Commit Graph
6925 Commits
Author SHA1 Message Date
Raphael Collet fef1ce7eda [IMP] test_new_api: add more tests about _check_company()
The tests did not cover the cases where:
 - the main record has no company;
 - the linked record has no company.

closes odoo/odoo#129044

Signed-off-by: Raphael Collet <rco@odoo.com>
2023-07-20 05:02:58 +02:00
Ipsita Borisagar 8ffca9da77 [IMP] base: add module category for appointment
Purpose is to introduce Appointment as a real app, meaning it now uses its own
module category.

Task-3280730

closes odoo/odoo#128976

Related: odoo/enterprise#43219
Related: odoo/upgrade#4946
Signed-off-by: Thibault Delavallee (tde) <tde@openerp.com>
2023-07-20 03:56:04 +02:00
Julien Carion (juca) 6c412be2ea [IMP] *: coherent hotkey uses
This commit makes hotkey uses more coherent throughout the entire
codebase by setting alt+q as main shortcurt for confirm and default
actions and alt+x for cancel actions.

task-3370463

closes odoo/odoo#127469

Related: odoo/enterprise#43694
Signed-off-by: Mathieu Duckerts-Antoine (dam) <dam@odoo.com>
2023-07-19 18:24:15 +02:00
Xavier Morel f96988cbe5 [IMP] core: improve test request blocker
Better tag selection
====================

The block was originally hooked onto the `external` tag under the
assumption that this was the tag used to allow external requests.

It's not, it's the tag for the "external" test suite, which is only
one of the test suites allowed to perform external calls. Hook again
onto `standard`, this might have some false positives (allow requests
which we'd rather block), but it should have a lot less false
negatives (block requests we want to allow).

Make Overrides Easier
=====================

Currently `_request_handler` raises a regular `ConnectionError`, this
is an issue because it passes some requests through, which could
themselves trigger genuine `ConnectionError`.

When overriding `_request_handler` to implement fallbacks for bespoke
URL mocks, these two cases need to be distinguishable as overrides
likely want to handle blocked requests, not actual failures.

Therefore `_request_handler` should a dedicated exception. This
exception should be a subclass of `ConnectionError`, so that blocked
requests are treated as regular connection failures by normal Odoo
code.

Class-scope
===========

Originally `_request_handler` was scoped on the instance with the idea
that it'd be a `mock` object, which individual tests could
`configure_mock`. This turned out not to work correctly, because
`Mock.side_effect` does not receive a `self`, hence the `Session` was
inaccessible and it was not possible to passthrough local requests.

While I moved to a regular `lambda` (because a direct method didn't
work either), I forgot to remove the `request_mock` attribute, and
didn't think that the block could now be lifted up to the class
scope. Doing this, requests performed during a "standard" test case's
`setUpClass` are now also blocked, which they very much should be.

closes odoo/odoo#128977

Signed-off-by: Xavier Morel (xmo) <xmo@odoo.com>
2023-07-19 13:13:32 +02:00
Pierre Pulinckx (pipu) 8bfa76a842 [REF] *: Unify _t and _lt
The goal of this commit is to prepare ground to remove
lazytranslate function _lt() and keep only _t()
for a better understanding of the use of the translation function.

In this commit,

the translate function _t() has been updated to return the translation
if they are loaded. If not, it throws an error.
the lazytranslate function _lt() returns _t() function.
Corollaries :
Steps in test tours are now a function that returns an array of steps
to avoid any interpolation of _t in this ones before translations has
been loaded.

Example :

registry.category("web_tour.tours").add("example", {
    test: true,
    steps: () => [
        {...},
        {...},
    ],
});

task-3292454

closes odoo/odoo#124157

Related: odoo/enterprise#43153
Signed-off-by: Samuel Degueldre (sad) <sad@odoo.com>
2023-07-19 13:13:16 +02:00
Benoit Socias 567e5b58d5 [IMP] base, tools, web_editor, *: use original image if size increases
*: web_tour, website

When no transformation is applied on an image, changing the quality
sometimes increases its storage size.

This commit makes sure that the original image remains used if only the
image quality is modified and if this makes its storage size bigger.

Fixes #61619
task-2835144

closes odoo/odoo#103398

Signed-off-by: Romain Derie (rde) <rde@odoo.com>
2023-07-19 13:12:51 +02:00
Arnaud Joset c4ed0a8e6c [IMP] Base ir.cron: _trigger should return the ir.cron.trigger records
Before this commit, when a ir.cron was walling _trigger, the ir.cron.trigger
records were not returned. it would prevent to use them later easily without
making a search.

