The idea is to make the dispatching and error-handling consistent for
JsonRequest and HTTPRequest.
In 8809c77f60 we introduced a way for
request-specific error-handling, but JsonRequest.dispatch() was
still catching all errors internally, instead of letting them bubble
up to ir_http._handle_exception()
By removing the internal try except in JsonRequest.dispatch(), we do not
change the behavior much as there are only a couple of "if" in
ir_http._handle_exception() before returning to the request-specific
handle_exception. However we give the opportunity to modules to
customize exception handling even for JsonRPC, the same way it is
possible for HTTP requests.
Here is a simple pseudo code of the flow
ir_http.dispatch():
try:
request.dispatch()
catch Exception as e:
ir_http._handle_exception(e)
ir_http.handle_exception(e)
request._handle_exception(e)
closesodoo/odoo#45639
Signed-off-by: Olivier Dony (odo) <odo@openerp.com>
This fixes the following issue. Set the field `arch` on a view; this
automatically writes on `arch_db`, which is a translated field. If some
translations are discarded, a call to `unlink()` invalidates the whole
cache. And then things go wrong: when `arch_db` is validated, the field
`arch` is missing from cache, and the ORM sets it to `None` because the
field is still protected by the initial write!
Fix the issue by avoiding the call to `unlink()`, and do it in SQL
instead.
closesodoo/odoo#45740
X-original-commit: e7679152ee480a51ef2b6d208ae7a05b2ef61941
Signed-off-by: Raphael Collet (rco) <rco@openerp.com>
On a standard odoo install, `MigrationManager._get_files` represent
more than 4% of an install. This is because the legacy
odoo/base/maintenance/migration path was added to upgrade.__path__
once by module, making the get_filed check 574^2 os.path.exists.
This commit adds a check on initialize_sys_path to call it only once,
and merge legacy path with upgrade-path management in order to benefit
of the `up not in upgrade.__path__` check. This second part of the fix
will also remove the local dir from the upgrades paths.
A further improvement would be to fix MigrationManager in order to skip
_get_file work on a fresh install, (wip by rco-odoo)
closesodoo/odoo#45699
X-original-commit: 497330a695ed52a33f9c9b9c27b149446de0db29
Signed-off-by: Xavier Dollé (xdo) <xdo@odoo.com>
Not setting a value for paperformat_id on 'Company Document Layout'
will also make paperformat_id False on the company but it is required
in the settings.
Without this commit, you can get in the weird situation of being able
to set a value on the document layout but having an error in the
general settings as a required field is missing.
Apply the same logic as in the other views
closesodoo/odoo#45527
X-original-commit: e518063e48936a3f8f9f921950cdae209e67ab47
Signed-off-by: Martin Trigaux (mat) <mat@odoo.com>
Issue
- Remove ~/.odoorc
- Launch a server
- Try to dump the db in db manager
Ok
- Restart the server
- Retry
pg_dump not found
Cause
When the .odoorc file is not there,
the pg_path option is not present so
the normalize method set it to None
When the server is restarted, it re-checks
the options (which are strings) and in the
normalize method we check "if not pg_path"
but 'None' is truthy so it thinks this is
a real path.
Solution
Check if not pg_path or if pg_path string
is None
OPW-2189789
closesodoo/odoo#45369
X-original-commit: f080964694c01a79c52e05c0ceb42c18d4c77df5
Signed-off-by: Nicolas Martinelli (nim) <nim@odoo.com>
The purpose is to force developers to explicitly manage the removal of
field via migration scripts.
closesodoo/odoo#45269
Related: odoo/upgrade#777
Signed-off-by: Raphael Collet (rco) <rco@openerp.com>
Purpose
=======
Improve the state creation flow.
Some users created states by mistake, we want to avoid this situation.
Specifications
==============
Do not allow to create country from the partner form view.
Disable the quick create of the state in the partner form view.
When we create a state from the partner form view, set by default the
country of the state to the country of the partner.
Task 2178289
closesodoo/odoo#44291
Signed-off-by: Thibault Delavallee (tde) <tde@openerp.com>
Before this commit, it was possible (and common) to create search views
without fields and only filters, the consequence was that a search for
that particular search view was not possible. (See
https://github.com/odoo/enterprise/pull/7852)
With this commit, a warning is raised if no field is defined within a
search view, preventing these "common mistakes" from happening again.
closesodoo/odoo#45058
Task-id: 2179521
Signed-off-by: Raphael Collet (rco) <rco@openerp.com>
Sometimes, constraints are not delayed during a module upgrade: the
module is 'to upgrade' but in 'init' mode :-/
Fix this by relying on the module's state only.
closesodoo/odoo#45179
X-original-commit: 878b6538961a9b6a5fe1c6ac68d4ff39391abcdf
Signed-off-by: Xavier Dollé (xdo) <xdo@odoo.com>
Custom models and fields set up the registry as part of their CRUD.
