The token field is a technical data that the other users are not able to use.
It may be confusing for users to see token on the user interface.
Still show it to administrator for debug reasons.
The dateutil package uses lazy import to selectively expose its
features: `parser`, `relativedelta`, `rrule`, `tz`.
Depending on installed modules and order of initialization, there was no
guarantee that a given feature was already loaded during the preparation
of the action context.
This patch ensures that we always preload the feature set we need, and
only that feature set. This way we have a consistent `dateutil` lib in
the action context at all times.
When using sudo, the administrator is logged as deleting the action.
For audit reason, log the correct user.
To avoid access rights errors, only group system can delete the action.
An ir.attachment record can be served as a request's reponse if:
- a request triggers a 404
- the ir.attachment record has its url field matching the url of
the failed and is of binary type
Following rev[1], portal users have the right to create these kind of
records, and it is a security concern.
This patch restrict the ability to create and write on the ir.attachment
records that may be served through the dispatch's exception mechanism to
settings users.
As the asset bundles files are served through the use of these special
ir.attachment, we make sure to retrieve only ir.attachment records
created by the superuser in the `get_attachment` method.
As website administrators often need to play with these special
ir.attachment, we also let to this group the permission to manage them.
[1] 61065b6d04
Make sure building reports using local resources are disabled.
This avoids get different report result based on the system if the
given resources are or not present (e.g. custom style)
Before this commit, the discount on a so line was always brought to zero when changing the price
After this commit, we do this only when the pricelist is supposed to compute the discount
OPW 1867262
closes#25851
The POS uses a DomCache for various UI elements to avoid re-rendering
elements that are the same as the last render. One such cached UI
element is an entry in the client list.
When a partner is edited in the POS frontend the POS will write this
to the backend and then it will load all updated res.partner
records (new write_date > previously loaded most recent write_date).
To render the newly updated information *and* to ensure any other
partner edited (through backend or because it's a child contact) is
updated just clear the whole cache.
Fixes#13856
Open the web/database/manager and create a db with a country set.
The country of the first company will be set to the country set on the form
Before this commit, the currency was not set, eventhough it is a field
on res.country
After this commit, we also set the currency of the first company
opw 1869435
closes#26097
Create an asset and confirm it.
Click on Sell or Dispose
The form view of the disposal move opens
With the breadcrums, back to the asset
Click again on sell or dispose
Before this commit, literally nothing happens
This is because there is no more business to do
After this commit, in the case there is no business to do
we fallback onto the smartbutton's action
OPW 1864318
closes#26086
Before this commit, the function that computes the aged partner balance
could return a list instead of a dict if no partner were found
After this commit, we make the function's signature consistent
closes#26095
Before this commit, saving a file being watched by watchdog
(--dev=reload) with vim (and possibly other text editors) would
crash the server via a KeyboardInterrupt error.
This happens because vim, emacs cause multiple filesystem events to
happen when saving a single file, the FSWatcher registers these events
as multiple SIGHUPs which in turn calls restart() multiple times in a
very small amount of time which makes the KeyboardInterrupts completely
shut down the server
This is fixed by only calling restart() if odoo.phoenix is False, since
catching a SIGHUP sets it to true.
Fixes#21178
Special thanks to @odony for the help :)
Avoid sharing of users'groups when writing on multiple users.
When changing groups of multiple users, all implied groups were shared
between written users.
Oversight of new-api rewrite.
Fixes#26036
With 60300fc, people can use promo code on website.
But the condition leads to a side effect, if a partner has a pricelist set for
him, he will never be able to see the dropdown list of pricelist since he will
enter the else condition with show_visible set to true.
Now, user is able to see selectable pricelists.
opw-1869371
In 75d3121c9 the bad rating was change from 0 to 1.
This commit update the javascript feedback part so the behavior is the
one expected.
related to opw-1863312
closes#26043
The functionality to add an event on outlook through a link seems gone on Microsoft's part
Or doesn't work as it did before
To avoid confusion, we remove the links
OPW 1865938
closes#25968
In af64780a2 an improvement was done so a numerical fields like '-500'
was not breaked up over two lines after the hyphen.