Taskid: 3270442
Part-of: odoo/odoo#118738
2023-07-19 11:39:37 +02:00
Maximilien (malb) bedfa27e3d [IMP] base: Rename states in their mother language in the data.
In Switzerland, states are really important. Each  state has its rules, its
language, its culture, its parliament, etc. It's quite frowned upon to send an
invoice/offer or even to have backend management using German terms when we're
in a very French-speaking state.

So in this PR, we will add states in the missing languages

closes odoo/odoo#128954

Task: 3268058
X-original-commit: f309fd06cd46a767fee742ec9f634b46a2edf70f
Signed-off-by: John Laterre (jol) <jol@odoo.com>
2023-07-19 09:12:42 +02:00
Nicolas Lempereur e0ef9806a6 [FIX] base: invisible groups default on selection group
In 9deb1e6aa902a09c4f invisible duplicate were added for boolean groups.

But the added test could fail on master when installing only base
module: in this case, there is only the group "base.group_allow_export"
that is shown as a selection group because it is the only field of its
category. When we install other module, the field become a boolean group
that is handled by the aboved mentionned commit.

The previous fix and test didn't take this case into account, with
customization this could be a real issue.

With this commit, hidden selection field are also handled and the test
test_reified_groups pass in master when installing only base.

related to #120310

closes odoo/odoo#128944

X-original-commit: b22fc41d63bded2435cd330517d407abab5035ee
Signed-off-by: Nicolas Lempereur (nle) <nle@odoo.com>
2023-07-18 21:48:30 +02:00
Xavier-Do 54af24356a [IMP] registry: less invalidation log
The number of invalidation during the test is quite large and
the crons cal also spam this log sometimes.

Waiting for further cleanup, removing this log to avoid spaming runbot
logs and making them harder to read.

closes odoo/odoo#128921

Signed-off-by: Xavier Dollé (xdo) <xdo@odoo.com>
2023-07-18 20:35:45 +02:00
Raphael Collet 96a98f4f4c [FIX] web: web_read() on new records with _inherits
This commit partly reverts 59afbf6686 and
provides an alternative solution.  In this solution, records.web_read()
returns a list of dicts where the key 'id' corresponds to each record.id
in records, which enables to reliably relate each record to its values.

This also fixes the implementation of web_read() on new records where
the fields contain a reference field with some context.

closes odoo/odoo#128878

Signed-off-by: Raphael Collet <rco@odoo.com>
2023-07-18 19:28:13 +02:00
Moises Lopez - https://www.vauxoo.com/ f8bbec56f2 [REF] core: Improve the message for invalid manifest version
Considering the valid odoo version in the manifest version

The message before of this commit was:

    Modules should have a version in format ``x.y`` or ``x.y.z``

It looks like it enforces to removing the odoo version part as invalid

But it is not, in fact, it is already supported

It is important since OCA enforces ``{odoo.version}.x.y.z`` format

It was already discussed here:
 - https://github.com/odoo/odoo/pull/118420#issuecomment-1635047100

The message after this commit is:

    Modules should have a version in format `x.y`, `x.y.z`, `16.4.x.y` or `16.4.x.y.z`.

Notice the Odoo version "16.4" is the current {odoo.version} for the moment this commit was done

It avoid confusing about the valid formats to use

closes odoo/odoo#128810

Signed-off-by: Christophe Simonis (chs) <chs@odoo.com>
2023-07-18 19:28:11 +02:00
Thomas (thbe) 82985296e1 [ADD] base: Revoke access to your account to all devices
Prior to this, there was no way to shut an active session you didn't have the
access to anymore or close every active session remotely.

Adding the RevokeAllDevices class, it is now possible to close every open
sessions, including the one you are performing the action on of the account
you are logged into via the Account Security page in the preferences.

This system is based on the principle that every open session uses the password
hash to maintain it. When the hash is computed, salt is added to it to make it
not reversible. Thanks to that salt, it is possible to change the user's
password's hash without changing the password. Therefore, the flow of this
addition is the following :
1. User clicks on the button and uses his passord to confirm identity.
2. User's input is used to check his identity (_check_credentials()).
3. User's input is used to refresh the password hash in the db (_change_password()).
4. User is logged out.

