Change decimal point, thousand separator and date format for Mongolian
language
closesodoo/odoo#37934
Signed-off-by: Martin Trigaux (mat) <mat@odoo.com>
`method` has no effect, so currently XML-RPC can be called via other
methods, e.g. GET, which is against XML-RPC specification.
closesodoo/odoo#37917
X-original-commit: c2fe13d31f6b55900ad139d4e75b8c1a0c4ac165
Signed-off-by: Xavier Morel (xmo) <xmo@odoo.com>
It is possible 29723e351d5 through the interface, in debug mode,
to create a portal or a public user.
Because of 29723e351d5, doing so raise: the user that it tries to create also
has internal user rights, which is forbidden for obvious security reasons.
The goal of 29723e351d5 was to restore normal behaviour when changing rights of
a non-internal user, i.e. to respect the groups given in arguments and their
implications. Most user creations happen programmatically, e.g. when a user
signs up on the website, so without that commit it was not possible to set up
the groups correctly in case of modifications, etc, since both create and write
did not use the provided group arguments.
However when passing through the interface, for portal or public users all the
other groups are hidden, but their values are not removed. Since these groups
confer user privileges, they imply internal user rights, which is forbidden for
a portal user, and raises.
Note that before a user created this way could not have the exact same rights
a portal user should have had, since technical groups should have been added
through the implied ids.
For this reason as well the fact that groups can be badly manipulated manually,
it is discouraged to use debug mode to to these actions, but still possible.
Since both flows simply use create, we fix the data that is sent by
the interface.
We cannot use an onchange to clean the groups since we are in the reified view.
So to avoid the JS sending the commands, we need to put the fields in readonly
if they are invisible.
To do so we also need to process the "user type" groups first.
Note that the sorting is stable, so the order is identical as before.
closesodoo/odoo#37839
X-original-commit: 3c44a5afe83465a76d16356e0fd6336b4d9c9196
Signed-off-by: Nans Lefebvre (len) <len@odoo.com>
Adding `tabindex="-1"` is the only way a button could be set to not
have a hotkey when user presses <kbd>Alt</kbd>
closesodoo/odoo#37835
X-original-commit: 9e5b8db72e789064f99f58c4f64867307846acc9
Signed-off-by: VincentSchippefilt <VincentSchippefilt@users.noreply.github.com>
Before this commit, the assets were not found when the user is connected
in mode debug assets in a multi-website and multi-company. This occurs
because the attachments (assets) were created with the number of the
first website accessed, and cannot be loaded when trying to access the
second website.
The website_id is added in the creation of the views see:
092870270e
Now, the attachments are created without the website number and is
shared between all the websites.
opw-2076768
closesodoo/odoo#37789
X-original-commit: 42eec88e5da164e4930c48113109f2c8d4b73da3
Signed-off-by: Jorge Pinna Puissant (jpp) <jpp@odoo.com>
Because of f206714af0 and subsequent commits, adding groups may raise.
Thus, it is always safer to first remove groups and then add new groups.
The converse could raise, making settings save impossible.
Closes#37481
Forward-Port-Of: #37517
In an onboarding situation, the company doesn't have a logo
make an invoice, send and print, print
The document layout editor's layout opens, because nothing is set up
on the company
Click Save
Before this commit, it was impossible to make the invoice print
because each time the document layout was displayed
After this commit, the invoice prints when clicking on Save
There is no default external layout for main_company
Also, the heuristic used to evaluate whether a company
has been set up, onboardingly speaking, has changed.
Before we used the existence of the logo, after we check if
a layout has been setup. When saving the document layout
modal, a report layout is written on the company
So, practically, the document layout modal only appears once
when trying to print invoices (or other documents)
closesodoo/odoo#37137
Signed-off-by: Lucas Perais (lpe) <lpe@odoo.com>
Redirect_type was renamed from 3xx to redirect_3xx, but name is used as http
status code. It is better a redirect(301) instead of redirect(redirect_301)
Re-add the bind_to_environ, it was removed because it seems not useful, but
once you are behind a proxy, werkzeug need the environ to find the correct
hostname and more ... Transformed relative url into absolute by werkzeug was
wrong.
closesodoo/odoo#37733
Signed-off-by: Jérémy Kersten (jke) <jke@openerp.com>
Werkzeug 0.15 modified ProxyFix such that by default it only forwards
the REMOTE_ADDR when enabled, whereas before 0.15 it would also
forward scheme and host. This breaks proxied odoo as the base url
becomes incorrect (cf #34412).
Use properly configured ProxyFix when running with werkzeug 0.15, old
configuration otherwise.
Backport of 4057227def which was merged
in master, because many people apparently run 0.15 now.
