As discussed on issue #15225, it should be possible for system administrators
to disable the 1-click installation system.
The plan is to disable the feature by default, but make it relatively easy
to turn on when it is explicitly desired.
1. At the moment we cannot guarantee that all Apps published on the Odoo Apps
Store are safe. And it is a security risk to let end-users deploy Python
code on their Odoo servers without requiring any review/deployment by a
competent system administrator.
We will work on improving the validation process of the Store, but this
will require time, and won't probably be a 100% safe process in any case.
2. The one-click install feature is however really useful to help
non-technical users install Apps, as long as the feature has been
explicitly allowed by the system administrator. This is a common feature
in other software suites as well. So we'd like to keep it as an opt-in
feature.
3. Administrators of multi-tenant servers, cloud hosting services, etc.
understandably expect to be able to turn off the feature for
security/control reasons.
4. By turning off the feature by default, but still exposing it in the UI,
we keep it *discoverable* for users. The error message should be
helpful to direct users to their sysadmins.
5. By using the permissions of the download folder as a flag for turning
off the feature, we avoid introducing an extra server parameter.
The folder is still created (read-only) by default, for the sole purpose
of making it easier to locate.
Fixes#15225
As discussed on issue #15225, it should be possible for system administrators
to disable the 1-click installation system.
The plan is to disable the feature by default, but make it relatively easy
to turn on when it is explicitly desired.
1. At the moment we cannot guarantee that all Apps published on the Odoo Apps
Store are safe. And it is a security risk to let end-users deploy Python
code on their Odoo servers without requiring any review/deployment by a
competent system administrator.
We will work on improving the validation process of the Store, but this
will require time, and won't probably be a 100% safe process in any case.
2. The one-click install feature is however really useful to help
non-technical users install Apps, as long as the feature has been
explicitly allowed by the system administrator. This is a common feature
in other software suites as well. So we'd like to keep it as an opt-in
feature.
3. Administrators of multi-tenant servers, cloud hosting services, etc.
understandably expect to be able to turn off the feature for
security/control reasons.
4. By turning off the feature by default, but still exposing it in the UI,
we keep it *discoverable* for users. The error message should be
helpful to direct users to their sysadmins.
5. By using the permissions of the download folder as a flag for turning
off the feature, we avoid introducing an extra server parameter.
The folder is still created (read-only) by default, for the sole purpose
of making it easier to locate.
Fixes#15225
As discussed on issue #15225, it should be possible for system administrators
to disable the 1-click installation system.
The plan is to disable the feature by default, but make it relatively easy
to turn on when it is explicitly desired.
1. At the moment we cannot guarantee that all Apps published on the Odoo Apps
Store are safe. And it is a security risk to let end-users deploy Python
code on their Odoo servers without requiring any review/deployment by a
competent system administrator.
We will work on improving the validation process of the Store, but this
will require time, and won't probably be a 100% safe process in any case.
2. The one-click install feature is however really useful to help
non-technical users install Apps, as long as the feature has been
explicitly allowed by the system administrator. This is a common feature
in other software suites as well. So we'd like to keep it as an opt-in
feature.
3. Administrators of multi-tenant servers, cloud hosting services, etc.
understandably expect to be able to turn off the feature for
security/control reasons.
4. By turning off the feature by default, but still exposing it in the UI,
we keep it *discoverable* for users. The error message should be
helpful to direct users to their sysadmins.
5. By using the permissions of the download folder as a flag for turning
off the feature, we avoid introducing an extra server parameter.
The folder is still created (read-only) by default, for the sole purpose
of making it easier to locate.
Fixes#15225
Before this commit, a user that is logged in with a partner of type contact,
was inheriting the address from the parent and didn't have the right to edit
the billing address... stopping the checkout in the middle.
With this commit, we change type of contact if needed to allow the user to
finish the checkout.
ps: Use of write instead of update to make the update in one step, else the
values updated before the field 'type' are ignored because the field is resync
from parent automatically.
This commit is related to: opw-705974 and opw-704653
In some instances we could get a traceback in the form view of an
account.invoice.line object. This is because the `parent` field can be
undefined depending of the way the form view was opened.
For example there can be a account.invoice.line list in a
sale.order.line form and this lead to a product_id with a traceback
capable context.
There are some problems in the way the picking compute its state
according to its move lives if the delivery strategy is partial.
When a picking was in a partially available state and then you would
force availability, the state would stay in partial availability.
Therefore, we changed the way the state is calculated more like it was done before.
This issue stems from the new API migration.
The bank account didn't appear when selecting SEPA credit transfer in ACCOUNTING>PURCHASE>PAYMENTS
to refund an employee. The bank account is taken from partner set with the field home_address_id.
So the account holder have to be set on the bank_account_id of the employee with the home_address_id.
opw:702881
The reverse field of a one2many could be originating from an
inherits'd field, this was solved in some instance with f5e5bbda.
The issue could still happen in some instances when doing a comparison
of:
- the one2many field to a False value,
- the one2many with a negative operator and an empty set to negate,
With this change, the ORM is used in such a situation.
closes#15234
opw-704962
The display label (e.g. "Legal leaves (5 remaining out of 20)") was not
translatable.
Add the 'remaining out of' as translatable.
Replaces and closes#15212
The payment reference of a S2S transaction has the given format:
'PAYMENT-9-170110_200204'. However, the reference is too long for some
providers such as Authorize (limited to 20 characters).
We make the reference less verbose as a first step to solve the issue.
However, case-by-case solutions will need to be found since the
reference depends on the id, which will ultimately grow.
opw-704615
In the loop `for action in self`, if all iterations
passed in the first `if` block only, res
was never assigned, but returned.
