According to the CLA signing instructions, the date of signature must be
expressed in the following form:
> `<date>`: current date in the form `YYYY-MM-DD`
However, the date was wrongly expressed as "9-2-2015". That date not
only was following an incorrect format, but also it was ambiguous,
because it was not clear if the format was following M-D-YYYY or
D-M-YYYY (the latter one being the case).
This fixes the format, so it now fits the required one.
Closes#25665
If a user A deletes the res.users record of user B while B is connected,
the verification of the session token fails with a comparison of a boolean and
bytes values.
While the check should obviously fail, this patch gracefully inform the user B
its session has expired and redirect him to the login page.
Without the patch, the session is never invalidated in the user browser,
redirecting to a forbidden error page as long as the session has not been manually
cleared from the browser.
Fixes#25530Closes#25654Closes#25682
Cherry-Pick of 96f01c08f8
Before this commit, it was not possible to upload again a file on the
browser from the composer, when it was added then removed from the attachments.
When a file is uploaded on the browser, it writes on a special input
some data to identify this file. In order to detect a new upload,
the code listens on the JQuery event `change` on this input. Since the
value of this input was not cleared after an attachment removal, the
user couldn't reupload the same file, because the value of the input
will be unchanged.
This commit solves this issue by clearing the special input when removing
an attachment, so that adding the same file again will trigger a `change`
on this input.
Before this commit, we could not remove an attachment in the composer
by clicking on the white-cross icon that is shown on mouse hover.
This was due to the handler function picking the wrong DOM element
as target for reading on the attachment ID: it should pick the target
of this handler function, and not the specific target below the mouse
on click. For instance, let's consider this HTML snippet for the button:
```
<div class='delete' data-attachment-id=100>
<span class='cross-icon'>X</span>
</div>
```
where the handler function is called when clicking on `div.delete`.
When we click on `span.cross-icon`, it triggers the handler function
of `div.delete`. The MouseEvent object contains the following property
values:
- `target`: the `<span>` element
- `currentTarget`: the `<div>` element
The handler function of `div.delete` deletes an attachment by looking
into the `data-attachment-id` attribute of `div.delete`. It should
always pick `div.delete`, even when the user clicks on `span.cross-icon`.
When merging two or more leads, a traceback was generated when attempting
to merge some selection field, if any.
closes https://github.com/odoo/odoo/issues/25644
opw 1864870
Steps to reproduce the bug:
- A product is configured as a service + invoicing policy as "Timesheet on task" + Create a task in an existing project.
- Create a SO with this product and confirm it.
- Go to the task, and create a timesheet on it, the delivered quantity on the SO is correctly updated.
- Now, go to the Timesheets app and remove the task from the analytic line.
Bug:
The Delivered quantity on the Sale Order was not updated.
PS: The case where so_line is in the values is already taken into account by the overwrite of
function write in addons/sale/models/analytic.py
But as task implies so line (as explained in addons/sale_timesheet/models/account.py in function _timesheet_preprocess),
the delivered qty of a so line must be recomputed when its task is modified.
opw:1864313
If a user A deletes the res.users record of user B while B is connected,
the verification of the session token fails with a comparison of a boolean and
bytes values.
While the check should obviously fail, this patch gracefully inform the user B
its session has expired and redirect him to the login page.
Without the patch, the session is never invalidated in the user browser,
redirecting to a forbidden error page as long as the session has not been manually
cleared from the browser.
Fixes#25530Closes#25654Closes#25682
Two use cases must work:
Should hide payment AND display errors when order contains deliverable product
Should show payment AND not display errors when order contains only services (event tickets)
Linked OPW 1864744
Linked PR v11.0 #25679closes#25692
Have some delivery method that do not apply to the country of the customer
Before this commit, the customer could access the Pay now button and confirm the sale
In v10.0 this was impossible as the retrieval of errors in python wiped out the variables that would
make the xml element of the payment not to render
In v11.0 this has changed in a more modular manner
After this commit, we hide the element in html.
OPW 1864744
Two use cases are dealt with:
Should hide payment AND display errors when order contains deliverable product
Should show payment AND not display errors when order contains only services (event tickets)
Linked v10.0 PR #25692closes#25679
When creating an event using the list view, no value is set in the
fields start and stop.
If selecting all day, we could only change the value of start_date and
stop_date which does not change the value in start or stop.
This makes it impossible to create an event from the list view.
This problem is not present in the calendar view since this view sets a
value in start and stop, and the start and stop are recomputed via the
inverse fields.
Closes#25680
The Work+Sans font of google fonts was hotlinked and available in
reports since saas-14's 3d04e448.
There does not seem to be a reason to do it and:
- hotlinking may add resources usage / processing time,
- server need outside internet access or the font doesn't load,
- it has been reported to cause the header/footer of some pages to
disappear, probably because of a problem with loading the content in
a given delay to render it.
- it was always loaded for report, even if used only once among all the
reports of Odoo
For these reasons, this commit removes the hotlinking of this font.
The ISR report of l10n_ch that used this font will thus fall back on
'Verdana', 'Geneva' then the default sans-serif font which doesn't
seem to be a drawback over 'Work Sans' font.