Make sure to flush() before setting up the registry, in order to avoid
neverending recomputations (as fixed by the former commit).
closesodoo/odoo#45163
X-original-commit: af6dbb5c7c165dcf37bf87ee76c0170795ecb574
Signed-off-by: Xavier Dollé (xdo) <xdo@odoo.com>
In some case, a pre-migration script calls `xml_import.parse` to force
reload a no-update data in pre-script. It is possible that fields are
marked to recompute in the process. The problem is that the reference to
the field added in `env.all.tocompute` won't be the same as the
reference of the same field after calling `registry.setup_models()`,
leading to an infinite loop while recomputing this field, since
`fields.__get__` wont find `self` in `env.all.tocompute`.
This problem was discovered when trying to migrate a database with all
modules installed (no demo data) from 12.0 to 13.0 (for commit
references: http://runbot.odoo.com/runbot/build/1176576 with database
comming from http://runbot.odoo.com/runbot/build/1171714).
This commit adds a check before executing `registry.setup_models()` in
order to log when some fields to compute remain before breaking fields
references, and adds a `flush()` after pre-scripts to fix the current
issue.
X-original-commit: 41b9d810066774736c4077bba1dc9c9fba004f48
This is a followup of 1d553eea7b.
Systematically logging import tracebacks can fill up log files, and
waste disk space. We therefore log those tracebacks in DEBUG mode, so
that they can be activated only when needed.
closesodoo/odoo#45075
X-original-commit: 017e3d798c55b1bdac221aea76d3d944f045ee65
Signed-off-by: Raphael Collet (rco) <rco@openerp.com>
* Code cleanup
* Avoid a safe evaluation of the field value when loading those records.
closesodoo/odoo#44883
Related: odoo/enterprise#8283
Signed-off-by: Victor Feyens (vfe) <vfe@odoo.com>
- Activate variants and pricelists
- Go to Product > Products Variants
- Search for anything on the 'Pricelist' filter
A traceback is raised: 'Can only create cache keys from hashable
values...'.
This comes from the following change:
https://github.com/odoo/odoo/blob/4b06fe19fa68255b7982d15e5847da2f6d6209fd/addons/web/static/src/js/views/control_panel/control_panel_model.js#L962
It returns a list instead of a string. Since a list is not hashable, it
causes the issue.
There are not much solutions since the context key `pricelist` can be a
`list` or an `int` (an ID). We force the cache key conversion to a tuple
to avoid the `TypeError` and handle the `list` use case (which was
broken on top of crashing).
opw-2187757
closesodoo/odoo#45064
X-original-commit: ec0a8767143b4c4818418281803c4f52fefa8d2a
Signed-off-by: Nicolas Martinelli (nim) <nim@odoo.com>
When adding a custom field, the ORM also adds it to all the inherits'ed
models, but with the state `base`, because those inherited fields are
automatic (created by the ORM). However, dependencies are enforced for
`base` fields, while they can be ignored for `manual` ones. This is a
problem when a custom field is fucked up: its inherited fields will make
the registry crash.
We fix the issue by not enforcing dependency check on fields inherits'ed
from custom fields.
opw-2191114
closesodoo/odoo#45024
X-original-commit: 2db0787dc9e8717200aaf1d71ac64df1c17f4143
Signed-off-by: Raphael Collet (rco) <rco@openerp.com>
When reading binary content such as `image_128` on `res.users`,
`AccessError` should be raised when necessary.
Steps to reproduce:
- Populate cache in superuser mode.
- Access cached field with public user.
- Read access is allowed but should not.
Concrete example:
- Unpublish `demo` user.
- Access `/slides` with `public` user.
- The template data is generated as `sudo`.
- The same data is then accessed as `public`.
- AccessError should be raised when requesting
`/profile/avatar/<int:user_id>` but is not.
Closes#43826closesodoo/odoo#45033
X-original-commit: e0112db4d6131751475365ab4c42de848f925dce
Signed-off-by: Christophe Simonis <chs@odoo.com>
When you have su == True in your env and you call _name_search
the _name_search was switching back to su = False
when you call with_user with the same user or with None
To reproduce the issue, take a model where a user has
no access.control.list allowing to read the model
call name_search with sudo.