This is an oversight during the conversion of the module to the new API
in revision eb04aa1e39
One could ask himself why `res = False` is before the loop
and not in this `if` block, but we believe this is
in the case multiple actions are passed to this method,
you wouldn't like the result of the first actions in the loop
to be overwritten by `False` when the condition of the last
action of the loop is not met.
For instance the first action returns as result an action but for the
second, the condition to run it is not met, in such a case
you would like what the first action returned as action.
opw-706150
The test wizard will be dropped eventually but it is not possible to delete
the mass-mailing before the transient is cleaned too due to the required field.
To make it faster, add a ondelete cascade on the field.
Closes#15217
Rev. 36f6f26 changed the format of the returned list of employees.
Javascript is expecting an array containing the array of employees,
each employee being a dict with keys id, name, email. But from rev.
36f6f26, it returned an array of employees, themselves represented
by an array containing their id, name and email.
As the format changed, the Javascript mention mechanism never used
the prefetched employees, and always fallbacked on an RPC to fetch
suggestions amongs all partners.
If after inserting a mention (eg: `@Guy`) and we eg. backspace and
change it (eg: to `@GuyFawkes`) the `@Guy` mention will still be
linkified but the partner is not subscribed.
This happened because the linkifying was not requiring a space to follow
the mention, but when getting the used mentions (and commands, ...) in
the message they were required (unless the mention was exactly at the
end of the message).
With this commit, a space is always required after a mention for it to
be working.
opw-705267
If you make an inventory adjustement in mode 'select products manually'
and you add a new line with a product having a different unit of mesure
than the default one, but in the same unit of mesure category than the
default one, the unit of mesure on the line doesn't change because both
are in the same category.
This bug is caused by an 'onchange' which is triggered when the
'product_id' or 'product_uom_id' has been changed. And so we cannot
force to change the value to the product one, because we should still be
able to make an inventory in 'kg', if the unit of mesure is in 'g'.
So to fix this bug, we have set the 'onchange' only on the product_id to
set the unit of mesure set on the product when we create a new line or
change the product of a line. We removed the onchange ont the unit of
mesure, because it was only checking that the unit of mesure is in the
category of the product unit of mesure category, but it's always true
has there is a domain set on the field unit on mesure by the onchange
on product_id
Don't enable evented mode unless gevent is enabled.
Previous code was activating evented mode as soon as gevent is imported which
may happen in different scenario but is not enough to assume the GeventServer
is actually running.
Closes#13463
Since `model` is not a required field, the invalidation may crash when one is
missing.
It should never happen than a mail.message has a res_id but not a model as it
makes no business sence.
However it is possible than a message temporarly misses one of the two, e.g:
```
self.model = False
self.res_id = False
```
will trigger two writes and will crash at the first.
Above code should probably be refactored to have only one write but this commit
fixes a regression introduced at 8f1c2bfc (the above code did not crash).
Closes#15199
template contains the mail template to render and is the result of the call to
`self.env.ref('account.email_template_edi_invoice', False)`
If the template does not exists (deleted), template is `None` and the action
rendering crashes.
While it is not recommended to delete master data, it is still possible to use
custom mail templates.
Closes#15204
When computing the amount tax by group, the taxes which affect base of
subsequent taxes must be taken into account and added to the base amount for
only one product.
opw:703524
The field company_id is not required on the res.partner and is used when the
portal user is created for portal access.
If the partner as no comapny set, the creation crashes (required on the user).
Use system default company, with possibility for overwrite.
Closes#15030
The template example products.xls (used in the import planner) references the
field "Vendors" (seller_ids) but was misspelled "Vendor" (renamed during new API
migration).
The file could no longer be imported.
Fixes#15159
- Log in on the eCommerce
- Add a product in the cart
- Log out
- Log in again
The previous cart is not retrieved, and a new one is created.
opw-704646
With 72dfcae2a we have an envelope icon in the chatter with the
information on the sent mail.
When not displayed, the tooltip is hidden using opacity:0 so if
something is underneath it it becomes unclickable.
This commit makes the tooltip disappear in this instance.
opw-705205
According official country source (BOE) some states changed their denomination
to allocate local language spelling.
https://www.boe.es/diario_boe/txt.php?id=BOE-A-2011-11606
As there's a lot of people that still uses the old one, the best solution is to
include both words in the name of the state, and thus user can search by any of
them.
"Melilla" code is also incorrect according used nomenclature but can not be
modified in stable version.
Futher commit can correct it with a migration script
Closes#15166
Scrollbar appeared in Firefox (at least 50.1.0 and up). Related to
depending on non-standard behavior when setting height on a table. For a
detailed explanation see f0eeed93dc.
In this case we can simply ignore overflow on the main POS window since
the height difference introduced is only a couple of pixels.
The POS uses tables to do some of it's layout. It also sets 'height:
100%' on a lot of these tables in an attempt to restrict their
height. The CSS standard however defines the height property on a table
as follows:
"A value of 'auto' means that the height is the sum of the row heights
plus any cell spacing or borders. Any other value is treated as a
minimum height." [1]
Chrome and Safari seems to handle this height property in a way that it
does in fact restrict height. The behavior of Firefox and Edge however
is more in line with the spec, and in these browsers table height is not
restricted by this property.
Because of this the contact list was not scrolleable in those
browsers. To resolve this we stop relying on non-standard behavior by
displaying the relevant contact list elements as regular block
elements. Additionally, we now have to recompute the height of the
client list whenever we show/hide the client details, something that
wasn't necessary before.
[1] https://www.w3.org/TR/CSS21/tables.html#height-layoutFixes#11020
Olivier Dony