This adds a way to close all sessions remotely and improve user's control over
their account and therefore their security.

task-3191567

closes odoo/odoo#113899

Related: odoo/upgrade#4951
Signed-off-by: Martin Trigaux (mat) <mat@odoo.com>
2023-07-18 19:27:19 +02:00
Xavier-Do 4c9968397b [IMP] base: avoid invalidation on xmlid updates
Splitting the cached revealed a missing cache invaldation.
The cache invalidation added a a query in test_related_fields

The query can be avoid by not updating the xmlid if it is not useful.

closes odoo/odoo#119813

Related: odoo/enterprise#42527
Signed-off-by: Xavier Dollé (xdo) <xdo@odoo.com>
2023-07-18 11:42:27 +02:00
Xavier-Do 88786dde49 [IMP] base, website: add an api to populate the cache
Part-of: odoo/odoo#119813
2023-07-18 11:42:26 +02:00
Xavier-Do b373c32c4d [FIX] base: don't invalidate for all company.write
The cron hr_presence will write hr_presence_last_compute_date on company
leading to an invalidation of the cache.

This commit makes the invalidation based on a list of field.

This may break some non tested behaviour, will be a good opportunity to
add test if any bugfixes is linked to this change.

Part-of: odoo/odoo#119813
2023-07-18 11:42:26 +02:00
Xavier-Do 595aa24843 [IMP] registry: multiple ormcache
One of the main issue with ormcache is that the invalidation clears
everything, meaning that some value, slow to compute but with a long
lifetime, can be removed from the cache because an easy to invalidate
value is cleared, like after writting or creating a product has an
example.

Most example in the code will try to invalidate the cache of the models
doing something like `env['ir.qweb'].clear_caches()` but it is
finally equivalent to `env.registry.clear_cache()`, and cross worker.

The idea is to have multiple cache, maybe with specific sizes for a
specific purpose.

Having one per model is maybe a bad idea because it will be difficult
to size the LRU correcly, and it is too dynamic. Checking invalidation
may be expensive.

The proposed solution is closed allow a limited number of named caches,
using onse sequence per cache. This is actually close to the
cache_longterm.

We want to discourage using a specific cache for one use case in
the buisness code. Adding a cache shouldn't be something easy, doable
in stable.

Note that we could also change the invalisation mecanism using an
insert only table. We an check the sequence of this table, but also
fetch all invalidation messages.
Another possible improvement, especially if we have more than x cache is
to have a global sequence, checking signaling would mean to check the
main sequence, and only the other ones if the main one changed.

Note that this poc is inspired from the long term cache but not all
use case where applie yet.

Part-of: odoo/odoo#119813
2023-07-18 11:42:26 +02:00
Xavier-Do dda0f64cf7 [FIX] base: avoid cache_invalidation on settings
A cache invalidation was triggered when displaying the settings page
because of a write on ir.property

    return call_kw(request.env[model], method, args, kwargs)
  File "/home/xdo/osrc/master/odoo/odoo/api.py", line 461, in call_kw
    result = _call_kw_multi(method, model, args, kwargs)
  File "/home/xdo/osrc/master/odoo/odoo/api.py", line 448, in _call_kw_multi
    result = method(recs, *args, **kwargs)
  File "/home/xdo/osrc/master/odoo/odoo/models.py", line 6689, in onchange
    record._onchange_eval(name, field_onchange[name], result)
  File "/home/xdo/osrc/master/odoo/odoo/models.py", line 6403, in _onchange_eval
    res = method(self)
  File "/home/xdo/osrc/master/enterprise/sale_stock_renting/models/res_config_settings.py", line 17, in _onchange_padding_time
    self.env['ir.property']._set_default("preparation_time", "product.template", self.padding_time)
  File "/home/xdo/osrc/master/odoo/odoo/addons/base/models/ir_property.py", line 203, in _set_default
    prop.write({'value': value})

This commit will avoid this by checking the current value.

Part-of: odoo/odoo#119813
2023-07-18 11:42:25 +02:00
uso-odoo 07f04e09f3 [FIX] base: prevent traceback while deleting Portal or Default User Template
When the user deletes the 'Portal User Template'  and when any new portal user
will do signup, then traceback will be generated.

If User deletes the 'Portal User Template', then no new portal user will be
created. Also, new portal user will see the traceback as it is generated in
UI.

