An ir.attachment record can be served as a request's reponse if:
- a request triggers a 404
- the ir.attachment record has its url field matching the url of
the failed and is of binary type
Following rev[1], portal users have the right to create these kind of
records, and it is a security concern.
This patch restrict the ability to create and write on the ir.attachment
records that may be served through the dispatch's exception mechanism to
settings users.
As the asset bundles files are served through the use of these special
ir.attachment, we make sure to retrieve only ir.attachment records
created by the superuser in the `get_attachment` method.
As website administrators often need to play with these special
ir.attachment, we also let to this group the permission to manage them.
[1] 61065b6d04
Make sure building reports using local resources are disabled.
This avoids get different report result based on the system if the
given resources are or not present (e.g. custom style)
Before this commit, the discount on a so line was always brought to zero when changing the price
After this commit, we do this only when the pricelist is supposed to compute the discount
OPW 1867262
closes#25851
The POS uses a DomCache for various UI elements to avoid re-rendering
elements that are the same as the last render. One such cached UI
element is an entry in the client list.
When a partner is edited in the POS frontend the POS will write this
to the backend and then it will load all updated res.partner
records (new write_date > previously loaded most recent write_date).
To render the newly updated information *and* to ensure any other
partner edited (through backend or because it's a child contact) is
updated just clear the whole cache.
Fixes#13856
Open the web/database/manager and create a db with a country set.
The country of the first company will be set to the country set on the form
Before this commit, the currency was not set, eventhough it is a field
on res.country
After this commit, we also set the currency of the first company
opw 1869435
closes#26097
Create an asset and confirm it.
Click on Sell or Dispose
The form view of the disposal move opens
With the breadcrums, back to the asset
Click again on sell or dispose
Before this commit, literally nothing happens
This is because there is no more business to do
After this commit, in the case there is no business to do
we fallback onto the smartbutton's action
OPW 1864318
closes#26086
Before this commit, the function that computes the aged partner balance
could return a list instead of a dict if no partner were found
After this commit, we make the function's signature consistent
closes#26095
Before this commit, saving a file being watched by watchdog
(--dev=reload) with vim (and possibly other text editors) would
crash the server via a KeyboardInterrupt error.
This happens because vim, emacs cause multiple filesystem events to
happen when saving a single file, the FSWatcher registers these events
as multiple SIGHUPs which in turn calls restart() multiple times in a
very small amount of time which makes the KeyboardInterrupts completely
shut down the server
This is fixed by only calling restart() if odoo.phoenix is False, since
catching a SIGHUP sets it to true.
Fixes#21178
Special thanks to @odony for the help :)
Avoid sharing of users'groups when writing on multiple users.
When changing groups of multiple users, all implied groups were shared
between written users.
Oversight of new-api rewrite.
Fixes#26036
With 60300fc, people can use promo code on website.
But the condition leads to a side effect, if a partner has a pricelist set for
him, he will never be able to see the dropdown list of pricelist since he will
enter the else condition with show_visible set to true.
Now, user is able to see selectable pricelists.
opw-1869371
In 75d3121c9 the bad rating was change from 0 to 1.
This commit update the javascript feedback part so the behavior is the
one expected.
related to opw-1863312
closes#26043
The functionality to add an event on outlook through a link seems gone on Microsoft's part
Or doesn't work as it did before
To avoid confusion, we remove the links
OPW 1865938
closes#25968
Do not reload when a temporary Python file is
added/updated/reloaded.
This is to be able to use editors using isolation when saving file.
On save, they create a temporary file which is then moved on the target file.
The temporary file exists for milliseconds only,
and when the change was detected by watchdog and the server was reloaded,
the file already no longer existed on load.
It leaded to `No such file or directory` after the reload.
Connect as portal, go to my account > invoices and click pay now
select wire transfer as the acquirer and then pay now
Before this commit, the messages displayed to the user was misleading and wrong
After this commit, we take the relevant acquirer's message
OPW 1867670
closes#17508closes#25946
When creating a job position from the frontend, and we:
- are on the same language that the default website language,
- have the permission to write on ir.ui.view,
we have all conditions to adding branding used to edit a page.
But when creating a position by the frontend, we create a job that will
render this template:
website_hr_recruitment.default_website_description
When we are in the above said condition, we will create a job position
that erroneously has the branding that should only be displayed on
website and removed when saving an edition.
This caused a lot of problem with the editor that would most often not
be able to edit the content.
In this commit, we use the "rendering_bundle" context key to prevent
branding.
opw-1868879
closes#25963
On mobile, some barcodes didn't trigger in the picking screens, notably
O-BTN.validate. This is due to the use of parent() to check if the
button is in a dropdown, as parent() only checks one DOM-level upwards.
The button being inside a <ul><li>, we need to check more levels than
one to pass the condition and trigger the button press.
By changing parent() to parents(), the entire chain will be checked, not
just one level, and the button press is correctly triggered.
opw-1860964
closes#25941
Have a product with a partner A as a seller, without any description whatsoever
Do a vendor bill with partner A as the partner.
Add the product onto the lines
Before this commit, the description on the line was "False"
After this commit, we fallback onto the product name if no other reference is set
OPW 1865969
closes#25857
When editing his post, a user can modify the tags even if he doesn't have
sufficient karma to do so.
