Friday, July 10, 2020
16 changes · master
Security fixes and vulnerability patches
This update improves internal checks that help developers catch unsafe database query patterns before they reach users. It reduces missed warnings and clarifies how legitimate dynamic database queries should be written, lowering the risk of security issues.
Original PR description
With the current lint we have very similar queries which lead to different flagging:
```python
self.env.cr.execute("SELECT %s FROM table WHERE %s" % (self._table, ''.join(where_list)))
```
triggers a lint failure but
```python
self.env.cr.execute("SELECT %s FROM table WHERE %s" % (self._table, where))
```
does not.
Now there's one part which is a bit unclear: is the first one a false positive or the second one a false negative? It basically boils down to whether what we're allowing is the specific `self._table` being injected directly, or whether `self._table` means all injection is now allowed aka is it ok if *all* injected parameters are `self._...` or *any* of them?
@moylop260 since you were the original author, do you remember the intent? (ignore the existing commits in this PR, basically I assumed the former situation where each parameter was whitelisted but that is quite noisy and unwieldy, which led me to believe your intent had been different).New functionality added to Odoo
Website automation actions can now create response objects directly from their Python code. This makes webhook-style automations easier to build because teams can return data without adding separate model methods.
Original PR description
**Description of the issue/feature this PR addresses:** I noticed, that ``base_automation`` can be used as a webhook handler. But I don't see a possibility to prepare a response directly in action's…
**Description of the issue/feature this PR addresses:** I noticed, that ``base_automation`` can be used as a webhook handler. But I don't see a possibility to prepare a response directly in action's code, because Response object is not available in the action context. Did I miss something? See https://github.com/odoo/odoo/blob/ceddb710a17e552061b9ad3cbc2647d7eae6567d/addons/website/controllers/main.py#L436-L442 And https://github.com/odoo/odoo/blob/ceddb710a17e552061b9ad3cbc2647d7eae6567d/addons/website/models/ir_actions.py#L54-L60 **Current behavior before PR:** To return data on the _request_ , you need to create a method in an model that returns Response object **Desired behavior after PR is merged:** You can create a Response object directly from "Python code field"  -- I confirm I have signed the CLA and read the PR guidelines at www.odoo.com/submit-pr @it-projects-llc
Resolved issues and error corrections
This update removes leftover debugging output and fixes small code quality issues from a previous smooth scrolling change. It helps keep the editor and web interface stable and maintainable without changing how users work day to day.
Miscellaneous changes
When building the package list of the APT repository, dpkg-scanpackages reports the following and only output the latest package information in the Packages file: ``` dpkg-scanpackages: warning: Packages with multiple instances but no --multiversion specified: dpkg-scanpackages: warning: ./odoo_13.0.20191002_all.deb dpkg-scanpackages: warning: ./odoo_13.0.20191003_all.deb [...] dpkg-scanpackages: warning: ./odoo_13.0.20200630_all.deb ``` Having only the latest version listed in the P
Original PR description
When building the package list of the APT repository, dpkg-scanpackages reports the following and only output the latest package information in the Packages file: ``` dpkg-scanpackages: warning: Packages with multiple instances but no --multiversion specified: dpkg-scanpackages: warning: ./odoo_13.0.20191002_all.deb dpkg-scanpackages: warning: ./odoo_13.0.20191003_all.deb [...] dpkg-scanpackages: warning: ./odoo_13.0.20200630_all.deb ``` Having only the latest version listed in the Packages file makes it impossible to tell apt to use a specific version through apt-pinning. It also makes it impossible to revert to a previous version if a regression is caused by an update. For these reasons, tell dpkg-scanpackages to include all versions of the odoo package in the Packages file it generates. Forward-Port-Of: odoo/odoo#53888
This change updates several modules to use safer, approved database query construction required by stricter internal checks. It helps prevent fragile query patterns and keeps the codebase aligned with improved quality controls, without introducing expected user-facing changes.
Original PR description
Changes necessary due to fixed / stricter sql linter in odoo/odoo#53938: dsql cases which were previously missed / ignored are now properly inspected, injecting self._table is whitelisted but other injections of local variables require using the psycopg2.sql API.