Steps To Produce for Portal User Template:-

1) Install the 'auth_signup' module
2) Go to Settings > Users
3) Filter only 'Inactive Users'
4) Delete the 'Portal User Template'
5) Open the Incognito tab and click on 'Don't have an account?'
6) Fill required values and click on the 'Sign Up' button

Traceback will be generated on the portal user side as well as in the
backend (Terminal)

Steps To Produce for Default User Template:-

1) Go to Settings > Users
2) Filter only 'Inactive Users'
3) Delete the 'Default User Template'
4) Try to install 'website' or 'hr_timesheet' module

Traceback will be generated

Applying these changes will resolve this issue.

sentry-4184429514,4274176666,4147914005

closes odoo/odoo#127516

X-original-commit: c3e5bed9307498b435857f7736c20cefde3ed6a7
Signed-off-by: Vranckx Florian (flvr) <flvr@odoo.com>
Signed-off-by: Urvi Soni (uso) <uso@odoo.com>
2023-07-17 18:13:08 +02:00
Xavier Morel 4111f02fb3 [ADD] core: block requests calls during tests
Non-external tests should not be performing requests to external
websites or services.

Add a mock to handle such requests:

- if the test is not tagged external
- and the request is not to localhost
- and the request is not to `file:` (it's possible to install a
  FileAdapter in a session to resolve file URLs)
- raise a connection error (and log, both with some details of the
  blocked request for debugging)

The mock is layered on the lowest possible level (`Session.send`), so
tests can either:

- reconfigure the mock to handle cases differently (the mock is
  re-created on every test)
- layer their own mock at a higher level of the library

Eventually we might also built-in a routing / dispatch mechanism so
it's easier to declare external services you want to mock, somewhat
similar to what's available client-side.

Whitelist `file:` because e.g. zeep performs `file:` request, using a
bespoke adapter installed in its session.

Part-of: odoo/odoo#128497
2023-07-15 12:00:11 +02:00
Benoit Socias 706e696e3d [IMP] base, tools: compute webp image size
This commit introduces the computation of the image size from a webp
binary source without relying on PIL.

This is needed by eCommerce to determine which image to fetch when using
the zoom functionality on the product page.

task-2774352

Part-of: odoo/odoo#85494
2023-07-15 05:10:47 +02:00
Benoit Socias 0ba3617f9d [IMP] base, web_editor: precompute and use resized webp on upload
`libwebp` cannot be used to perform resize operations on webp images on
the server.

This commit uploads all resizes of webp images whenever a webp image is
uploaded:
- resized to any smaller size in 1024, 512, 256 & 128,
- each size converted to jpg as well to be usable in `wkhtmltopdf`.

When an Image field requires `_imageProcessing` to resize a webp image,
it retrieves the pre-resized image instead of running through the
Pillow toolbox.

Pre-converted images are stored as `ir.attachment`s with:
- `res_model` = ir.attachment
- `res_id` = id of transformed attachment
  i.e. id of original size webp for resized images
       id of webp for jpeg-converted images
- `description` = "format: image/jpeg" for jpeg conversions,
                  "resize: [size]" for resized images.

task-2774352

Part-of: odoo/odoo#85494
2023-07-15 05:10:46 +02:00
Benoit Socias 8210bf4f27 [IMP] base, web: use converted WebP images in wkhtmltopdf
Wkhtmltopdf is unable to render WebP images.
This commit intercepts the requests for the image data during PDF
reports rendering to replace them by the converted image that was
uploaded with it.

task-2774352

Part-of: odoo/odoo#85494
2023-07-15 05:10:46 +02:00
Benoit Socias 4095539765 [IMP] base, web: upload a JPEG too when uploading a WEBP in backend
The library used to generate PDFs does not support the WEBP image
format. For those images to be included in reports, they need to be
converted. For security reasons, this conversion cannot be done on the
server, therefore it was decided to keep an already converted copy of
such images.

This commit converts uploaded WEBP images to JPEG and uploads them both
so that the report generation can use the JPEG instead.
This commit also pre-generates the resized version of images - and JPEG
versions of each of them.

task-2774352

Part-of: odoo/odoo#85494
2023-07-15 05:10:46 +02:00
Benoit Socias d1292a96a6 [IMP] base,*: support image/webp image format
*: mail, mrp, test_website, web, web_editor

Before this commit '.webp' images could not be used in odoo.

