Daily updates from Odoo
Navigate
Branch
Friday, September 20, 2019
4 changes
Security fixes and vulnerability patches
This update replaces older SHA-1 checks with stronger SHA-2 hashing for cached web resources and adds collision checks for stored attachments. It reduces security risk around file storage and browser-cached assets while keeping day-to-day behavior unchanged for users.
Original PR description
SHA-1 is a cryptographic hash function that have weaknesses known since 2005, it has been deprecated by the NIST [1] about 10 years ago in 2011 and Google [2] have been able to perform a collision…
SHA-1 is a cryptographic hash function that have weaknesses known since 2005, it has been deprecated by the NIST [1] about 10 years ago in 2011 and Google [2] have been able to perform a collision attack in 2017. We use SHA-1 to compute the checksum of every attachment and reuse that checksum in order to store the file on disk. The purpose is only store the file once and possibly link that file in many attachments. We use SHA-1 in order to generate unique URL for resources that can be cached by the browser: assets bundle, translations, qweb templates and qweb images. Although practical attacks still requires quite a lot of computational resources, it is time to upgrade SHA-1 to SHA-2. To prevent attacks on the filestore, when uploading a file that has the same SHA-1 as a stored file, we perform a SHA-2 computation on both files to verify their signature. If their SHA-2 signature is different, an error is raised. We have selected the SHA-512/256 variant of the SHA-2 algorithm as replacement for SHA-1 for the following reasons: * On 64 bits platform, SHA-512 is the fastest SHA-2 variant, it is only ~1.5x slower than SHA-1. [3] * Keeping only the 256 foremost bits protects against both collision attacks and length extension attacks. * The hexadecimal digest is only 24 chars longer than SHA-1 which is nice to have somewhat short URLs. We have not used SHA-3 because: * At the moment of writing, it is too slow (~3x slower than SHA-1) [3] * It is not guaranteed to be available with the Python 3.5 `hashlib` module. * One of the author of SHA-3 is Belgian. [1] https://csrc.nist.gov/projects/hash-functions/nist-policy-on-hash-functions [2] https://shattered.io/ [3] http://bench.cr.yp.to/results-hash.html [4] http://www.commitstrip.com/en/2017/02/27/the-sha-1-alternative/ task-31589
Resolved issues and error corrections
Users can now add voucher lines with a price of zero without using workarounds such as creating special products or applying full discounts. This makes voucher entry simpler and better supports legitimate zero-value items.
Original PR description
Fixes: https://github.com/odoo/odoo/issues/29119 Description of the issue/feature this PR addresses: account_voucher Current behavior before PR: - Before this patch it was impossible to add line with Zero price in lines. The possible workarounds were to - `Create new Product with zero price` - `Set 100% Discount` - `Set Zero price on Product.` Desired behavior after PR is merged:This commits makes it possible to Add line with Zero price -- I confirm I have signed the CLA and read the PR guidelines at www.odoo.com/submit-pr Cc: @qdp-odoo
CRM lead scoring settings now save fields using stable internal names instead of translated display names. This prevents configuration issues for companies working in multiple languages and keeps predictive lead scoring consistent.
Original PR description
Description of the issue/feature this PR addresses:
The configuration parameter 'crm.pls_fields' is saved with the display name, this will not work when in a multilingual environment.
It is better to store this with the technical name of the field.
The test odoo/addons/crm/tests/test_crm_pls.py also uses the technical names of the fields
# Set the PLS config
self.env['ir.config_parameter'].sudo().set_param("crm.pls_start_date", "2000-01-01")
self.env['ir.config_parameter'].sudo().set_param("crm.pls_fields", "country_id,state_id,email_state,phone_state,source_id")
Current behavior before PR:
The display name of the fields are stored into the configuration parameter.
Desired behavior after PR is merged:
The technical name of the fields should be stored into the configuration parameter.
--
I confirm I have signed the CLA and read the PR guidelines at www.odoo.com/submit-prFeatures or functions removed from Odoo
This change removes old compatibility names for loading Odoo modules and updates affected code to use the current Odoo import paths. It reduces maintenance complexity and helps keep the platform aligned with modern Python standards, with little direct impact for business users unless custom code still uses the retired names.
Original PR description
`openerp` module/addons imports has been deprecated in v13 by 7c47eb1 for removal in v14. If you were still using the removed aliases, please substitute all `import openerp` by `import odoo` and `import openerp.addons` by `import odoo.addons`. If you were still using the removed `ad_paths` proxy, please use the python standard `odoo.addons.__path__`.