This instance was not actually exploitable for
SQL injection as it is not callable directly
via RPC and guarded by other queries when indirectly
called. Still plain awful.
This instance was not actually exploitable for
SQL injection as it is not callable directly
via RPC and guarded by other queries when indirectly
called. Still plain awful.
The installation of a multilang localisation (e.g. Belgium) used to install as well account_accountant (and then account_voucher) for no technical reason and was considered as the full accounting package.
When setting a worklog on a project_issue, the field to_invoice is prefilled with on_change_account_id based on the contract settings. As the field was not present on the list view, the information was lost and every worklog was not written as invoiceable, even if enabled on the contract. opw 609082.
Commit b6a7402 (reverted at f8671cb) was almost correct, the PageReset should be added at the end of each stories but only if we have one more stories.
The PageReset will force the page count to be reseted at zero which means that last page of report would have been at zero.
In case of invalid format such as 'name email@server' (missing chevrons), the parsing would be failing due to a strict behaviour of getaddresses (returns nameemail@server).
With the patch this format is accepted.
opw 607312
Displaying the pagert in view group does not make sense as it's not updated when changing filter and every group (even if more than 80) is displayed in view group
The website module normally tries to render user-friendly
error pages for any error occurring during the processing
of a website-enabled request.
This happens even for werkzeug's HTTPExceptions that have
their own response, because we want the website layout to
be applied on top of the error page.
One special sort of HTTPException should be preserved
without rewriting: the manually-crafted ones generated
with abort(), and usually wrapping a redirect response,
which bears no alteration.
The switch mode event was triggered even if the view was not actually switched
This leaded to inconsistencies, like adding the view in the breadcrumb history, while the switch did not happen
[IMP] l10n_fr_hr_payroll: make sure the date format of Fiche de paie report is in french
report_sxw: make sure we have a fallback on en_US if trying to load an format in unknown language
This gives JSONRequests a chance to return
a proper JSON-RPC result when an HTTPException
is raised downstream, instead of returning a
plain HTML 404 error.
[FIX] _handle_exception() logic amongst requests and ir_http objects
Changes in website's ir_http#_handle_exception():
* exception is mandatory, can't be None anymore
* we don't touch non website_enabled requests
* we don't touch explicits plain responses from parent
* logic flow is now easier to read (I hope so)
* check for openerp's AccessError and convert to 403 errors
Change in website's ir_http#_dispatch():
* In case of real 404, instead of returning self._handle_exception(), just let parent do the job (so we call super())
Some objects (e.g. account.move.line) have a different signature than the classical 'cr, uid, ids, vals, context=None' and may add extra arguments.
This fix allows to create rules on these objects and still pass the valid arguments.
(opw 609204)
The wizard to generate recurring entries did not respect multicompany rules as the request was done in plain sql.
Add ir.rule and use the orm (opw 607782)
When a purchase requisition is created from a procurement order, a first stock move is created, not associated to any purchase orders
Then, on purchase order creation and confirmation, in the purchase requisition, new stock moves are created, associated to the purchase order.
The existing stock move issued from the procurement order which created the purchase requisition remained untouched, leading to wrong inventory values
To fix this, the destination location of the stock move of the procurement order is written on the source location
A proper fix should be to use a dedicated workflow for puchase requisition, but this can't be done in 7.0, it has to be done in master/trunk
Changes in website's ir_http#_handle_exception():
- exception is mandatory, can't be None anymore
- we don't touch non website_enabled requests
- we don't touch explicits plain responses from parent
- logic flow is now easier to read (I hope so)
Change in website's ir_http#_dispatch():
- In case of real 404, instead of returning self._handle_exception(),
just let parent do the job (so we call super())
FalcoBolger