons/pad/models/pad.py
@@ -75,7 +75,7 @@ class PadCommon(models.AbstractModel):
     @api.model
     def pad_get_content(self, url):
         company = self.env.user.sudo().company_id
-        myPad = EtherpadLiteClient(company.pad_key, company.pad_server + '/api')
+        myPad = EtherpadLiteClient(company.pad_key, (company.pad_server or '') + '/api')
         content = ''
         if url:
             split_url = url.split('/p/')
@@ -132,7 +132,7 @@ class PadCommon(models.AbstractModel):
         for k, field in self._fields.items():
             if hasattr(field, 'pad_content_field') and vals.get(field.pad_content_field) and self[k]:
                 company = self.env.user.sudo().company_id
-                myPad = EtherpadLiteClient(company.pad_key, company.pad_server + '/api')
+                myPad = EtherpadLiteClient(company.pad_key, (company.pad_server or '') + '/api')
                 path = self[k].split('/p/')[1]
                 myPad.setHtmlFallbackText(path, vals[field.pad_content_field])
 

From e5305ca8b718ffec27474e57d06fb54340c81707 Mon Sep 17 00:00:00 2001
From: Arnold Moyaux <arm@odoo.com>
Date: Thu, 12 Apr 2018 14:20:24 +0200
Subject: [PATCH 24/34] [FIX] barcode: use the same process for quantity
 listener

The barcode scanner and the quantity listener do not use
the same proccess although they act for the same operation.
(For example the quantity listener trigger onchange server side
while the barcode scanner not if 'notifychange' key on the
active_barcode is set to False)

Since quantity listener is based on candidate we could directly
call the _barcodeSelectedCandidate method in order to have a common
behavior and code.
---
 .../static/src/js/barcode_form_view.js        | 13 ++--
 addons/barcodes/static/tests/barcode_tests.js | 78 +++++++++++++++++++
 2 files changed, 86 insertions(+), 5 deletions(-)