After this commit '.webp' images can be uploaded to odoo.
- can be used in image field
- can be used in HTML field image
- can be used in mails and website
- can be transformed (shape mask, filter effect, crop, rotate, resize,
  adjust quality)

task-2774352

Part-of: odoo/odoo#85494
2023-07-15 05:10:45 +02:00
niyasraphy 73521a9fbc [FIX] base: invalid format is shown as valid in user error
before this commit, if user imports a non valid file,
in the import translation wizard, the users is notified
about the invalid file format by a user error and in
this message .pot is shown as a valid format.

but the only valid format's are csv and po files.

after this commit, the .pot from the user error is removed.

closes odoo/odoo#128422

Signed-off-by: Martin Trigaux (mat) <mat@odoo.com>
2023-07-13 19:28:29 +02:00
Julien Castiaux c92331aa78 [FIX] core: -i/-u shouldn't be allowed with multiple db
The `-i`/`--init` and `-u`/`--update` cli options behavior is only
defined when using a single database with `-d`/`--database`/`db_name`.

Using those two cli options along with multiple databases is undefined
and can have disastrous consequences[^1].

The server now crashes in this situation.

Fixes: #107188
Fixes: #128273
[^1]: https://github.com/odoo/odoo/issues/107188#issuecomment-1627996425

closes odoo/odoo#128306

Signed-off-by: Julien Castiaux (juc) <juc@odoo.com>
2023-07-13 19:28:12 +02:00
Habib (ayh) a638442a3d [IMP] base: force dialog size of layout configurator
action_base_document_layout_configurator should always have a dialog_size = 'large'
this ensures that the context from a calling function is not applied

closes odoo/odoo#127630

Related: odoo/enterprise#43770
Related: odoo/upgrade#4918
Signed-off-by: Laurent Smet (las) <las@odoo.com>
2023-07-12 16:52:59 +02:00
Martin Trigaux 884a56c239 [FIX] test_access_rights: adapt tests
Make the user be in at least one of the group employee, public or
portal to be more coherent with Odoo

closes odoo/odoo#125216

Related: odoo/enterprise#42628
Signed-off-by: Martin Trigaux (mat) <mat@odoo.com>
2023-07-11 22:33:47 +02:00
Xavier Morel ce1a4a2ee0 [IMP] base: deprecate global rules
ir.model.access rules without group will now log a warning

Part-of: odoo/odoo#125216
2023-07-11 22:33:47 +02:00
Martin Trigaux c68fa610d4 [FIX] *: correctly search record without user
If a user is not present in the request, he is in no group at all and
can not access any model, including the one available for public
users.
Avoid ambiguity by using sudo or add a user specifically.

Part-of: odoo/odoo#125216
2023-07-11 22:33:47 +02:00
Martin Trigaux cd2f330bec [IMP] *: remove glocal ACL
Specify explicit route for each ,, line
This is part of task 3230280 where global ir.model.access will be
forbidden.
The goal is to make access to public/portal explicit. Too often,
global access was granted with only employees in mind.

Remove ,,0,0,0,0 lines

mail:
employee already had read access to mail.group
still needed to subtypes as in ir.rule domain

mail_group: employee already had read access
pos_mercury: only needed for employees

membership:
move public access for website_membership as needed in the controllers

website_customer: employee already had read access

website_event_booth: no need for category
website_event_exhibitor: retrieved in sudo
website_event_track: not needed for location

Part-of: odoo/odoo#125216
2023-07-11 22:33:47 +02:00
Raphael Collet 884522ebd1 [FIX] core: infinite recursion when accessing Html field on new record
closes odoo/odoo#127718

Related: odoo/enterprise#43815
Signed-off-by: Raphael Collet <rco@odoo.com>
2023-07-10 18:16:19 +02:00
Raphael Collet 59afbf6686 [FIX] web: web_read() on new records with _inherits
Part-of: odoo/odoo#127718
2023-07-10 18:16:19 +02:00
Raphael Collet b3e8560c9c [FIX] tests: make first call to onchange2() return complete x2many value
The use-case is a first call to onchange2() where:
 - a one2many field has a default value with a new line
 - some onchange method discards that line

The diff should not return a "delete" command for the discarded line,
since the client does not know about it.  Instead, for that first call,
it should behave like if the initial value of the field was empty.

Part-of: odoo/odoo#127718
2023-07-10 18:16:18 +02:00
Denis Ledoux 3d2f76671c [FIX] core: missing escaping in sql constraint name_manual_field
Oversight in revision
8c38baee85

In SQL,
The underscore character ( _ ) represents a single character
to match a pattern from a word or string.

