Daily updates from Odoo
Navigate
Branch
Wednesday, February 13, 2019
20 changes
Security fixes and vulnerability patches
This update removes places where the user session identifier was exposed to browser-side code, reducing the risk of session theft if a page is compromised. It also modernizes related web communication by replacing older JSONP calls with standard CORS support, improving security and maintainability without changing normal user workflows.
Original PR description
Before this rev. the `session_id` was provided by the server to the webclient (in session_info, mostly) and was stored and accessible. This made XSS injection more dangerous than they should be as it was very easy to steal the `session_id`. As the browser automatically set the `session_id` on every request to the server, the webclient shouldn't need any explicit reference. Since rev. odoo/odoo@f4d541e the `session_id` cookie uses the `httponly` flag so it cannot be accessed through client side script. Task 1905359
New functionality added to Odoo
Adds a left-side search panel to Kanban views so users can narrow records by key categories more quickly. The new filtering experience is applied to Employee cards and Lunch new orders, making everyday browsing and ordering workflows more efficient.
Original PR description
Link to task: https://www.odoo.com/web#id=1892462&action=333&active_id=133&model=project.task&view_type=form&menu_id=4720
Adds a new Forecasted Inventory menu so users can review expected stock levels across all products in one place instead of checking each product individually. The report includes pivot analysis by product and time period, default quantity measures, references, and clickable forecast cells for faster investigation.
Original PR description
Purpose of this task: Show forecasted inventory for all products. Before this commit we have to search forecasted inventory for each product individually. There is no way to check all the forecasted…
Purpose of this task: Show forecasted inventory for all products. Before this commit we have to search forecasted inventory for each product individually. There is no way to check all the forecasted inventory in a single menu. After this commit: User can search for all forecasted inventory from the menu 'Forecasted Inventory'. Features added. 1. Menu for Forecasted Inventory has been added. 2. Pivot view for Forecasted Inventory added. 3. Default measures has been set to 'Quantity' and 'Cumulative Quantity'. 4. Pivot view is grouped by product (vertical) and by days (horizontal). Why query changes required: User can search for all forecasted inventory from the menu 'Forecasted Inventory'. Features added. 1. lines only those containing any stock move will be shown. 2. Reference field added. 3. We remove 'week' from the query, instead of we fetch all the data according to 'date_expected', and we create three group_bys (i.e. group by date, week and month) so it is easy for the user to check report according to day, week and month. This commit is related to task 36088.
Odoo now supports CCAvenue as a payment provider, giving Indian businesses another option for accepting online payments. The update also improves payment failure visibility by logging error messages when a transaction does not complete successfully.
Original PR description
Task: https://www.odoo.com/web?#id=58741&action=333&active_id=131&model=project.task&view_type=form&menu_id=4720 Co-authored-by: Rohan Patel <rop@odoo.com> Description of the issue/feature this PR addresses: Current behavior before PR: Desired behavior after PR is merged: -- I confirm I have signed the CLA and read the PR guidelines at www.odoo.com/submit-pr
This change adds support for connecting UK VAT reporting to HMRC's Making Tax Digital service, including authorization, obligation retrieval, and VAT return submission flows. It helps businesses submit required VAT information more directly from Odoo and manage the HMRC connection through a proxy-based authentication process.
Enhancements to existing features
Users can now choose a "Last 5 Years" option when filtering date or datetime fields. This makes it easier to review longer-term trends and compare business performance across multiple years without manually setting custom dates.
Original PR description
Description of the issue/feature this PR addresses: Add "Last 5 Years" time range, to insert after Last 365 days. Current behavior before PR: Currently, There is no time range to see the data evolution over years. Desired behavior after PR is merged: Added "Last 5 Years" time range, to insert after Last 365 days. Task: https://www.odoo.com/web#id=1916017&action=327&model=project.task&view_type=form&menu_id=4720 Pad: https://pad.odoo.com/p/r.e204103a3acd35269f1d986a7192e0b4 -- I confirm I have signed the CLA and read the PR guidelines at www.odoo.com/submit-pr
When duplicate contacts are merged, their loyalty points can now be added together instead of one balance being lost. This helps businesses preserve customer rewards accurately during contact cleanup and consolidation.
Original PR description
Before this commit - Loyalty points were not merging, if we merge two contacts. After this, New contact will have sum of all loyalty points of customes which are getting merged. This commit is related to task #1869488. Description of the issue/feature this PR addresses: Current behavior before PR: Desired behavior after PR is merged: -- I confirm I have signed the CLA and read the PR guidelines at www.odoo.com/submit-pr
Odoo now rejects invalid rounding settings instead of returning misleading calculation results. This improves reliability in financial and sales calculations, including safer handling when currency or customer information is missing.
Original PR description
Adding two new rules to verify that invalid parameters are forbidden: * The precision_rounding must always be bigger than 0 * The precision_digits must always be equal or bigger than 0 Before this commit: * when a precision_round was 0 or smaller than 0 the float_utils functions gave as results: ** float_is_zero(0.0, precision_rounding=0.0) -> False ** float_round(1.25, precision_rounding=0.0) -> 0.0 ** float_compare(1.0, 1.0, precision_rounding=0.0) -> 1 * when a precision_digits was smaller than 0 the float_utils functions gave as results: ** float_is_zero(9.01, precision_digits=-2) -> True ** float_round(125.01, precision_digits=-2) -> 100.0 ** float_compare(121.01, 122.02, precision_digits=-2) -> 0 These results where at least not correct at worst not logic. Now, the function raises an error when the precision_rounding is smaller or equal than 0 or when the precision_digits is smaller than 0.