diff --git a/addons/barcodes/static/src/js/barcode_form_view.js b/addons/barcodes/static/src/js/barcode_form_view.js
index 1730b42290e..b5cad7a1509 100644
--- a/addons/barcodes/static/src/js/barcode_form_view.js
+++ b/addons/barcodes/static/src/js/barcode_form_view.js
@@ -146,10 +146,10 @@ FormController.include({
      * @param {Object} activeBarcode: options sent by the field who use barcode features
      * @returns {Deferred}
      */
-    _barcodeSelectedCandidate: function (candidate, record, barcode, activeBarcode) {
+    _barcodeSelectedCandidate: function (candidate, record, barcode, activeBarcode, quantity) {
         var changes = {};
         var candidateChanges = {};
-        candidateChanges[activeBarcode.quantity] = candidate.data[activeBarcode.quantity] + 1;
+        candidateChanges[activeBarcode.quantity] = quantity ? quantity : candidate.data[activeBarcode.quantity] + 1;
         changes[activeBarcode.fieldName] = {
             operation: 'UPDATE',
             id: candidate.id,
@@ -306,6 +306,8 @@ FormController.include({
             }
             return self.alive($.when.apply($, defs)).then(function () {
                 if (!prefixed) {
+                    // remember the barcode scanned for the quantity listener
+                    self.current_barcode = barcode;
                     // redraw the view if we scanned a real barcode (required if
                     // we manually apply the change in JS, e.g. incrementing the
                     // quantity)
@@ -355,9 +357,10 @@ FormController.include({
             title: _t('Set quantity'),
             buttons: [{text: _t('Select'), classes: 'btn-primary', close: true, click: function () {
                 var new_qty = this.$content.find('.o_set_qty_input').val();
-                var values = {};
-                values[activeBarcode.quantity] = parseFloat(new_qty);
-                return self.model.notifyChanges(activeBarcode.candidate.id, values).then(function () {
+                var record = self.model.get(self.handle);
+                return self._barcodeSelectedCandidate(activeBarcode.candidate, record,
+                        self.current_barcode, activeBarcode, parseFloat(new_qty))
+                .then(function () {
                     self.update({}, {reload: false});
                 });
             }}, {text: _t('Discard'), close: true}],
diff --git a/addons/barcodes/static/tests/barcode_tests.js b/addons/barcodes/static/tests/barcode_tests.js
index cf77497a2a7..783a5875e98 100644
--- a/addons/barcodes/static/tests/barcode_tests.js
+++ b/addons/barcodes/static/tests/barcode_tests.js
@@ -404,4 +404,82 @@ QUnit.test('specification of widget barcode_handler', function (assert) {
     barcodeEvents.BarcodeEvents.max_time_between_keys_in_ms = delay;
     delete fieldRegistry.map.test_barcode_handler;
 });
+
+QUnit.test('specification of widget barcode_handler with keypress and notifyChange', function (assert) {
+    assert.expect(6);
+    var done = assert.async();
+
+    var delay = barcodeEvents.BarcodeEvents.max_time_between_keys_in_ms;
+    barcodeEvents.BarcodeEvents.max_time_between_keys_in_ms = 0;
+
+    this.data.order.onchanges = {
+        _barcode_scanned: function () {},
+    };
+
+    // Define a specific barcode_handler widget for this test case
+    var TestBarcodeHandler = AbstractField.extend({
+        init: function () {
+            this._super.apply(this, arguments);
+
+            this.trigger_up('activeBarcode', {
+                name: 'test',
+                fieldName: 'line_ids',
+                notifyChange: false,
+                setQuantityWithKeypress: true,
+                quantity: 'quantity',
+                commands: {
+                    barcode: '_barcodeAddX2MQuantity',
+                }
+            });
+        },
+    });
+    fieldRegistry.add('test_barcode_handler', TestBarcodeHandler);
+
+    var form = createView({
+        View: FormView,
+        model: 'order',
+        data: this.data,
+        arch: '<form>' +
+                    '<field name="_barcode_scanned" widget="test_barcode_handler"/>' +
+                    '<field name="line_ids">' +
+                        '<tree>' +
+                            '<field name="product_id"/>' +
+                            '<field name="product_barcode" invisible="1"/>' +
+                            '<field name="quantity"/>' +
+                        '</tree>' +
+                    '</field>' +
+                '</form>',
+        mockRPC: function (route, args) {
+            assert.step(args.method);
+            return this._super.apply(this, arguments);
+        },
+        res_id: 1,
+        viewOptions: {
+            mode: 'edit',
+        },
+    });
+    _.each(['1','2','3','4','5','6','7','8','9','0','Enter'], triggerKeypressEvent);
+         // Quantity listener should open a dialog.
+    triggerKeypressEvent('5');
+
+    setTimeout(function () {
+        var keycode = $.ui.keyCode.ENTER;
+
+        assert.strictEqual($('.modal .modal-body').length, 1, 'should open a modal with a quantity as input');
+        assert.strictEqual($('.modal .modal-body .o_set_qty_input').val(), '5', 'the quantity by default in the modal shoud be 5');
+
+        $('.modal .modal-body .o_set_qty_input').val('7');
+
+        $('.modal .modal-body .o_set_qty_input').trigger($.Event('keypress', {which: keycode, keyCode: keycode}));
+        assert.strictEqual(form.$('.o_data_row .o_data_cell:nth(1)').text(), '7',
+        "quantity checked should be 7");
+
+        assert.verifySteps(['read', 'read']);
+
+        form.destroy();
+        barcodeEvents.BarcodeEvents.max_time_between_keys_in_ms = delay;
+        delete fieldRegistry.map.test_barcode_handler;
+        done();
+    });
+});
 });

From a6e2830631be5b933c33bf7105aafc33e08665d5 Mon Sep 17 00:00:00 2001
From: Arnold Moyaux <arm@odoo.com>
Date: Thu, 12 Apr 2018 15:20:17 +0200
Subject: [PATCH 25/34] [FIX] barcode: do not trigger barcode on pending views

The check on the event target and the barcode target is done outside
the check on barcode found. That result in a warning for each modal/form
view that is pending.