X-original-commit: 8755269f9877e039663adaec8500b530b6d67c68
Have a company with Croatian address but no street2 set.
Create and invoice, print it. On the report the street2 will appear
blank (Empty line).
Correcting the formatting of the address fix the issue
opw-2182621
closesodoo/odoo#44789
X-original-commit: 5f4cc31a3b5a459f4a33c149fafb635a13f08270
Signed-off-by: Nicolas Martinelli (nim) <nim@odoo.com>
Purpose
======
Our current integration between FSM and Stock works well for basic flows, but quickly shows limitations. We don't handle warehouse by employee. Use-case: each worker has a dedicated van with a dedicated stock. I want to track the material used for each intervention to make sure that nothing is stolen.
+ This is also useful in usecases outside of FSM. Example: I have 3 shops (= 3 warehouses), each employee works in a different shop, the default warehouse set on the Sales Order should be the default warehouse of the salesperson. So this should be done sale_stock (and not in FSM)
Specifications
===========
Add a 'Default Warehouse' field on the user only visible if :
- sale_stock is installed
- the 'multi-warehouses' feature is enabled
- domain should only include warehouses which belong to a company the user has access to
- not required
The field should be editable by a user on his own profile and by the admin on all users.
When creating a FSM task from scratch, adding some products creates a SO, the warehouse on the SO should be the default warehouse of the user set on the FSM task.
On SO creation, set the 'default warehouse' selected on the user assigned to the SO. If there isn't any 'default warehouse' set on the user, fallback on the current behavior (warehouse with
lowest sequence)
The field on the res.user should be a property field to allow multicompany usage.
Task : 2166382
closesodoo/odoo#44257
Signed-off-by: Yannick Tivisse (yti) <yti@odoo.com>
In 0.15 accessing werkzeug.urls functions directly through werkzeug
is deprecated, the shortcut will be removed in the eventual werkzeug
1.0.
Fix existing uses of these shortcuts. Also cleanup some imports when
they're not far from a werkzeug* import being altered.
assertDictContainsSubset has been deprecated since 3.2 and is not
documented anymore, apparently because the order of its parameters is
less than obvious.
Consequently, remove the call to said dict & replace it with
assertions on item sets.
Note: the odd formatting is because these bits are literal-include-ed
in the documentation as sub-slices (just the relevant code lines), so
ideally they shouldn't be moved around and no additional content
should be added to those specific lines.
Before this commit, models with the `_transient` flag were ignored in
ir.model.access verifications. Only an implicit ir.rule with the
domain (create_uid=user.id) was applied to avoid most side effects.
The problem is that, often, the security does not lie in side-effects
of abusing of somebody else's wizard record but in the fact that the
wizard methods blindly trust only the right users are creating these
records. Too often, too many sudo were used and creating wizard with
chosen values could lead to an abuse scenario.
Instead, explicitly require the developer to declare security rules
the same way as on any other model.
closesodoo/odoo#43306
Task-id: 1863044
Pad: https://pad.odoo.com/p/r.c1befa51103ed3b955a427971eb19719
Signed-off-by: Martin Trigaux (mat) <mat@odoo.com>
Following changes needing ir.model.access on transient models too.
Remove groups declaration on the action to move it to ir.model.access
when possible.
Rules are strict by default with no unlink access by default and high
priviledge asked. Adaptations may be needed later.
