An ir.attachment record can be served as a request's reponse if:
- a request triggers a 404
- the ir.attachment record has its url field matching the url of
the failed and is of binary type
Following rev[1], portal users have the right to create these kind of
records, and it is a security concern.
This patch restrict the ability to create and write on the ir.attachment
records that may be served through the dispatch's exception mechanism to
settings users.
As the asset bundles files are served through the use of these special
ir.attachment, we make sure to retrieve only ir.attachment records
created by the superuser in the `get_attachment` method.
As website administrators often need to play with these special
ir.attachment, we also let to this group the permission to manage them.
[1] 61065b6d04
Make sure building reports using local resources are disabled.
This avoids get different report result based on the system if the
given resources are or not present (e.g. custom style)
Before this commit, the discount on a so line was always brought to zero when changing the price
After this commit, we do this only when the pricelist is supposed to compute the discount
OPW 1867262
closes#25851
The POS uses a DomCache for various UI elements to avoid re-rendering
elements that are the same as the last render. One such cached UI
element is an entry in the client list.
When a partner is edited in the POS frontend the POS will write this
to the backend and then it will load all updated res.partner
records (new write_date > previously loaded most recent write_date).
To render the newly updated information *and* to ensure any other
partner edited (through backend or because it's a child contact) is
updated just clear the whole cache.
Fixes#13856
Open the web/database/manager and create a db with a country set.
The country of the first company will be set to the country set on the form
Before this commit, the currency was not set, eventhough it is a field
on res.country
After this commit, we also set the currency of the first company
opw 1869435
closes#26097
Create an asset and confirm it.
Click on Sell or Dispose
The form view of the disposal move opens
With the breadcrums, back to the asset
Click again on sell or dispose
Before this commit, literally nothing happens
This is because there is no more business to do
After this commit, in the case there is no business to do
we fallback onto the smartbutton's action
OPW 1864318
closes#26086
Before this commit, the function that computes the aged partner balance
could return a list instead of a dict if no partner were found
After this commit, we make the function's signature consistent
closes#26095
Before this commit, saving a file being watched by watchdog
(--dev=reload) with vim (and possibly other text editors) would
crash the server via a KeyboardInterrupt error.
This happens because vim, emacs cause multiple filesystem events to
happen when saving a single file, the FSWatcher registers these events
as multiple SIGHUPs which in turn calls restart() multiple times in a
very small amount of time which makes the KeyboardInterrupts completely
shut down the server
This is fixed by only calling restart() if odoo.phoenix is False, since
catching a SIGHUP sets it to true.
Fixes#21178
Special thanks to @odony for the help :)
Avoid sharing of users'groups when writing on multiple users.
When changing groups of multiple users, all implied groups were shared
between written users.
Oversight of new-api rewrite.
Fixes#26036
With 60300fc, people can use promo code on website.
But the condition leads to a side effect, if a partner has a pricelist set for
him, he will never be able to see the dropdown list of pricelist since he will
enter the else condition with show_visible set to true.
Now, user is able to see selectable pricelists.
opw-1869371
In 75d3121c9 the bad rating was change from 0 to 1.
This commit update the javascript feedback part so the behavior is the
one expected.
related to opw-1863312
closes#26043
The functionality to add an event on outlook through a link seems gone on Microsoft's part
Or doesn't work as it did before
To avoid confusion, we remove the links
OPW 1865938
closes#25968
In af64780a2 an improvement was done so a numerical fields like '-500'
was not breaked up over two lines after the hyphen.
But it seems in a very particular case of printing PDF in a given
combination of condition:
- printing over wkhtmltopdf which itself uses an old version of webkit
- particular font (issue happen with Arial but not "Segoe UI")
- particular version of windows (windows server 2012, not on windows 10)
the - character at the front of a monetary, float or integer field would
be displayed as | erroneously.
The problem is probably that the font system in the old webkit with
given windows will not find the code point in the given font, and
doesn't fallback correctly.
This commit replace using the "NON-BREAKING HYPHEN (U+2011)" by using
the "ZERO WIDTH NO-BREAK SPACE (U+FEFF)" which is an invisible character
with no width that prevent splitting at its location.
As a note, an alternative to this character is "WORD JOINER (U+2060)"
that may be preferred, but it presents exactly the same issue (with
-|500 instead of -{WORD JOINER}500) in the same environment.
mentioned in https://www.odoo.com/forum/1/question/118653
opw-1867842
fixes#17093fixes#25840closes#26019
Do not reload when a temporary Python file is
added/updated/reloaded.
This is to be able to use editors using isolation when saving file.
On save, they create a temporary file which is then moved on the target file.
The temporary file exists for milliseconds only,
and when the change was detected by watchdog and the server was reloaded,
the file already no longer existed on load.
It leaded to `No such file or directory` after the reload.
Connect as portal, go to my account > invoices and click pay now
select wire transfer as the acquirer and then pay now
Before this commit, the messages displayed to the user was misleading and wrong
After this commit, we take the relevant acquirer's message
OPW 1867670
closes#17508closes#25946
When creating a job position from the frontend, and we:
- are on the same language that the default website language,
- have the permission to write on ir.ui.view,
we have all conditions to adding branding used to edit a page.