If at one time we should reintroduce it, it should be contained in the
given report and possibly have the font locally and not externally.
opw-1861368
closes#25683
Before this commit, the widgets of website_gengo were not adapted to the new translate and web editor
After this commit, they are adapted
Although, gengo_sandbox of res.config would need to be redefined as related to company_id.gengo_sandbox. It has been done in saas-11.2
OPW 1862013
closes#25647
The call to /web/session/authenticate should return an empty session_info
in case of wrong login/password.
It was producing a traceback (due to self.ensure_one() and search)
Introduced at d1cd293ece and fdb250942Fixes#24071
Company is in USD
Do an invoice in EUR with a specific rate (and post it)
Do a payment on this invoice with another rate (and post it)
revert the payment's move
Before this commit, the move_lines of the original/reverted move pair were not reconciled
to one another
This could cause problems in some reports (aged reports for example)
After this commit, the lines in the original/revert move pair are reconciled
provided that they *can* be reconciled
Which is either belonging to a reconciliable account, or to an account of type liquidity
OPW 1861273
closes#25592
This is essentially a backport of 7544c22de9
and
4f40c9da7b
Company is in USD
Do an invoice in EUR with a specific rate (and post it)
Do a payment on this invoice with another rate (and post it)
revert the payment's move
Before this commit, the move_lines of the original/reverted move pair were not reconciled
to one another
This could cause problems in some reports (aged reports for example)
After this commit, the lines in the original/revert move pair are reconciled
provided that they *can* be reconciled
Which is either belonging to a reconciliable account, or to an account of type liquidity
OPW 1861273
closes#25600
Open a new session with user A, the cashier is A.
Close the session and post the entries.
The responsible for the session is user A and the salesman on the sale order is A.
Then log in to the database with user B.
Open a new session on the same pos.
Before this commit, the cashier on the second session was A
After this commit, the cashier on the second session is B
OPW 1864207
closes#25628
The computation is badly implemented. Wrong
data struture used at the wrong moment.
This commit fixes it: remaing hour in overview
is SOLD qty - DONE qty (sum of timesheets).
Task #1857652
When using sudo, the administrator is logged as deleting the action.
For audit reason, log the correct user.
To avoid access rights errors, only group system can delete the action.
An ir.attachment record can be served as a request's reponse if:
- a request triggers a 404
- the ir.attachment record has its url field matching the url of
the failed and is of binary type
Following rev[1], portal users have the right to create these kind of
records, and it is a security concern.
This patch restrict the ability to create and write on the ir.attachment
records that may be served through the dispatch's exception mechanism to
settings users.
As the asset bundles files are served through the use of these special
ir.attachment, we make sure to retrieve only ir.attachment records
created by the superuser in the `get_attachment` method.
As website administrators often need to play with these special
ir.attachment, we also let to this group the permission to manage them.
[1] 61065b6d04
Before, the name given to the copy method was always 'the old name (copy)'
(even bypassing what might have been given to the default values dict).
opw 1862214
If the parameter ids is given to the process_mail_queue method, it is supposed
to only process the ids it was given, not all mails.
Commit https://github.com/odoo/odoo/commit/4b122ad41d873febe288ab1f8c6cdc078ca2a479
replaced ids by self.ids, and thus default filter was always applied.
fix suggested by @suganthikarunanithi, Sodexis team
opw 1860484
This reverts commit ef444da57a.
Changing a function signature is not supposed to happen in stable;
we have already received 3 opw's about broken customizations or
modules that extend the stock because code such as:
res = self.do_next_transfer()
if not res:
<bla bla>
stops without any warning.
Before, the name given to the copy method was always 'the old name (copy)'
(even bypassing what might have been given to the default values dict).
opw 1862214
In a one2many, if the user clicked the trash button while editing another line,
the row was not unselected.
Thus the modal was not triggered, which entailed that the currently edited line
was always saved.
In particular, it allowed to give empty values to required fields.
opw 1834346
- Create 2 Companies A & B
- Set User B in Company B
- Record some `mail.activity` for User B on a lead belonging to Company
B.
- With a manager user in Company A, go to Kanban view of leads and
remove filters => all leads, including leads in Company B, are
displayed
An access error occurs.
`read_progress_bar` method, tries to access the field `activity_state`
which is: `states = record.activity_ids.mapped('state')`. The state of
a `mail.activity` is using the tz of the partner. To read the
`activity_state` of a lead, one needs to access
`record.activity_ids.user_id.partner_id.tz`
=> multi-company security rules raised
opw: 1850984, 1859470
Suppose there is a one2many field embedded in a one2many,
(say we are viewing record A with one2many field B itself with a one2many C).
Furthermore, there is a second page of the one2many field B.
If an onchange is applied on B, then the server replies with a 1 command for all
B records attached to the currently viewed object A.
This includes a list of commands [[5], [4, C_id]*] for each B record,
in particular B records that are on the second page.
Since they are on the second page, they might not have been fetched by the
frontend; in that case the corresponding C_ids are thus unknown.
As a consequence, on save the frontend sends a command 0 to create the records
for all unknown C_ids.
Since it doesn't have any value to give to the 0 command, the row creation
usually crash in the backend.
Another wrong behaviour is fixed at the same time: if the server sends an update
on the list of C ids with 4 commands.
In that case, if the record has not been prefetched, we have no way to know
if the list changed or not.
To solve this, when we receive the 4 commands by the server, we send back 4
commands.
coauthored by @aab-odoo
opw 1835936
Olivier Dony