This commit do the check before doing any operations in order
to directly stop if the event target is not similiar to listening
barcode target
---
 .../static/src/js/barcode_form_view.js        | 10 ++--
 addons/barcodes/static/tests/barcode_tests.js | 54 +++++++++++++++++++
 2 files changed, 60 insertions(+), 4 deletions(-)

diff --git a/addons/barcodes/static/src/js/barcode_form_view.js b/addons/barcodes/static/src/js/barcode_form_view.js
index b5cad7a1509..015119c5830 100644
--- a/addons/barcodes/static/src/js/barcode_form_view.js
+++ b/addons/barcodes/static/src/js/barcode_form_view.js
@@ -283,15 +283,14 @@ FormController.include({
                     function (reserved) {return barcode.indexOf(reserved) === 0;});
             var hasCommand = false;
             var defs = [];
+            if (! $.contains(target, self.el)) {
+                return;
+            }
             for (var k in self.activeBarcode) {
                 var activeBarcode = self.activeBarcode[k];
                 // Handle the case where there are several barcode widgets on the same page. Since the
                 // event is global on the page, all barcode widgets will be triggered. However, we only
                 // want to keep the event on the target widget.
-                if (! $.contains(target, self.el)) {
-                    continue;
-                }
-
                 var methods = self.activeBarcode[k].commands;
                 var method = prefixed ? methods[barcode] : methods.barcode;
                 if (method) {
@@ -323,6 +322,9 @@ FormController.include({
     _quantityListener: function (event) {
         var character = String.fromCharCode(event.which);
 
+        if (! $.contains(event.target, this.el)) {
+            return;
+        }
         // only catch the event if we're not focused in
         // another field and it's a number
         if (!$(event.target).is('body, .modal') || !/[0-9]/.test(character)) {
diff --git a/addons/barcodes/static/tests/barcode_tests.js b/addons/barcodes/static/tests/barcode_tests.js
index 783a5875e98..b2a2bf46126 100644
--- a/addons/barcodes/static/tests/barcode_tests.js
+++ b/addons/barcodes/static/tests/barcode_tests.js
@@ -482,4 +482,58 @@ QUnit.test('specification of widget barcode_handler with keypress and notifyChan
         done();
     });
 });
+QUnit.test('barcode_scanned only trigger error for active view', function (assert) {
+    assert.expect(2);
+
+    this.data.order_line.fields._barcode_scanned = {string: 'Barcode scanned', type: 'char'};
+
+    var form = createView({
+        View: FormView,
+        model: 'order',
+        data: this.data,
+        arch: '<form>' +
+                    '<field name="_barcode_scanned" widget="barcode_handler"/>' +
+                    '<field name="line_ids">' +
+                        '<tree>' +
+                            '<field name="product_id"/>' +
+                            '<field name="product_barcode" invisible="1"/>' +
+                            '<field name="quantity"/>' +
+                        '</tree>' +
+                    '</field>' +
+                '</form>',
+        archs: {
+            "order_line,false,form":
+                '<form string="order line">' +
+                    '<field name="_barcode_scanned" widget="barcode_handler"/>' +
+                    '<field name="product_id"/>' +
+                '</form>',
+        },
+        res_id: 1,
+        intercepts: {
+            warning: function (event) {
+                assert.step(event.name);
+            }
+        },
+        viewOptions: {
+            mode: 'edit',
+        },
+    });
+
+    form.$('.o_data_row:first').click();
+
+    // We do not trigger on the body since modal and 
+    // form view are both inside it.
+    function modalTriggerKeypressEvent(char) {
+        var keycode;
+        if (char === "Enter") {
+            keycode = $.ui.keyCode.ENTER;
+        } else {
+            keycode = char.charCodeAt(0);
+        }
+        return $('.modal').trigger($.Event('keypress', {which: keycode, keyCode: keycode}));
+    }
+    _.each(['O','-','B','T','N','.','c','a','n','c','e','l','Enter'], modalTriggerKeypressEvent);
+    assert.verifySteps(['warning'], "only one event should be triggered");
+    form.destroy();
+});
 });

From a78442194a1de7c2f18de52141ccf13e45e02ca5 Mon Sep 17 00:00:00 2001
From: Yannick Tivisse <yti@odoo.com>
Date: Wed, 18 Apr 2018 11:52:41 +0200
Subject: [PATCH 26/34] [FIX] fleet: Track driver modifications on vehicles

