Daily updates from Odoo
Navigate
Branch
Thursday, January 31, 2019
19 changes
Security fixes and vulnerability patches
Server actions now verify that the user has permission to read the related model before the action runs. This helps prevent unauthorized remote access to data or operations, strengthening access control for business processes.
Original PR description
Description of the issue/feature this PR addresses: To prevent an unallowed rpc access. Check the access of read of the linked model of the server action. @odony -- I confirm I have signed the CLA and read the PR guidelines at www.odoo.com/submit-pr
This change closes gaps that could let unauthorized users retrieve system metadata such as external identifiers or default record information. It strengthens access checks in the core data model so sensitive internal information is only available to permitted users.
Original PR description
Description of the issue/feature this PR addresses: get_external_id is not really protected. Today the id is an integer and when you try to call by xml_rpc you have this error : TypeError: dictionary key must be string. But if one day, xml_rpc allow interger in key, or the id is an a string, anyone can download external id. get_metadata is only protected by the check rules read of res.users. default_get is not protected @odony -- I confirm I have signed the CLA and read the PR guidelines at www.odoo.com/submit-pr
Enhancements to existing features
When records are deleted, their related translations are now removed at the same time. This prevents outdated translation data from accumulating and helps keep the system cleaner and more consistent.
Original PR description
Same logic as for the mail.message or ir.attachment, when a record is deleted, drop the ir.translations linked to it as well. Fixes odoo/odoo#25105
This update adds clearer identifiers to existing creation controls in Sales and Accounting screens. It does not change day-to-day functionality, but makes future customizations easier, safer, and less costly to maintain.
Original PR description
Description of the issue/feature this PR addresses: Easier `xpath` expressions on existing `create` elements Followup of https://github.com/odoo/odoo/pull/30534 Fixes https://github.com/odoo/odoo/pull/30534 Current behavior before PR: There is not a very clean/easy way to `xpath` into one `create` element within a `control` without doing dirty index expressions. Desired behavior after PR is merged: Clean and short `xpath` expressions on these elements -- I confirm I have signed the CLA and read the PR guidelines at www.odoo.com/submit-pr
Survey managers can now better handle people who are invited again, choosing whether to resend the existing invitation or create a new attempt. The update also fixes invitation tracking and adds clearer statistics, making private surveys and certifications easier to manage.
The CRM Reveal information card shown in the chatter has been visually improved to make it cleaner and easier to read. This helps users review CRM reveal details more comfortably within their normal workflow.
Original PR description
Task : https://www.odoo.com/web#id=1903882&action=327&model=project.task&view_type=form&menu_id=4720 Pad : https://pad.odoo.com/p/r.6efbd202a2e66adad9b70aa57f1813cb Current behavior before PR: https://www.awesomescreenshot.com/image/3687838/44404126b878c1b20a4fc3e6cd5efbb7 Desired behavior after PR is merged: https://www.awesomescreenshot.com/image/3782007/b5ca1b915ac494e006766f0e27546bf5 -- I confirm I have signed the CLA and read the PR guidelines at www.odoo.com/submit-pr
Odoo now records which reconciliation rules created journal entries during bank reconciliation. This makes it easier for finance teams to review reconciliation activity and troubleshoot mismatches between bank statement items and journal items.
Original PR description
Description of the issue/feature this PR addresses: Keep track of journal entries generated using the reconciliation model. Current behavior before PR: There is no easy way to see a summary of what journal items have been reconciled with a bank statement. This makes troubleshooting difficult. Desired behavior after PR is merged: There should be a way to see the detailed history of which bank statement items were reconciled with which journal items. -- I confirm I have signed the CLA and read the PR guidelines at www.odoo.com/submit-pr
Customers who sign a sales document in the portal are now immediately shown the payment window when online payment is required. This reduces confusion and helps prevent orders from being signed but left unpaid.
Original PR description
**Description of the issue/feature this PR addresses**: To make payment window pop up right after successful submission of signature. - related task: https://www.odoo.com/mail/view?res_id=1910532&access_token=c8dcd24e-1ad9-4215-ba58-4d6df8354989&model=project.task - pad: https://pad.odoo.com/p/r.b0c78ab903858afec275f564673968aa **Current behavior before PR:** It just reloads page after successful submission of signature. **Desired behavior after PR is merged:** It'll open dialog box for payment right after successful submission of signature if online payment has been selected. -- I confirm I have signed the CLA and read the PR guidelines at www.odoo.com/submit-pr
This update corrects demo data in the base module so sample user records are more accurate. It helps keep demonstration and testing environments consistent with expected Odoo behavior.