Meaning
`name LIKE 'x_%'`
allows names starting by `x`, and not names starting by `x_` as expected.

Add the escape in the constraint to enforce starting by `x_`
and not just `x`

closes odoo/odoo#127883
2023-07-10 16:59:24 +02:00
Arnaud Baes abbfd74436 [FIX] core: ensure werkzeug request/response json
closes odoo/odoo#33682

Signed-off-by: Pierre Masereel <pim@odoo.com>
2023-05-15 15:25:56 +02:00
Julien (jula) 9bdcb596ce [IMP] tools: make arch diff viewer prettier
When investigating an issue on a customer database, the diff view modal
can be pretty useful. However it is not very good looking and therefore
poorly readable.

This PR improves the CSS styling of that modal so that it resemble more
the diff view of GitHub. This is done by:
- Increasing the width of the modal
- Aligning the text to the top of the table cell, that way there is no
text floating in the middle of two lines
- Lightly coloring the whole line when there is a change on it while the
actual change is on a darker background
- Putting in red all types of change on the left and in green on the
right (instead of mixing green, red and orange together)

This commit is improving the tool that was made at [`96d3fa4`](https://github.com/odoo/odoo/commit/96d3fa4e01bf8afc35dbf0b7301ce75c6bf3a5c7)

closes odoo/odoo#127765

X-original-commit: bf412f6920b10376a979c9f95c4508dedfec5d5f
Signed-off-by: Romain Derie (rde) <rde@odoo.com>
2023-07-07 19:12:42 +02:00
Rémy Voet (ryv)andJulien00859 55c71cb224 [FIX] base: ir.property.search_multi with 'any'/'not any' operators
Install POS, go in the settings, add a new cash routing method.
Traceback, the field as no comodel.

The ir.property `search_multi` method wasn't compatible with the
'any'/'not any' operator.

opw-3375624

closes odoo/odoo#127750

X-original-commit: 7dd14eb0b0edb57150288361e72e407e05e67a73
Signed-off-by: Raphael Collet <rco@odoo.com>
Signed-off-by: Rémy Voet (ryv) <ryv@odoo.com>
Co-authored-by: Julien00859 <juc@odoo.com>
2023-07-07 16:42:45 +02:00
Rémy Voet (ryv) 22a0c7f9ee [FIX] core: filtered_domain with 'any'/'not any'
`filtered_domain` didn't throw an exception when it is called with a
domain containing the new 'any' and 'not any' operators. Fix it.

X-original-commit: 05713a270bfad406daa9dbf739b80cf8c4d065c0
Part-of: odoo/odoo#127750
2023-07-07 16:42:45 +02:00
Rémy Voet (ryv) 78165067a6 [FIX] core: fix semantic of 'not any' operator with many2one field.
Since 5a998694a6,
`[('<many2one>', 'not any', [<domain>])]` matches rows where the
<many2one> is set and the corresponding many2one row matches the
<domain>. This is incorrect. 'not any' should be the inverse of
the 'any' operator and domains such as
`['!', ('partner_id.name', '=', 'System')]` are incorrectly converted
to "Return every record with a partner name != 'System'"
when it should be "Return every record with a partner name != 'System'
OR without partner at all".

Fix semantic and add tests to avoid any future regressions.

X-original-commit: c8c1ef45f24482e380529daf2de55b9091338a83
Part-of: odoo/odoo#127750
2023-07-07 16:42:44 +02:00
Denis Ledoux 8c38baee85 [IMP] core: enforce custom fields to starts with x_
The `api.constrains` `_check_name` on `ir.model.fields`
ensures users do not create custom fields not starting with `x_`.
It offers a user-friendly message when users try to do that.

However, this `api.constrains` can be bypassed,
for instance when updating the field name through raw SQL.

This revision aims to no longer load custom fields
if they do not starts with `x_`.

In addition, it replaces the Python constraint
with an SQL constraint in order to have a stronger constraint.
Following bugs or unexpected flows, people
were able to add custom fields not starting with `x_`
with the `api.constrains` alone.
Adding the SQL constraint will tighten the constraint.

However, even without that SQL constraint,
for instance if users drop the SQL constraint manually,
custom field not starting by `x_` must not be loaded.
A user would be able to drop that constraint
through a SQL shell or a `cr.execute` in a server action.