Closes#35085closesodoo/odoo#36212closesodoo/odoo#37708
Signed-off-by: Xavier Morel (xmo) <xmo@odoo.com>
A warning was raised during documentation build because of encoding inconsistency.
closesodoo/odoo#37682
Signed-off-by: Victor Feyens (vfe) <vfe@odoo.com>
en_US may not be activated as it is possible to create a database in
another language using the database manager.
When trying to install a chart of account, the tax return entry tried
to format a date at the installation of the module, with no lang in
the context. The fallback was made on en_US but an error is raised if
that language is not activated.
As it is a very common scenario to retrieve a language from the
context, add a generic tool method to do it.
Replace and closesodoo/odoo#37629closesodoo/odoo#37568
Signed-off-by: Martin Trigaux (mat) <mat@odoo.com>
These functions convert plain text links into clickable hyperlinks.
These open in new tabs but did not have the "noreferrer noopener" rel
attributes, which made them susceptible to reverse tabnabbing.
A lot of attack vectors were available to unregistered, uninvited
anonymous users and presented a significant phishing threat (such as
posting links in the instant-chat, through a mail-alias, in a forum post
or in a twitter post) and leading the operator to believe he had been
disconnected from odoo in the original tab, prompting them to enter
their credentials.
while these three places will add the noreferrer and noopener attributes
on the anchor tags generated by them, there are still many places that
create hyperlinks without the use of these functions, although most of
them are static links, they still represent a transitive security
vulnerability to the linked sites.
There are also a few modules and widgets that roll out their own links
or open new tabs unsafely using window.open(), these will need to be
patched separately.
closesodoo/odoo#37591
Signed-off-by: Olivier Dony (odo) <odo@openerp.com>
Retrieving selection data for a custom field while setting up a model
should not flush() fields in `ir.model.fields.selection`.
closesodoo/odoo#37667
Signed-off-by: Raphael Collet (rco) <rco@openerp.com>
After this commit, you will be able (in technical mode) to update the url for
the python controllers.
Eg.
You can now rename /shop in /garden and /shop/product/ in /garden/vegetable/
Most of urls will be replaced at fly in the renderd qweb, with the function
url_for but all old urls will keep available. So if you access url /shop you
will be automatically redirected to /garden (308 Permanent Redirect).
As for cdn and other post-process of att, the automatically replacement in the
rendered qweb is only done when you will be not website editor. But the new
dispatch of URL will be applied in all cases.
For developper, since it is Permanent Redirect, don't forget to clear cache or
open chrome debug tool (with option 'Disable cache while DevTools is Open) to
see your lasts changes.
closesodoo/odoo#36555
Signed-off-by: Jérémy Kersten (jke) <jke@openerp.com>
The form proxy will raise an error if a required field is not filled,
even when the web client would let it pass through. Indeed, the web
client (correctly) assumes that a user cannot fill in an invisible
field and that something will probably be done on the server to handle
that (e.g. an override of the write/create or simply a command-handling
code by the ORM). Since invisible fields do not even get a widget
instaciated for them, no validation takes place whatsoever.
Since it is sometimes (for obscure reasons) necessary to include all
kinds of invisible fields in tree view (e.g. to get correct values for
related stored fields, somehow), it is possible that required fields
in a view are in fact not really required since they are ignored
by the web client and then correctly handled/modified server-side.
This commit adapts the test proxies to behave similarly to the web client
(since that is, after all, the goal of these proxies) and to ignore
invisible fields when validating views.
closesodoo/odoo#37432
Signed-off-by: Damien Bouvy (dbo) <dbo@odoo.com>
Issue: after many2one updates, the cache of the corresponding one2many
fields was inconsistent when the latter depends on `active_test`. One
of the values in cache was updated, while the other was left intact.
We simplify the cache by not making the field depend on context: the
cache value contains all the records in the relation (corresponding to
`active_test=False`). The value of the field is automatically filtered
by the `active` field when the value is accessed.
This makes it easier to maintain the cache value, guarantees its
consistency, and avoids queries to read the one2many field with
`active_test=False`, after having set it with `active_test=True`.
[`psycopg2` includes a submodule called `sql`][1] which provides more safety and comfort when dealing with raw SQL queries.
As of today, it works fine with Odoo unless SQL query logging is enabled.
This patch fixes that problem, allowing usage of that module.
[1]: http://initd.org/psycopg/docs/sql.htmlclosesodoo/odoo#37561
Signed-off-by: Christophe Simonis <chs@odoo.com>
only activate multi-edit on list with specific attribute.
When the attribute multi_edit="1" is set on the tree view the user
can select a/some records and it will activate the multi-edit
with confirmation dialog (even for a single record).
Also, on-change are not applied when using multi-edit
closesodoo/odoo#37525
Signed-off-by: VincentSchippefilt <VincentSchippefilt@users.noreply.github.com>
Section 7.1.2 of RFC 7231 requires preservation of URL fragment
through redirects. Our old JS redirection code was necessary when
browsers did not consistently implement it. Apart from a few odd
and marginal exceptions they all do it now, so we can stop that.
