The groups were set only on the view which does not prevent abuses.
The fact that users can bypass the groups on the view is not critical as the
changes are logged but this should be improved nevertheless.
In master, proper record rules should be set.
Closes#20427
In 11.0, this part of the code has been removed.
When choosing the shipping address in the cart, if a tax has been mapped
by a fiscal position, the subtotal was not correctly computed.
opw:778405
adapting #20279 to v10
Before this commit, when starting a livechat session as a public user and continuing as a portal user, the livechat crashed
(the poral user couldn't see the channel created before as Admin)
After this commit, the conversation is kept and security insured by the uuid in the cookie
OPW 775568
closes#20281
The method `_process_jobs` provides an alternative API to process the cron
jobs, that does not catch exceptions and log them. This makes the processing
of cron jobs easier for scripting.
In case we are not uploading a file but add a slide based on google doc url
or youtube link, post['datas'] is not set and the code will crash.
Javascript don't check the onError, so the user never see the error and wait
that nothing happend.
This commit improve the daily use of activities by delegating activities
management to the document. Activities are already managed on document
through the UI either in form view or in kanban view.
- Create a user A
- Create a lead, assign to A
- Deactivate user A
- Duplicate the lead
A notification email is sent to A (user assigned to the lead).
Since the user is archived, he should not receive any email since it
might contain sensitive information.
opw-778825
[FIX] *: do not use groups when extending an asset bundle
Using groups when declaring an extension of an asset bundle leads to a
different generated asset bundle according to the user's group. This
is not something we want because a dynamic asset bundle's content
means that it could (and it does) trigger unwanted cache invalidation.
website_event, website_blog, website_forum and website_sale add
functions to . These functions are bound to
server side qweb nodes protected by groups. We can always add the
functions; if a user tries to use the routes he should receive a
traceback because of lack of access rules
website_blog adds a module, but is guarded by
the presence of a node in the DOM. We use the same logic to guard the
module added by website_sale with the node.
website_gengo is working as expected.
Use case to reproduce:
- Set a product to be expensed
- Set the expense_policy to something else than no
- Do a delivery order with a picking
- Validate the picking
-> Delivered quantity to 0 and impossible to create an invoice
if the invoice_policy is delivered_quantity
It happens due to this commit 48ea59d
What does it do:
- The move could be generated by an expense.
- If the move has 'no' as expense policy thus we won't add it in the invoice
Problem we can't guess if the move come from an expense or not (limitation).
This commit add an onchange on can_be_expense is order to set the expense
policy back to 'no' when the user uncheck it.
Courtesy of amoyaux
opw-777139
When opening the POS in this specific case:
- Under Mozilla Firefox
- auto printing the receipt is True
- invoicing is True
Before this commit, when issuing an invoice for a customer, a Traceback was thrown to the user and the invoice was not downloaded.
This was because the invoiced parameter resolved before the printing action was.
After this commit, we constain the invoiced parameter to be resolved when the action returns.
There is no traceback, and the invoice is downloaded
OPW 777647
closes#20570
- Create a tax:
Fixed amount: 10
Price included
- Add it by default to a product costing 100
- In a SO/PO/Invoice, add 2 units of the product
The total price is 210 instead of 200.
opw-779696
The `sale_stock.tour` failed in the case the admin was not
part of the group
`product.group_stock_packaging`
or the group
`sale.group_mrp_properties`
because then the sale order was working with the editable list,
which does not open a dialog,
while the test was relying on the dialog to be opened,
in order to close it.
The fix is simply to pass the fact to close the dialog if
there is none.
opw-779308
In Enterprise:
- Go in Settings > Technical > Mail > Templates
- Edit a template
- In the editor, upload an image
- Choose "Upload image without optimization"
You are sent back to the app switcher.
opw-778918
Do not try to run `action_assign` on the next move if it is done or
cancelled. The issue is that `action_assign` will first unlink the
existing pack operations before creating new ones, and the system
forbids to unlink these ones.
To reproduce this issue:
1. Create a product, routes manufacturing and MTO
2. Create SO with that product
3. Go to DO and force assign then cancel the delivery
4. Go to Manufacturing order created and produce
opw 778897
In 7eab8e26d3 res.partner was converted
to the new API, at that point company_type was changed from a stored
field manually synchronised with is_company (through create/write
overrides) into a proper computed field.
However to make it "editable" it was simply marked as
"readonly=False", which means even though UI-wise it looks editable
editing it does not actually do anything (things work in the partners
form because there's also an onchange which updates is_company on the
fly).
Fix by implementing an inverse function and actually do this
correctly.
Fixes#20623
- Go to Maintenance Requests, Create
- Go to 'Equipment' field, 'Create and edit'
- Go to 'Product Information' tab
- Click on 'Vendor' field, 'Create and edit'
'Is a Vendor' field is False
opw-779200
Fields `amount_type` on `account.tax` and `account.tax.template` are
already defined in the `account` module.
Redefining them here (with the same parameters) breaks every other
module that would have used `selection_add=` on those fields.
Actually, it is the case in `account_tax_python`, and thus, all the
localizations/customizations that depend on it were broken by this one.
~ Old API backport of 5d0d80afa5 ~
Fields `amount_type` on `account.tax` and `account.tax.template` are
already defined in the `account` module.
Redefining them here (with the same parameters) breaks every other
module that would have used `selection_add=` on those fields.
Actually, it is the case in `account_tax_python`, and thus, all the
localizations/customizations that depend on it were broken by this one.
(issue spotted by 11.0-nightly)
Closes#19812#20596
Remove weird special case: when the first field of the first line of a one2many
is empty, replace this first field by the comma-separated names of the lines,
and discard the other lines.
Fine tuning of this commit: 51d072db44
When clicking on the group of the Inventory at Date, the
product.price.inventory must follow the same order as the
read_group in stock.history.
opw:747857
- Create an asset, post one line.
- Go back to the asset => the button is green
- Click again on the line => the button is orange
There is no protection to prevent the user to post the same entry
several times (a new account move is created every time it is clicked).
We fix the JS widget, but we add an extra layer of protection at the
Python level.
opw-778756
Before this commit, when trying to access website_public_price from the backend (when adding this field to a view for example), a traceback saying that the website attribute on the request object was non existent was raised.
After this commit, we control for this and the field displays correctly
OPW 778586
closes#20536
Christophe Simonis