This is to prevent users to override class attributes.

closes odoo/odoo#127702

Related: odoo/upgrade#4908
2023-07-07 12:10:05 +02:00
Chong Wang (cwg) 967f6b6121 [FIX] website: fix to_translate tag
Before the task
when the default language for a website is not en_US, and users try to
edit_translations from the website, all terms are marked "translated"
because odoo adds
`data-oe-translation-state="to translate"` if the term is not extracted from
the en_US value and is the same as its en_US term

After this commit:
if the record's bounded website's default language is lang_base
odoo adds
`data-oe-translation-state="to translate"` if the term is not extracted from
the lang_base value and is the same as its lang_base term

closes odoo/odoo#127468

Task-id: 3344973
X-original-commit: 7c20510bda2f1312a9392df445ee38aea7b2267b
Signed-off-by: Julien Castiaux (juc) <juc@odoo.com>
Signed-off-by: Chong Wang (cwg) <cwg@odoo.com>
2023-07-07 12:09:54 +02:00
Julien Castiaux cc6b60f72f [IMP] web: default robots.txt
Web lacked a default route for /robots.txt meaning that if you didn't
installed website (which comes with a full fledged robots.txt) you would
get a 404 page not found.

closes odoo/odoo#127402

Signed-off-by: Julien Castiaux (juc) <juc@odoo.com>
2023-07-07 06:15:46 +02:00
Elisabeth Dickinson f590fcb7d1 [FIX] base, web, survey: fix spacings between buttons
Some buttons were stuck together or some had too much of a gap between
them, this commit aims to harmonize the space between buttons.

task-3378519
part of task-3326263

X-original-commit: 68d16f5b2131f44b2dfc3a5d6756aea8987b3fd5
Part-of: odoo/odoo#127613
2023-07-06 20:55:58 +02:00
Raphael Collet f7cbaca473 [FIX] base, account: avoid messing up with implementation of Form
Part-of: odoo/odoo#127400
2023-07-05 18:46:50 +02:00
Raphael Collet b33452cd57 [IMP] tests: simplify implementation of Form
- simplify initialization of form._values (don't fill in with False)
- use UpdateDict for form._values (more consistent with x2many values)
- better/simpler API for getting save/onchange/all values
- don't reparse subview in O2MForm (already done by toplevel Form)
- guarantee that one2many fields always have an edition view
- add assignment on many2many fields
- add __getitem__/__setitem__ to access/assign fields with dynamic name

Part-of: odoo/odoo#127400
2023-07-05 18:46:49 +02:00
Yannick Tivisse b1f7e56f79 [IMP] base: Remove private res.partner type
- Improve performances, as the ir.rule restricting private partners
  visibility is also applied on res.users by inheritance, on each
  prefetch.
- Solve the issue of partners set as followers on records (eg: application
  form) and then made private, making them impossible to contact via the
  chatter.
- Solve the multiple access issues when trying to access the bank
  account, or the private address for non HR people like the accountants
  forcing the usage of sudo in the business code.

TaskID: 3101400
2023-07-05 14:21:28 +02:00
Valeriya(vchu) c360a6e047 [IMP] base, payment: prevent changing currencies' rounding precision
- discourage users from changing the currency's rounding precision by
  making it editable only before the currency is saved;
- remove the hard-coded dict of minor units that util functions rely on.

task-3076355

closes odoo/odoo#119308

Signed-off-by: Antoine Vandevenne (anv) <anv@odoo.com>
2023-07-04 11:35:00 +02:00
Mohit Beniwal e7fd1d43ba [FIX] base: prevent json decoder error for default values
JSONDecoderError occurs when users enters invalid JSON format data in
'Default Value' field inside 'User-defined Defaults' and wherever this field is
being accessed to get default value this traceback will be generated.

Steps to reproduce:
1) Install 'Contacts' module.
2) Open 'Settings' > 'Technical' > 'User-defined Defaults'.
3) Click on record 'Language' > 'EDIT' button > in 'Default Value' field enter
   any improper JSON format data (e.g 'Maa' : FI ) .
4) Now, open 'Contacts' module > click on 'CREATE' button and traceback would be
   generated.

By applying this, it will check for proper JSON format.

Sentry-4169062951

closes odoo/odoo#126932

X-original-commit: 71b32d9ea892c8a79c8eac51b9f394c92c44f45d
Signed-off-by: Rémy Voet (ryv) <ryv@odoo.com>
2023-07-04 09:04:44 +02:00