Before this commit, when a record of a model who has a `res.users` field
it could fail the `check_company` because the check looks for
`company_id` who is the default company of the user.
In the case of `res.users`, `check_company` must look after the
`company_ids` of the user.
Because the sub-record values would not necessarily get fetched
ever (whether default or stored), the computation of modifiers might
blow up if it relied on one of the un-fetched un-specified fields.
One such situation is trying to create a partner with child partners
if base_address_city is installed: the module adds a readonly attr
predicated upon the parent_id, without explicitly providing such the
field would be missing from the O2M record's values.
Closes#37176closesodoo/odoo#37452
X-original-commit: 184d1b69eac2b78c72228c81c5c6cf8cc4a56eb4
Signed-off-by: Xavier Morel (xmo) <xmo@odoo.com>
- When trying to access an image that need to be resized and cropped,
the code could crashes.
This is due to the fact that PIL expect to work with integer for
sizes, but in some cases we provide floats
closesodoo/odoo#37442
Signed-off-by: Toufik Benjaa (tbe) <tbe@odoo.com>
Since it appears that email validation feature from Flanker v0.9.0
is completelly broken (the lib explodes when calling
address.validate_address('some@address.xxx')), Flanker is then removed
and email validation will be done only using the email_normalize method.
Task ID: 2044539
PR #37413
This commit adds support for the parameter 'add_direction' on the '_format_time_ago' method
from tools.
This will allow formatting to '25 minutes' instead of '25 minutes ago'.
Preparation commit for the social 'feedback' task.
Task#2075858
* base, web
Google now recommends a TTL of one year for static contents. We used to
use 1 week in almost every case. This commit increases that value to one
year for safe resources, like assets bundles which contain a specific
hash in the URL which changes if the bundle is recomputed anyway.
Note: this commit refactors the code so that both the one week and one
year durations are defined in http.py and used by others apps. Loading
the library "locale" file used to be done with 10-hours-cache, this has
been increased to 1-week-cache by using the http.py STATIC_CACHE var.
closesodoo/odoo#37402
Signed-off-by: Quentin Smetz (qsm) <qsm@odoo.com>
Before: the address column was 50% wide because of a span in the labels
column which causes its column to be 50% wide.
Now: replaced the span by a label, the columns have the right sizes.
task-2075905
closesodoo/odoo#37331
Signed-off-by: Thibault Delavallee (tde) <tde@openerp.com>
When a model inherit from another, it still must have a _description
specified if the _name is different
Before this commit, mail.test.cc inherited from mail.thread.cc without
specifying a _description but this was not raising any issue
This helps for updating inverse fields without making queries.
Due to this change, a `flush` has to be added in the portal attachment test to
actually compute the inverse after the change of `res_id`.
Before this commit, the inverse of `datas` would be computed after the `create`,
which would lead to unnecessary queries, not only for writing the new values,
but also because of the re-computation of fields that depend on these values.
This makes sense because in `create` the "previous" value of a field is
obviously non-existent.
This avoids having to fetch pre-existing attachments when they are known to be
inexistent, which optimizes stored related binary that are computed post-insert.
Before this commit, flushing a model that uses the `image.mixin` would generate
twice as many queries as it should.
This is because `_compute_related` is not meant to be overridden. In the
override of `Image` we call `super()` then post process the records by
reassigning each record's relevant image field with `_image_process`.
The `super()` will assign the field of the records once which
will in turn trigger a `write` (and thus, will generate queries) then
after the `super()` call we reassign them which will re-trigger the same
`write` and the same queries.
With this commit, instead of overriding `_compute_related` we extract the
processing to a method that can be overridden, so that the `write` is called
simply once.
The result, obviously, is that queries related to the `write` are cut in half.
Related PR: #36683 & #36288
Co-authored-by: Adrian Torres <adt@odoo.com>
Co-authored-by: Sébastien Theys <seb@odoo.com>
This fixes an issue when a Model A with a `many2one_reference` is inherited in
Model B with `_inherits`, and another Model C defines a `one2many` having as
inverse the inherited `many2one_reference` in Model B.
Without this commit, the value of `model_field` is `False` by default for the
field in B, which would lead to incorrect queries when building
`get_domain_list` for the `one2many`.
This commit fixes:
- body of a email.template in a small field
- translation of website_description of a product does not show the
source of the translation
- translation of website_description of a product shows the full
content for the current language
HTML fields are typically fields with longer of content.
If the field is an HTML field, it should be displayed in a textarea,
like the text fields.
Most of HTML fields are split in meaningful chunks of content (using
xml_translate or html_translate method).
For these fields, the source must be displayed.
Also sort the entries on the source to have a consistent order
closesodoo/odoo#37215
Signed-off-by: Martin Trigaux (mat) <mat@odoo.com>
baskhuu