---
 addons/fleet/models/fleet_vehicle.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/addons/fleet/models/fleet_vehicle.py b/addons/fleet/models/fleet_vehicle.py
index 103d764864e..07b989f19df 100644
--- a/addons/fleet/models/fleet_vehicle.py
+++ b/addons/fleet/models/fleet_vehicle.py
@@ -22,7 +22,7 @@ class FleetVehicle(models.Model):
     license_plate = fields.Char(required=True, track_visibility="onchange",
         help='License plate number of the vehicle (i = plate number for a car)')
     vin_sn = fields.Char('Chassis Number', help='Unique number written on the vehicle motor (VIN/SN number)', copy=False)
-    driver_id = fields.Many2one('res.partner', 'Driver', help='Driver of the vehicle', copy=False)
+    driver_id = fields.Many2one('res.partner', 'Driver', track_visibility="onchange", help='Driver of the vehicle', copy=False)
     model_id = fields.Many2one('fleet.vehicle.model', 'Model', required=True, help='Model of the vehicle')
     log_fuel = fields.One2many('fleet.vehicle.log.fuel', 'vehicle_id', 'Fuel Logs')
     log_services = fields.One2many('fleet.vehicle.log.services', 'vehicle_id', 'Services Logs')

From e155244007bf6bfd88e4b4ee248e9570a2725d5f Mon Sep 17 00:00:00 2001
From: Florent de Labarre <florent.mirieu@gmail.com>
Date: Mon, 9 Apr 2018 21:26:33 +0200
Subject: [PATCH 27/34] [FIX] sale_stock: access rights when updating delivered
 quantities

If a user only has the stock user access rights, he's not able to
validate or write on a move that has to update the delivered quantities.

Closes #23782
opw-1835138
---
 addons/sale_stock/models/stock.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/addons/sale_stock/models/stock.py b/addons/sale_stock/models/stock.py
index 26deb65145d..b13e71d6c6f 100644
--- a/addons/sale_stock/models/stock.py
+++ b/addons/sale_stock/models/stock.py
@@ -28,7 +28,7 @@ class StockMove(models.Model):
 
     def _action_done(self):
         result = super(StockMove, self)._action_done()
-        for line in result.mapped('sale_line_id'):
+        for line in result.mapped('sale_line_id').sudo():
             line.qty_delivered = line._get_delivered_qty()
         return result
 
@@ -39,7 +39,7 @@ class StockMove(models.Model):
             for move in self:
                 if move.state == 'done':
                     sale_order_lines = self.filtered(lambda move: move.sale_line_id and move.product_id.expense_policy == 'no').mapped('sale_line_id')
-                    for line in sale_order_lines:
+                    for line in sale_order_lines.sudo():
                         line.qty_delivered = line._get_delivered_qty()
         return res
 

From 41e7df788055bfe674d9689400fdfbdf15bb269b Mon Sep 17 00:00:00 2001
From: Martin Trigaux <mat@odoo.com>
Date: Wed, 18 Apr 2018 13:58:09 +0200
Subject: [PATCH 28/34] [FIX] transifex: adapt the URL scheme

The search patterns have changed on Transifex
While the URL is still backward compatible, it may change in the future
---
 addons/transifex/models/ir_translation.py | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/addons/transifex/models/ir_translation.py b/addons/transifex/models/ir_translation.py
index 46ceecdb91f..316fbba47b1 100644
--- a/addons/transifex/models/ir_translation.py
+++ b/addons/transifex/models/ir_translation.py
@@ -78,11 +78,14 @@ class IrTranslation(models.Model):
                     translation.transifex_url = False
                     continue
 
-                # e.g. 'https://www.transifex.com/odoo/odoo-10/translate/#fr/sale/42?q=Sale+Order'
+                # e.g. https://www.transifex.com/odoo/odoo-10/translate/#fr/sale/42?q=text'Sale+Order'
                 translation.transifex_url = "%(url)s/%(project)s/translate/#%(lang)s/%(module)s/42?q=%(src)s" % {
                     'url': base_url,
                     'project': project,
                     'lang': lang_code,
                     'module': translation.module,
-                    'src': werkzeug.url_quote_plus(translation.source[:50]),
+                    'src': werkzeug.url_quote_plus(
+                            "text:'" +
+                            translation.source[:50].replace("'", "\'") +
+                            "'"),
                 }