Since the backend raises an error, it sends the user to a 403 forbidden page.
opw 1866019
When checking if tags had changed, a missing .ids made it that a recordset was
compared to a set of ids (integers).
As a result, to make an edit the forum would always check that the user had
sufficent karma to retag, even if it was not needed.
opw 1866019
Before this commit, the test aged report crashed on date Year/07/16 (and probably after, too) because:
- we create a partial reconcile today (create_date = Year/07/16) when making the payment to the invoice
- the report date is set as Year/07/15, so, the partial reconciliation, if tested after that date, always appears in another period,
which is not the use case we test, hence the crash of the test
After this commit, we force the create date of the partial reconciliation to *before* the report is called,
thus, no error occurs
closes#25785
On a database where many modules are installed (e.g. runbot all), with
the option "manage available packaging options per products", doing a groupby
"product" on the "package type" list view triggers a js error.
It comes from the fact that the fixed_group variable contains a "length"
attribute; the _().each function uses this to determine (erroneously)
that the object is an array.
It thus uses fixed_group[0] to get an undefined, and then tries to access
a method of undefined.
We replace the each by a simple js loop.
opw 1863576
Set the rounding method to Round Globally
Create a tax A with rate = 1.1040 %
Create a bank statement with one line having amount = 1153.960
Go on to reconcile that bank statement
Reconcile with a new line on which the tax A applies
Create the write-off
Click on Reconcile
Before this commit, an error was thrown by the server (Move unbalanced)
This was because the amount of the write-off line sent by JS (which is the tax amount)
was 12.7397
The server though computes the taxes by forcing the rounding and gives off a tax amount of 12.74
Hence the error
After this commit, the JS will fetch the amount of the taxes by forcing the rounding there also
And the reconciliation process goes well
This fix is already present in v11.0 at 6fce298d70
OPW 1859939
closes#25733
Steps to reproduce the bug:
- configuration on sale:
- Unit of measure: Some products may be sold/purchased in different units of measure (Advanced)
- Sale Price: Advaced pricing based on formulas (discounts, margins, rounding)
- Discount: Allow discounts on sale order lines
- kg as the Reference UOM for weight
- create an uom 10 kg
- Category: Weight
- Type: Bigger...
- Bigger ratio: 10.0
- create a product P
- Sale price: 100
- Unit of measure: kg
- Purchase UOM: kg
- create a pricelist "My pricelist"
- Discount policy: Show public price & discount to the customer
- Items : All products - 10% discount
- create a SO with "My pricelist"
- create a SO line with P, the unit price is automatically 90 with 10 % of discount
- change the uom of the line with 10kg
Bug:
The unit price of the line didn't change and the discount on the line disappeared.
In function product_uom_change, the uom of the SO line has been set in the context
of the product(like in function product_id_change). So in funciton _get_display_price,
the function _get_real_price_currency must be called with the uom of product in the context.
In this way, the lst_price will be fetch on product with the right uom without any bad conversion
(because uom.id == product_uom with uom from the parameters and product_uom from the context).
But with function get_product_price_rule, no need to call this function with the uom in context as
it is already set in the product(check "if uom_id: ... else ..." in this function).
The same logic has been applied in function _onchange_discount
opw:186385
Display the address of the partner_id when available rather than using the partner id of the movelines. Important when the partner is changed after the movelines are created.
support ticket : 1857582
When merging two or more leads, a traceback was generated when attempting
to merge some selection field, if any.
closes https://github.com/odoo/odoo/issues/25644
opw 1864870
Two use cases must work:
Should hide payment AND display errors when order contains deliverable product
Should show payment AND not display errors when order contains only services (event tickets)
Linked OPW 1864744
Linked PR v11.0 #25679closes#25692
When creating an event using the list view, no value is set in the
fields start and stop.
If selecting all day, we could only change the value of start_date and
stop_date which does not change the value in start or stop.
This makes it impossible to create an event from the list view.
This problem is not present in the calendar view since this view sets a
value in start and stop, and the start and stop are recomputed via the
inverse fields.
Closes#25680
The call to /web/session/authenticate should return an empty session_info
in case of wrong login/password.
It was producing a traceback (due to self.ensure_one() and search)
Introduced at d1cd293ece and fdb250942Fixes#24071
This is essentially a backport of 7544c22de9
and
4f40c9da7b
Company is in USD
Do an invoice in EUR with a specific rate (and post it)
Do a payment on this invoice with another rate (and post it)
revert the payment's move
Before this commit, the move_lines of the original/reverted move pair were not reconciled
to one another
This could cause problems in some reports (aged reports for example)
After this commit, the lines in the original/revert move pair are reconciled
provided that they *can* be reconciled
Which is either belonging to a reconciliable account, or to an account of type liquidity
OPW 1861273
closes#25600
Open a new session with user A, the cashier is A.
Close the session and post the entries.
The responsible for the session is user A and the salesman on the sale order is A.
Then log in to the database with user B.
Open a new session on the same pos.
Before this commit, the cashier on the second session was A
After this commit, the cashier on the second session is B
OPW 1864207
closes#25628
Thibault Delavallée