But it seems in a very particular case of printing PDF in a given
combination of condition:
- printing over wkhtmltopdf which itself uses an old version of webkit
- particular font (issue happen with Arial but not "Segoe UI")
- particular version of windows (windows server 2012, not on windows 10)
the - character at the front of a monetary, float or integer field would
be displayed as | erroneously.
The problem is probably that the font system in the old webkit with
given windows will not find the code point in the given font, and
doesn't fallback correctly.
This commit replace using the "NON-BREAKING HYPHEN (U+2011)" by using
the "ZERO WIDTH NO-BREAK SPACE (U+FEFF)" which is an invisible character
with no width that prevent splitting at its location.
As a note, an alternative to this character is "WORD JOINER (U+2060)"
that may be preferred, but it presents exactly the same issue (with
-|500 instead of -{WORD JOINER}500) in the same environment.
mentioned in https://www.odoo.com/forum/1/question/118653
opw-1867842
fixes#17093fixes#25840closes#26019
Do not reload when a temporary Python file is
added/updated/reloaded.
This is to be able to use editors using isolation when saving file.
On save, they create a temporary file which is then moved on the target file.
The temporary file exists for milliseconds only,
and when the change was detected by watchdog and the server was reloaded,
the file already no longer existed on load.
It leaded to `No such file or directory` after the reload.
Connect as portal, go to my account > invoices and click pay now
select wire transfer as the acquirer and then pay now
Before this commit, the messages displayed to the user was misleading and wrong
After this commit, we take the relevant acquirer's message
OPW 1867670
closes#17508closes#25946
When creating a job position from the frontend, and we:
- are on the same language that the default website language,
- have the permission to write on ir.ui.view,
we have all conditions to adding branding used to edit a page.
But when creating a position by the frontend, we create a job that will
render this template:
website_hr_recruitment.default_website_description
When we are in the above said condition, we will create a job position
that erroneously has the branding that should only be displayed on
website and removed when saving an edition.
This caused a lot of problem with the editor that would most often not
be able to edit the content.
In this commit, we use the "rendering_bundle" context key to prevent
branding.
opw-1868879
closes#25963
On mobile, some barcodes didn't trigger in the picking screens, notably
O-BTN.validate. This is due to the use of parent() to check if the
button is in a dropdown, as parent() only checks one DOM-level upwards.
The button being inside a <ul><li>, we need to check more levels than
one to pass the condition and trigger the button press.
By changing parent() to parents(), the entire chain will be checked, not
just one level, and the button press is correctly triggered.
opw-1860964
closes#25941
Rendering in html was correct thanks to the webkit-padding-start 40px added
by the browser. But once printed with wkhtml, the padding was missing.
Now we force the padding manually.
This commit closes#7375
When there is no ACL for a model, the system emits a log with a sample
ACL entry that developers should consider adding. This proposed ACL
should be safe: a default read-only access for internal users
seems appropriate.
Closes#25919
Have a product with a partner A as a seller, without any description whatsoever
Do a vendor bill with partner A as the partner.
Add the product onto the lines
Before this commit, the description on the line was "False"
After this commit, we fallback onto the product name if no other reference is set
OPW 1865969
closes#25857
When editing his post, a user can modify the tags even if he doesn't have
sufficient karma to do so.
Since the backend raises an error, it sends the user to a 403 forbidden page.
opw 1866019
When checking if tags had changed, a missing .ids made it that a recordset was
compared to a set of ids (integers).
As a result, to make an edit the forum would always check that the user had
sufficent karma to retag, even if it was not needed.
opw 1866019
For records having multiple translated terms per field (like html fields),
it was possible to have duplicated entries when synchronizing existing
entries with new ones.
Before this commit, the test aged report crashed on date Year/07/16 (and probably after, too) because:
- we create a partial reconcile today (create_date = Year/07/16) when making the payment to the invoice
- the report date is set as Year/07/15, so, the partial reconciliation, if tested after that date, always appears in another period,
which is not the use case we test, hence the crash of the test
After this commit, we force the create date of the partial reconciliation to *before* the report is called,
thus, no error occurs
closes#25785
Christophe Simonis