From 7671e0c30d2cbe6b91937858318ec205502a59ec Mon Sep 17 00:00:00 2001
From: len-odoo <len@odoo.com>
Date: Wed, 18 Apr 2018 11:46:32 +0200
Subject: [PATCH 29/34] [FIX] calendar: fix event sorting function with
 relational fields

When working with relational fields, the sorting function would
compare empty recordsets with Strings (the field value),
crashing in the process.

This is essentially an addendum to previous commit
b6c962e62a7a47240d0091f88fc2ad4359179845
which fixed the sorting for non-relational fields.

opw 1831457
---
 addons/calendar/models/calendar.py | 1 +
 1 file changed, 1 insertion(+)

diff --git a/addons/calendar/models/calendar.py b/addons/calendar/models/calendar.py
index 4d377e295d8..077c700def1 100644
--- a/addons/calendar/models/calendar.py
+++ b/addons/calendar/models/calendar.py
@@ -1156,6 +1156,7 @@ class Meeting(models.Model):
         def key(record):
             # we need to deal with undefined fields, as sorted requires an homogeneous iterable
             def boolean_product(x):
+                x = False if (isinstance(x, models.Model) and not x) else x
                 if isinstance(x, bool):
                     return (x, x)
                 return (True, x)

From c74f97599470ce3c861b9c7a2bb85e6662f703b8 Mon Sep 17 00:00:00 2001
From: Martin Trigaux <mat@odoo.com>
Date: Wed, 18 Apr 2018 14:05:52 +0200
Subject: [PATCH 30/34] [FIX] base: correct Arabic iso_code

The Arabic we use on Transifex is "simple" Arabic, not the one from Syria.
The .po files we synchronise are named 'ar.po', not 'ar_SY.po'

Change the iso_code to match the one we actually use.
transifex module relies on the iso_code to make its URL
---
 odoo/addons/base/res/res.lang.csv | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/odoo/addons/base/res/res.lang.csv b/odoo/addons/base/res/res.lang.csv
index bf57d2fef89..8de2be3a327 100644
--- a/odoo/addons/base/res/res.lang.csv
+++ b/odoo/addons/base/res/res.lang.csv
@@ -1,7 +1,7 @@
 "id","name","code","iso_code","direction","grouping","decimal_point","thousands_sep","date_format","time_format","translatable"
 "base.lang_en","English","en_US","en","Left-to-Right","[3,0]",".",",","%m/%d/%Y","%H:%M:%S","True"
 "base.lang_am_ET","Amharic / አምሃርኛ","am_ET","am_ET","Left-to-Right","[3,0]",".",",","%d/%m/%Y","%I:%M:%S","True"
-"base.lang_ar_SY","Arabic / الْعَرَبيّة","ar_SY","ar_SY","Left-to-Right","[3,0]",".",",","%d %b, %Y","%I:%M:%S","True"
+"base.lang_ar_SY","Arabic / الْعَرَبيّة","ar_SY","ar","Left-to-Right","[3,0]",".",",","%d %b, %Y","%I:%M:%S","True"
 "base.lang_eu_ES","Basque / Euskara","eu_ES","eu_ES","Left-to-Right","[]",",",,"%a, %Y.eko %bren %da","%H:%M:%S","True"
 "base.lang_bs_BA","Bosnian / bosanski jezik","bs_BA","bs","Left-to-Right","[]",",",,"%d.%m.%Y","%H:%M:%S","True"
 "base.lang_bg","Bulgarian / български език","bg_BG","bg","Left-to-Right","[3,0]",",",,"%d.%m.%Y","%H,%M,%S","True"

From 8550cf28e882cdb39c95a8a530f86ec1d86db468 Mon Sep 17 00:00:00 2001
From: Martin Trigaux <mat@odoo.com>
Date: Wed, 18 Apr 2018 16:25:42 +0200
Subject: [PATCH 31/34] [IMP] doc: add link to qweb variable syntax