But when creating a position by the frontend, we create a job that will
render this template:
website_hr_recruitment.default_website_description
When we are in the above said condition, we will create a job position
that erroneously has the branding that should only be displayed on
website and removed when saving an edition.
This caused a lot of problem with the editor that would most often not
be able to edit the content.
In this commit, we use the "rendering_bundle" context key to prevent
branding.
opw-1868879
closes#25963
On mobile, some barcodes didn't trigger in the picking screens, notably
O-BTN.validate. This is due to the use of parent() to check if the
button is in a dropdown, as parent() only checks one DOM-level upwards.
The button being inside a <ul><li>, we need to check more levels than
one to pass the condition and trigger the button press.
By changing parent() to parents(), the entire chain will be checked, not
just one level, and the button press is correctly triggered.
opw-1860964
closes#25941
Rendering in html was correct thanks to the webkit-padding-start 40px added
by the browser. But once printed with wkhtml, the padding was missing.
Now we force the padding manually.
This commit closes#7375
When there is no ACL for a model, the system emits a log with a sample
ACL entry that developers should consider adding. This proposed ACL
should be safe: a default read-only access for internal users
seems appropriate.
Closes#25919
Have a product with a partner A as a seller, without any description whatsoever
Do a vendor bill with partner A as the partner.
Add the product onto the lines
Before this commit, the description on the line was "False"
After this commit, we fallback onto the product name if no other reference is set
OPW 1865969
closes#25857
When editing his post, a user can modify the tags even if he doesn't have
sufficient karma to do so.
Since the backend raises an error, it sends the user to a 403 forbidden page.
opw 1866019
When checking if tags had changed, a missing .ids made it that a recordset was
compared to a set of ids (integers).
As a result, to make an edit the forum would always check that the user had
sufficent karma to retag, even if it was not needed.
opw 1866019
For records having multiple translated terms per field (like html fields),
it was possible to have duplicated entries when synchronizing existing
entries with new ones.
Before this commit, the test aged report crashed on date Year/07/16 (and probably after, too) because:
- we create a partial reconcile today (create_date = Year/07/16) when making the payment to the invoice
- the report date is set as Year/07/15, so, the partial reconciliation, if tested after that date, always appears in another period,
which is not the use case we test, hence the crash of the test
After this commit, we force the create date of the partial reconciliation to *before* the report is called,
thus, no error occurs
closes#25785
On a database where many modules are installed (e.g. runbot all), with
the option "manage available packaging options per products", doing a groupby
"product" on the "package type" list view triggers a js error.
It comes from the fact that the fixed_group variable contains a "length"
attribute; the _().each function uses this to determine (erroneously)
that the object is an array.
It thus uses fixed_group[0] to get an undefined, and then tries to access
a method of undefined.
We replace the each by a simple js loop.
opw 1863576
Since ffda023295, the error is not 'OpenERP Server Error' but 'Odoo Server
Error'.
In case we change of name once again, check based on the name
Avoid "traceback not available" error in PoS when there is a traceback.
Set the rounding method to Round Globally
Create a tax A with rate = 1.1040 %
Create a bank statement with one line having amount = 1153.960
Go on to reconcile that bank statement
Reconcile with a new line on which the tax A applies
Create the write-off
Click on Reconcile
Before this commit, an error was thrown by the server (Move unbalanced)
This was because the amount of the write-off line sent by JS (which is the tax amount)
was 12.7397
The server though computes the taxes by forcing the rounding and gives off a tax amount of 12.74
Hence the error
After this commit, the JS will fetch the amount of the taxes by forcing the rounding there also
And the reconciliation process goes well
This fix is already present in v11.0 at 6fce298d70
OPW 1859939
closes#25733
Steps to reproduce the bug:
- configuration on sale:
- Unit of measure: Some products may be sold/purchased in different units of measure (Advanced)
- Sale Price: Advaced pricing based on formulas (discounts, margins, rounding)
- Discount: Allow discounts on sale order lines
- kg as the Reference UOM for weight
- create an uom 10 kg
- Category: Weight
- Type: Bigger...
- Bigger ratio: 10.0
- create a product P
- Sale price: 100
- Unit of measure: kg
- Purchase UOM: kg
- create a pricelist "My pricelist"
- Discount policy: Show public price & discount to the customer
- Items : All products - 10% discount
- create a SO with "My pricelist"
- create a SO line with P, the unit price is automatically 90 with 10 % of discount
- change the uom of the line with 10kg
Bug:
The unit price of the line didn't change and the discount on the line disappeared.
In function product_uom_change, the uom of the SO line has been set in the context
of the product(like in function product_id_change). So in funciton _get_display_price,
the function _get_real_price_currency must be called with the uom of product in the context.
In this way, the lst_price will be fetch on product with the right uom without any bad conversion
(because uom.id == product_uom with uom from the parameters and product_uom from the context).
But with function get_product_price_rule, no need to call this function with the uom in context as
it is already set in the product(check "if uom_id: ... else ..." in this function).
The same logic has been applied in function _onchange_discount
opw:186385
Simon Lejeune