Demo records across sales, purchasing, repair, accounting, and website sales were updated so product descriptions better match the products shown. Purchase order lines now prefer a vendor-specific product code when available, making supplier communications clearer and reducing confusion.
Original PR description
Pad:https://pad.odoo.com/p/r.b30aef421f566d4854482088693f30ec Task:https://www.odoo.com/web?debug#id=1892754&action=333&active_id=131&model=project.task&view_type=form&menu_id=4720
This change lets teams identify customers who have placed orders through Point of Sale. It supports business uses such as e-marketing campaigns targeted at customers who bought in store.
Original PR description
Task: https://www.odoo.com/web?#id=1931528&action=333&active_id=131&model=project.task&view_type=form&menu_id=4720 Pad: https://pad.odoo.com/p/r.4ff63496524687424bb440af0e2c53cc Description of the issue/feature this PR addresses: Current behavior before PR: Desired behavior after PR is merged: -- I confirm I have signed the CLA and read the PR guidelines at www.odoo.com/submit-pr
The Manufacturing app now hides operation and manufacturing readiness options when a bill of materials is set up as a kit, since those settings do not apply. The help text is also made easier to understand, reducing confusion for users configuring kits.
Original PR description
Task : https://www.odoo.com/web?debug=assets#id=1929631&action=327&model=project.task&view_type=form&menu_id=4720 Pad : https://pad.odoo.com/p/r.250cb4e677684d1e8732345ac3490013 Current behavior before PR: 1) https://drive.google.com/a/odoo.com/file/d/1GzRFc8xKiVDcnKfPkXJirVHzmYXI4CGU/view?usp=drivesdk 2) https://drive.google.com/a/odoo.com/file/d/1vmQ3uHd478Cq9TB-NS6eEYNIceVt9jVh/view?usp=drivesdk Desired behavior after PR is merged: https://www.awesomescreenshot.com/image/3831254/aff4d6dd023a06ade890b9bacead8f43 -- I confirm I have signed the CLA and read the PR guidelines at www.odoo.com/submit-pr
When duplicate customer records are merged, their loyalty points are now added together instead of risking points being left behind. This helps keep customer rewards accurate and avoids manual corrections for loyalty balances.
Original PR description
Task link = https://www.odoo.com/web#id=1869488&action=327&model=project.task&view_type=form&menu_id=4720
This update removes direct references to a session identifier from the timesheet synchronization code. It helps align the enterprise app with broader platform changes, reducing internal coupling while keeping user-facing behavior unchanged.
Original PR description
See odoo/odoo#30098
Resolved issues and error corrections
This update clarifies how public and logged-in slide views are counted, making eLearning statistics more reliable. It also fixes course member counting and tightens upload/publish permissions so training content is managed by the right responsible users.
Original PR description
Description of the issue/feature this PR addresses: Current behavior before PR: Desired behavior after PR is merged: -- I confirm I have signed the CLA and read the PR guidelines at www.odoo.com/submit-pr
This change restores and updates automated checks for the website editor after recent editor updates. It helps ensure website editing and style customization continue to be validated reliably, reducing the risk of regressions reaching users.
Original PR description
This reverts commit ba0fe3437f79577d9934eeee151f67c1bfaf3a8d, as this should be ok with recent forward-port.
Expense reports now automatically use the same payment mode choices as individual expenses. This prevents missing or inconsistent options when new payment methods are added, making expense handling more reliable.
Original PR description
Description of the issue/feature this PR addresses The field payment mode in the expense sheet is related to the same the field in the expense, but this must be consistent, and if a new option is added in the expense must be considered in the sheet. In Odoo v11 > is not necessary indicate the selection parameter in the field definition. Current behavior before PR: If is added a new option in the hr.expense thas is not considered on the sheet Desired behavior after PR is merged: Make consistent both models -- I confirm I have signed the CLA and read the PR guidelines at www.odoo.com/submit-pr
Timesheet records imported before an employee had a linked user will now be updated once that user is assigned. This keeps employee timesheet data aligned automatically and avoids manual corrections after imports.
Original PR description
Description of the issue/feature this PR addresses: When employee entry has no user set in "Related User" field for any reason, and timesheet entries are imported, `user_id` field of a `account.analytic.line` will never be updated if "Related User" is set after the import. Steps to reproduce 1. Create `hr.employee` w/o "Related User" 2. Create `account.analytic.line` (as Timesheet entry) for created employee 3. Create `res.users` 4. Set created user as "Related User" of previously-created employee Current behavior before PR: `user_id` field of `account.analytic.line` won't get updated Desired behavior after PR is merged: `user_id` field of `account.analytic.line` will get updated -- I confirm I have signed the CLA and read the PR guidelines at www.odoo.com/submit-pr
This update removes an outdated compatibility reference from the Mexican tax cash basis test code. It helps keep the module aligned with current platform standards and prevents a test import error during validation.
Original PR description
Fixes: ``` File "/home/odoo/enterprise/l10n_mx_tax_cash_basis/tests/test_account_tax_cash_basis.py", line 8, in <module> from odoo.tools.pycompat import izip ```
This fixes a bank synchronization issue that could stop online bank statements from processing when a journal did not have a specific currency set. Businesses can now use optional journal currency settings without disrupting bank statement synchronization.
Original PR description
Before this commit, the online_sync_bank_statement wasn't working correctly. This occurs when the currency was not defined in the journal (currency is optional in journal). Indeed, when you call the float_is_zero function with the currency's precision (0 as it's not defined) an error is raised. Now we take into account if currency is defined.
Code cleanup and technical improvements
The Documents app now uses Odoo's shared search panel instead of a custom folder and tag selector. This makes navigation more consistent with other parts of Odoo and reduces custom code, helping future improvements and maintenance.