To mention you can use the {{ var }} syntax too

Closes #12035
---
 doc/reference/reports.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/reference/reports.rst b/doc/reference/reports.rst
index 6ec6e6a157c..ed408a0d817 100644
--- a/doc/reference/reports.rst
+++ b/doc/reference/reports.rst
@@ -190,7 +190,7 @@ Barcodes
 --------
 
 Barcodes are images returned by a controller and can easily be embedded in
-reports thanks to the QWeb syntax:
+reports thanks to the QWeb syntax (e.g. see :ref:`reference/qweb/attributes`):
 
 .. code-block:: html
 

From 0e49ccc4196b5302fbd15d0b11026afb489ce10f Mon Sep 17 00:00:00 2001
From: Toufik Benjaa <tbe@odoo.com>
Date: Wed, 18 Apr 2018 15:58:32 +0200
Subject: [PATCH 32/34] [FIX] payment: Save payment token only if user is
 connected

- Fix an issue where the transaction were always set a 'form_save' thus always creating payment tokens.
- Fix an issue where when the customer paying while not being logged in was crashing.
  The issue is due to the fact that we are creating payment transactions linked to no partners, doing so it crashing the code when creating the payment token with no partner set.
---
 addons/payment/controllers/portal.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/addons/payment/controllers/portal.py b/addons/payment/controllers/portal.py
index be70f46309e..6f13400356b 100644
--- a/addons/payment/controllers/portal.py
+++ b/addons/payment/controllers/portal.py
@@ -89,7 +89,7 @@ class WebsitePayment(http.Controller):
                 'amount': float(amount),
                 'currency_id': currency_id,
                 'partner_id': partner_id,
-                'type': 'form_save' if acquirer.save_token else 'form',
+                'type': 'form_save' if acquirer.save_token != 'none' and partner_id else 'form',
             }
 
             tx = request.env['payment.transaction'].sudo().create(values)
@@ -119,7 +119,7 @@ class WebsitePayment(http.Controller):
             'currency_id': int(currency_id),
             'partner_id': partner_id,
             'payment_token_id': pm_id,
-            'type': 'form_save' if token.acquirer_id.save_token else 'form',
+            'type': 'form_save' if token.acquirer_id.save_token != 'none' and partner_id else 'form',
         }
 
         tx = request.env['payment.transaction'].sudo().create(values)

From 05589db8232a68846cca2660c73914045b1fec5a Mon Sep 17 00:00:00 2001
From: Aaron Bohy <aab@odoo.com>
Date: Fri, 13 Apr 2018 15:22:47 +0200
Subject: [PATCH 33/34] [FIX] web: don't ignore required attrs on image fields

Before this rev., falsy image fields could be saved even if they
were required.
---
 .../web/static/src/js/fields/basic_fields.js  |  3 --
 addons/web/static/src/less/fields.less        |  4 +++
 .../static/tests/fields/basic_fields_tests.js | 29 ++++++++++++++++++-
 3 files changed, 32 insertions(+), 4 deletions(-)

diff --git a/addons/web/static/src/js/fields/basic_fields.js b/addons/web/static/src/js/fields/basic_fields.js
index aff339cb4a2..ac8ad02b24a 100644
--- a/addons/web/static/src/js/fields/basic_fields.js
+++ b/addons/web/static/src/js/fields/basic_fields.js
@@ -1227,9 +1227,6 @@ var FieldBinaryImage = AbstractFieldBinary.extend({
             self.do_warn(_t("Image"), _t("Could not display the selected image."));
         });
     },
-    isSet: function () {
-        return true;
-    },
 });
 
 var FieldBinaryFile = AbstractFieldBinary.extend({
diff --git a/addons/web/static/src/less/fields.less b/addons/web/static/src/less/fields.less
index 26753ca3d8b..4ac5643bf4d 100644
--- a/addons/web/static/src/less/fields.less
+++ b/addons/web/static/src/less/fields.less
@@ -309,6 +309,10 @@
         &:hover .o_form_image_controls {
             opacity: 0.8;
         }
+
+        &.o_field_invalid > img {
+            border: 1px solid @brand-danger;
+        }
     }
 