Original PR description
Description of the issue/feature this PR addresses: Current behavior before PR: Desired behavior after PR is merged: -- I confirm I have signed the CLA and read the PR guidelines at www.odoo.com/submit-pr
Contact records now keep a history when the assigned salesperson changes. This helps teams review ownership changes over time and improves accountability in customer relationship management.
Original PR description
This commit is related to task ID : 1911137 task : https://www.odoo.com/web#id=1911137&action=327&model=project.task&view_type=form&menu_id=4720 Pad : https://pad.odoo.com/p/r.2e64498244c84f254eb4fd6b000dfe54 -- I confirm I have signed the CLA and read the PR guidelines at www.odoo.com/submit-pr
A new button on the partner form lets users quickly open the document kanban view filtered to documents linked to that partner. This makes it easier for teams to find and manage customer or vendor documents without manually searching.
Original PR description
adds a smart button to the partner's form that opens the documents kanban view for all the documents where this partner is the partner_id. task: #1934284
The Documents app now labels sharing buttons and names the related popup more clearly. This helps users distinguish between the available sharing options and reduces the chance of choosing the wrong one.
Original PR description
This commit adds button titles and a popup name to make it more easy to distinguish between the two different ways of sharing documents.
Resolved issues and error corrections
This fixes a problem where broken image fields could keep retrying in the background even after a screen was closed. The change reduces unnecessary CPU and memory use, helping prevent slowdowns or crashes during testing and similar image-error cases.
Original PR description
During the unit tests, I have noticed that the test window was doing a lot of work after the test were completed, it was using CPU and using RAM in jigsaw pattern. Eventually after being left alone…
During the unit tests, I have noticed that the test window was doing a lot of work after the test were completed, it was using CPU and using RAM in jigsaw pattern. Eventually after being left alone for a few hours, the window would just crash. This was due to an unlimitted chain of deferred running when an image field had a load error. The situation is as such: ``` 1. The image is put in the DOM with an onError handler 2. There is an error, as the image is a dummy text for the tests 3. The onError is called, it clears the image field, then calls _render 4. _render re-adds an image with the same onError handler <---------- 5. The onError is called - again - it clears the image field - again | (wich does nothing this time because the value is the same) - | then calls _render - again | 6. The second time _render is called, go to step 4 -------------------- ``` ... In the meantime, the widget has been destroyed by the test, so it should not do anything anymore. This fix breaks the loop, as well as bind the onError handled with 'one' instead of 'on'. Description of the issue/feature this PR addresses: Current behavior before PR: Desired behavior after PR is merged: -- I confirm I have signed the CLA and read the PR guidelines at www.odoo.com/submit-pr
This fixes an issue in the Point of Sale where keyboard handling could remain active after leaving the product screen. It helps prevent unintended actions from key presses and makes the checkout experience more reliable for staff.
Original PR description
Issue: https://www.odoo.com/web#id=1934670&model=project.task&view_type=form&menu_id= -- I confirm I have signed the CLA and read the PR guidelines at www.odoo.com/submit-pr
This update fixes issues in the call for tender process, especially when purchases are triggered automatically from make-to-order needs. It helps ensure tender-related purchase workflows behave correctly and reduces errors during procurement.
Original PR description
Description of the issue/feature this PR addresses: Current behavior before PR: Desired behavior after PR is merged: -- I confirm I have signed the CLA and read the PR guidelines at www.odoo.com/submit-pr
Pivot reports now include selected calculated measures even when those fields are not stored in the database. This helps users see the reporting data they configured instead of missing measures in analysis views.
Original PR description
Description of the issue/feature this PR addresses: When a measure field is defined in the arch but for a compute field not stored, the field was not added to the list of measures -- I confirm I have signed the CLA and read the PR guidelines at www.odoo.com/submit-pr
This update prevents users from being automatically subscribed to website course channels in situations that could trigger unwanted emails or spam. It also fixes a crash when creating a new slide and adds tests to help keep these course publishing workflows stable.
Code cleanup and technical improvements
This change combines two overlapping website components into one, reducing duplicated internal code after the newer editor made one component obsolete. It should make future website improvements easier to maintain without changing the visible website experience for users.
Original PR description
Following the new editor's merge at https://github.com/odoo/odoo/pull/29775, 'web_editor.BodyManager' stopped being used by the editor and the related file was moved to website without being renamed or considered. Hopefully, the editor replaced it by something else so the `BodyManager` makes no sense on its own anymore. This commit merges its features with the only other component which still used it: `WebsiteRoot` See upcoming improvements at https://github.com/odoo/odoo/pull/29442 (related to task-1932066)
Documentation and clarification updates
This pull request records that contributor zwgshr has signed the required Contributor License Agreement. It supports Odoo's legal compliance process and does not change any product functionality.
Original PR description
[CLA] signature for zwgshr -- I confirm I have signed the CLA and read the PR guidelines at www.odoo.com/submit-pr