Write access is given as a wizard may need to be modified in case the
action triggers an error and the user has to correct a value
account*: use account.group_account_user for all transient by default
remove account.print.journal relic
stock*: use stock.group_stock_user by default
survey: survey user can send invitations
mail: allow any employee to execute wizards
additional verifications are made to ensure they are executed
only on the documents the user has access to you
give portal access to mail.compose.message as portal still does
some actions like posting messages on the forum
add ir.rule to avoid reading somebody else messages
increase the query count because of undeterminist count
crm: saleman for lead2opp, manager for massmailing
partner manager for actions linked to partners
avoid a write in test_lead_lost
sms: any employee can send sms
mrp: mrp user can execute wizards
give unlink access as making write during do_produce operation
base_import: employees can import files
delivery: stock user can deliver
event_sale: sale user can configure the wizards
event user inherit from sale rights
gamification: employee can give badge
google_service: resolve FIXME
hr: add specific rights
manager can set a plan according to group on button
anyone who can write on an employee can register a departure
hr_expense: set rights based on buttons
hr_holidays: an approver can make a summary report
hr_recruitment: recruiter can refuse a candidate
hr_timesheet: can use the wizard if can create a timesheet
l10n_eu_service: managers can create fiscal positions
mass_mailing: same group as on mass.mailing.list
membership: accountant can create invoice from membership
payment: accountant can create a link
as the source is an account.move
keep the payment.acquirer.onboarding.wizard to system user
only as it is called during company configuration
point_of_sale: PoS manager only can use wizards
never create closing_balance_confirm_wizard records
product_expiry: stock user has rights on stock.picking
product_margin: access from accounting menus
repair: same rules as for above models
sale: set ir.rule for self wizard only
add rule from model introduced in payment to add salesman group
sale_crm: saleman can create a quotation from a lead
sale_coupon: any saleman can generate coupon
add self ir.rule
sale_product_configurator: salesman can select product variants
snailmail: employee can send letters
website: designers can write on website
website_crm_partner_assign: same rule as group on action
website_sale: sale ACL as for payment.acquirer.onboarding.wizard
website_slides: anyone can send invitation
base: base.language.*: allow employee (cf lang_install)
change.password.user: can not read change password wizard of
other users
test.*: no access is needed
Courtesy of Damien Bouvy, William Andre and Antoine Prieëls for review
of acl
As neither fields_view_get, nor default_get actually verify you have
access to a specific model (this is likely to be changed in the
future), it was possible to execute an action to a model, even if the
user does not have access to the corresponding model.
Before this commit, launching an action to a wizard with no access was
opening a new record view with all fields in readonly and clicking on
any button raised an access error.
To avoid the frustrating of seeing an action but getting an unusable
screen when clicking on it, just hide the action in the first place.
Before this commit models with the `_transient` flag were ignored in
ir.model.access verifications. Only an implicit ir.rule with the
domain (create_uid=user.id) was applied to avoid most side effects.
The problem is that, often, the security does not lie in side-effects
of abusing of somebody else's wizard record but in the fact that the
wizard methods blindly trust only the right users are creating these
records. Too often, too many sudo were used and creating wizard with
chosen values could lead to an abuse scenario.
Instead, explicitly require the developer to declare security rules
the same way as on any other model.
Since this option is soon to be used, this rename is a last tweek
to make it more logical to use since it will point to a single
upgrade dir most of the time.
closesodoo/odoo#44593
X-original-commit: 1c8e2809fb296abce6114b7da906d48a240df418
Signed-off-by: Xavier Dollé (xdo) <xdo@odoo.com>
Copying a custom model's record seems pointless by default, since
no field is actually copied.
It makes sense to copy at least the `x_name` field, to make it clear
to the user that the system understood it was duplicating something
and not just creating something entirely new.
The fact that there is a company id set means that you cannot select the
partner in a M2o if you didn't select the company in the selector, and
that you cannot open a document where that partner is set if you are not
in the correct company.
This is an issue for inter_company_rules, as you should be able to
select the company to make a so, po or invoice to a company of the same
database.
If an automated action raises an exception, in the traceback modal:
- For admins, display Disable & Edit automated action buttons
to be able to directly know with wihch automated action the error occurred,
and to give the possibility to edit or disable it quickly,
- For regular users, just add a paragraph to tell with which automated action the error occurred,
so they can give this useful information to their administrator
This is specially useful for databases which have just been
upgraded to a newer version, and for which the server action
is failing because its code is no longer supported.
closesodoo/odoo#44513
X-original-commit: 8f3940c132bbbc99e47fa3f0cba0e768159d9af2
Signed-off-by: Denis Ledoux (dle) <dle@odoo.com>
time.clock is deprecated since python 3.3 and no longer exists in python 3.8
time.process_time was introduced in python 3.3
Replace "is" by "==" as this produces a SyntaxWarning in python 3.8
Fixesodoo/odoo#41313closesodoo/odoo#44502
X-original-commit: f03b4cb5576f264b6845242ba112f02422af4f5f
Signed-off-by: Martin Trigaux (mat) <mat@odoo.com>
Closes#43580Fixes#9449
Adds field type conditions for boolean in search for Property model.
As False values are not stored in DB for boolean, the search() does
not return any value for non existent lines with:
* operator: '=' and value: False
* operator: '!=' and value: True
Uses the 'include_zero' and inverse operator mechanisms implemented
in Property model.
Signed-off-by: Martin Trigaux (mat) <mat@odoo.com>
Victor Feyens