     // Input loading/file
diff --git a/addons/web/static/tests/fields/basic_fields_tests.js b/addons/web/static/tests/fields/basic_fields_tests.js
index 909e778b60a..7f1742b3041 100644
--- a/addons/web/static/tests/fields/basic_fields_tests.js
+++ b/addons/web/static/tests/fields/basic_fields_tests.js
@@ -1698,7 +1698,6 @@ QUnit.module('basic_fields', {
         assert.strictEqual(form.$('div[name="document"] > img').attr('width'), "90",
             "the image should correctly set its attributes");
         form.destroy();
-
     });
 
     QUnit.test('image fields in subviews are loaded correctly', function (assert) {
@@ -1750,6 +1749,34 @@ QUnit.module('basic_fields', {
         form.destroy();
     });
 
+    QUnit.test('image fields with required attribute', function (assert) {
+        assert.expect(2);
+
+        var form = createView({
+            View: FormView,
+            model: 'partner',
+            data: this.data,
+            arch: '<form string="Partners">' +
+                    '<field name="document" required="1" widget="image"/>' +
+                '</form>',
+            mockRPC: function (route, args) {
+                if (args.method === 'create') {
+                    throw new Error("Should not do a create RPC with unset required image field");
+                }
+                return this._super.apply(this, arguments);
+            },
+        });
+
+        form.$buttons.find('.o_form_button_save').click();
+
+        assert.ok(form.$('.o_form_view').hasClass('o_form_editable'),
+            "form view should still be editable");
+        assert.ok(form.$('.o_field_widget').hasClass('o_field_invalid'),
+            "image field should be displayed as invalid");
+
+        form.destroy();
+    });
+
     QUnit.module('JournalDashboardGraph', {
         beforeEach: function () {
             _.extend(this.data.partner.fields, {

From 8c64159b8847dc465a21415c085d6526d280be02 Mon Sep 17 00:00:00 2001
From: Josse Colpaert <jco@odoo.com>
Date: Tue, 17 Apr 2018 18:23:30 +0200
Subject: [PATCH 34/34] [FIX] stock_account: valuation report needs
 company_owned in context

When calculating the stock_value of a product,
the system will take into account all the locations
that have this company as company.  (that way if owner_id
is not set, the company_id on the location is the owner (virtual: not set))

The Qty on Hand field takes into account however
the quantities that are in the warehouses.

This could lead to weird situations where the Quantity On Hand is 0
and so the record is not shown, while the stock value is positive.
(e.g. stock in Transit)

In order to use the same logic for both fields, we pass company_owned=True
in the context.
---
 addons/stock_account/views/product_views.xml          | 2 +-
 addons/stock_account/wizard/stock_quantity_history.py | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/addons/stock_account/views/product_views.xml b/addons/stock_account/views/product_views.xml
index e6d14d02309..f029db4ce51 100644
--- a/addons/stock_account/views/product_views.xml
+++ b/addons/stock_account/views/product_views.xml
@@ -95,7 +95,7 @@
             <field name="view_type">form</field>
             <field name="view_id" ref="view_stock_product_tree2"/>
             <field name="domain">[('type', '=', 'product'), ('qty_available', '!=', 0)]</field>
-            <field name="context">{}</field>
+            <field name="context">{'company_owned': True}</field>
             <field name="help" type="html">
                 <p class="oe_view_nocontent_create">
                     If there are products, you will see its name and valuation. 
diff --git a/addons/stock_account/wizard/stock_quantity_history.py b/addons/stock_account/wizard/stock_quantity_history.py
index 6b244d13ac2..fe920a457bb 100644
--- a/addons/stock_account/wizard/stock_quantity_history.py
+++ b/addons/stock_account/wizard/stock_quantity_history.py
@@ -24,7 +24,7 @@ class StockQuantityHistory(models.TransientModel):
                 'name': _('Products'),
                 'res_model': 'product.product',
                 'domain': "[('type', '=', 'product'), ('qty_available', '!=', 0)]",
-                'context': dict(self.env.context, to_date=self.date),
+                'context': dict(self.env.context, to_date=self.date, company_owned=True),
             }
             return action
         else: