Daily updates from Odoo
Navigate
Branch
Thursday, May 14, 2020
6 changes
Security fixes and vulnerability patches
This update removes broad read access to internal view definitions and ensures permissions are evaluated as the actual user. It helps prevent users from seeing actions they cannot perform and strengthens access control across many Enterprise apps.
Original PR description
Enterprise version of the changes made at odoo/odoo#44993 (where the changes are explained in more details)
Miscellaneous changes
Execution time before commit: ~545s Execution time after commit: ~20s Clients datas: - Number of stock_valuation_layer: ~65 000 - Number of product.products: ~286 000 2 main performance used here: - Use `active_test=False` see: https://github.com/odoo/odoo/commit/466a8319547e11e2193dd8594b0e50e3c27d4b3e - Restoration of commit https://github.com/odoo/enterprise/pull/6308/commits/8e34b1355d5e33637897e2dd990e5e26e90ea70d to filter the dates in order to tighten the domain OPW-222
Original PR description
Execution time before commit: ~545s Execution time after commit: ~20s Clients datas: - Number of stock_valuation_layer: ~65 000 - Number of product.products: ~286 000 2 main performance used here: - Use `active_test=False` see: https://github.com/odoo/odoo/commit/466a8319547e11e2193dd8594b0e50e3c27d4b3e - Restoration of commit https://github.com/odoo/enterprise/pull/6308/commits/8e34b1355d5e33637897e2dd990e5e26e90ea70d to filter the dates in order to tighten the domain OPW-2221170 Forward-Port-Of: odoo/enterprise#10601
`_allowed_input_type_ids` field is computed based on the payslip. But as the payslip is not in the view, the JS does not send it to the server which cannot correcly compute the mentioned field. Forward-Port-Of: odoo/enterprise#9012
Original PR description
`_allowed_input_type_ids` field is computed based on the payslip. But as the payslip is not in the view, the JS does not send it to the server which cannot correcly compute the mentioned field. Forward-Port-Of: odoo/enterprise#9012
Before this commit, channels in the message were always empty. So the type of channel doesn't match the condition and the notifications in mobile are not formatted and associated correctly. After this commit, we use the self object as it's the 'mail.channel' model itself. Steps to reproduce: * Activate OCN * Use a mobile and login at least once on Odoo (e.g. using Demo) * Then send a direct message (e.g. to Demo) with another user (e.g. Admin) => Now on mobile a notification appears
Original PR description
Before this commit, channels in the message were always empty. So the type of channel doesn't match the condition and the notifications in mobile are not formatted and associated correctly. After this commit, we use the self object as it's the 'mail.channel' model itself. Steps to reproduce: * Activate OCN * Use a mobile and login at least once on Odoo (e.g. using Demo) * Then send a direct message (e.g. to Demo) with another user (e.g. Admin) => Now on mobile a notification appears but not formatted correctly and not in the right Android Channel Note: I guess the bug was introduced by this commit odoo/odoo@be27955 when some code was refactored form mail_message to mail_thread. We have also added these tests: * Test conditional notification (notification_type != inbox) * Test Tracking Message * Test Android Channel Identification Task ID: 2229735 Forward-Port-Of: odoo/enterprise#10563 Forward-Port-Of: odoo/enterprise#9604
- Activate Studio from dashboard of database A - Export studio customizations - Activate Studio from dashboard of database B - Import studio customizations previously exported The imported data don't have the boolean studio field set to True. Since v12, when loading a module, a query is executed to create or update XML ids. The create and write methods are not called anymore. Therefore the overridden create and write methods of "ir.model.data" defined in Studio module are not called an
Original PR description
- Activate Studio from dashboard of database A - Export studio customizations - Activate Studio from dashboard of database B - Import studio customizations previously exported The imported data don't have the boolean studio field set to True. Since v12, when loading a module, a query is executed to create or update XML ids. The create and write methods are not called anymore. Therefore the overridden create and write methods of "ir.model.data" defined in Studio module are not called and thus cannot set the studio field to True. The generation of the query creating XML ids has been moved to a private method allowing another module like Studio to override it. opw-2245578 related Community PR: https://github.com/odoo/odoo/pull/51140 Forward-Port-Of: odoo/enterprise#10555
…e requests Steps to reproduce: - install employees, hr_contract, sign - go to employees and reate a new employee with no related user - go to sign > select the default demo contract > share > go to the link in a private navigation window 2+ times - go to employees > select the created employee Previous behavior: the smart button "signature requests" counts public signature requests (if you opened the contract x times, it will show x in the smart button count for all employees with
Original PR description
…e requests Steps to reproduce: - install employees, hr_contract, sign - go to employees and reate a new employee with no related user - go to sign > select the default demo contract > share > go to the link in a private navigation window 2+ times - go to employees > select the created employee Previous behavior: the smart button "signature requests" counts public signature requests (if you opened the contract x times, it will show x in the smart button count for all employees with no related user) Current behavior: employees with no related user will have no signature requests from role (so that public signature are not counted) signatures from contracts are still counted opw-2251277 Forward-Port-Of: odoo/enterprise#10565