### Issue - Accounting > General ledger - Have 2-3 lines in the table I added filters to have them - Toggle optional columns: (...) on the right There is an y scroll but you can't scroll more than half of the scrollbar. ### Cause The cause is that the dropdown height is greater than the table height. ### Solution Compute the table height depending on the dropdown and table header height. **OPW-2291531** -- I confirm I have signed the CLA and read the PR
Original PR description
### Issue - Accounting > General ledger - Have 2-3 lines in the table I added filters to have them - Toggle optional columns: (...) on the right There is an y scroll but you can't scroll more than half of the scrollbar. ### Cause The cause is that the dropdown height is greater than the table height. ### Solution Compute the table height depending on the dropdown and table header height. **OPW-2291531** -- I confirm I have signed the CLA and read the PR guidelines at www.odoo.com/submit-pr Forward-Port-Of: odoo/odoo#54256
Description of the issue/feature this PR addresses: Current behavior before PR: Desired behavior after PR is merged: -- I confirm I have signed the CLA and read the PR guidelines at www.odoo.com/submit-pr Forward-Port-Of: odoo/odoo#53874
Original PR description
Description of the issue/feature this PR addresses: Current behavior before PR: Desired behavior after PR is merged: -- I confirm I have signed the CLA and read the PR guidelines at www.odoo.com/submit-pr Forward-Port-Of: odoo/odoo#53874
…nt Link wizard In Sales, in Payment Link generation wizard, when entering manually the total of the quotation as Amount, it can happen that the Validation Error asking to set an Amount smaller than the total is triggered. opw-2287794 Description of the issue/feature this PR addresses: Current behavior before PR: Desired behavior after PR is merged: -- I confirm I have signed the CLA and read the PR guidelines at www.odoo.com/submit-pr Forward-Port-Of: odoo/odoo#54278
Original PR description
…nt Link wizard In Sales, in Payment Link generation wizard, when entering manually the total of the quotation as Amount, it can happen that the Validation Error asking to set an Amount smaller than the total is triggered. opw-2287794 Description of the issue/feature this PR addresses: Current behavior before PR: Desired behavior after PR is merged: -- I confirm I have signed the CLA and read the PR guidelines at www.odoo.com/submit-pr Forward-Port-Of: odoo/odoo#54278
The label of some buttons is updated on-the-fly, and the code which does that was actually altering the structure of the button widgets instead of just the labels' text. This code should be made more robust in master. Forward-Port-Of: odoo/odoo#54319
Original PR description
The label of some buttons is updated on-the-fly, and the code which does that was actually altering the structure of the button widgets instead of just the labels' text. This code should be made more robust in master. Forward-Port-Of: odoo/odoo#54319
Search the xsd files from in the database. -- I confirm I have signed the CLA and read the PR guidelines at www.odoo.com/submit-pr Forward-Port-Of: odoo/odoo#54130
Original PR description
Search the xsd files from in the database. -- I confirm I have signed the CLA and read the PR guidelines at www.odoo.com/submit-pr Forward-Port-Of: odoo/odoo#54130
When we group by date with DST change within a range, we could get a reocrd inside two date range grouping, or inside no grouping. This is because we computed range just with [+ 1 month], so we possibly had these ranges (in UTC): - October 2019 : [('datetime', '>=', '2019-10-01 02:00:00') ('datetime', '<', '2019-11-01 02:00:00')] - November 2019 : [('datetime', '>=', '2019-11-01 01:00:00') ('datetime', '<', '2019-12-01 01:00:00')] So a record on 2019-11-0
Original PR description
When we group by date with DST change within a range, we could get a reocrd inside two date range grouping, or inside no grouping. This is because we computed range just with [+ 1 month], so we…
When we group by date with DST change within a range, we could get a
reocrd inside two date range grouping, or inside no grouping.
This is because we computed range just with [+ 1 month], so we possibly
had these ranges (in UTC):
- October 2019 : [('datetime', '>=', '2019-10-01 02:00:00')
('datetime', '<', '2019-11-01 02:00:00')]
- November 2019 : [('datetime', '>=', '2019-11-01 01:00:00')
('datetime', '<', '2019-12-01 01:00:00')]
So a record on 2019-11-01 01:30:00 would be both inside October and
November.
This happen because the DST is removed on happen on 27 October 2019 and
this was not taken into account when computing the end of the range.
With this changeset, for the given example aboth, we will have:
- October 2019 : [('datetime', '>=', '2019-10-01 02:00:00')
('datetime', '<', '2019-11-01 01:00:00')]
Added test without the change fails with "AssertionError: Lists differ"
because:
- "Q1 2019" finished on 17:00:00 instead of 16:00:00
- "Q3 2019" finished on 16:00:00 instead of 17:00:00
opw-2278829
Forward-Port-Of: odoo/odoo#54189
Forward-Port-Of: odoo/odoo#54056The fact that led_status.sh was still running when performing the `git reset --hard` made it impossible to remount the filesystem in RO mode, due to a `mount point is busy` error. Instead of starting the led_status_sh script from rc.local, we make it a service so it can be easily restarted when an update is performed. -- I confirm I have signed the CLA and read the PR guidelines at www.odoo.com/submit-pr Forward-Port-Of: odoo/odoo#54339
Original PR description
The fact that led_status.sh was still running when performing the `git reset --hard` made it impossible to remount the filesystem in RO mode, due to a `mount point is busy` error. Instead of starting the led_status_sh script from rc.local, we make it a service so it can be easily restarted when an update is performed. -- I confirm I have signed the CLA and read the PR guidelines at www.odoo.com/submit-pr Forward-Port-Of: odoo/odoo#54339
opw-[2294930](https://www.odoo.com/web#id=2294930&action=333&active_id=967&model=project.task&view_type=form&cids=1&menu_id=4720) The tax amount not included in price should be computed in the remaining balance, even if not included in price. -- I confirm I have signed the CLA and read the PR guidelines at www.odoo.com/submit-pr Forward-Port-Of: odoo/odoo#54325
Original PR description
opw-[2294930](https://www.odoo.com/web#id=2294930&action=333&active_id=967&model=project.task&view_type=form&cids=1&menu_id=4720) The tax amount not included in price should be computed in the remaining balance, even if not included in price. -- I confirm I have signed the CLA and read the PR guidelines at www.odoo.com/submit-pr Forward-Port-Of: odoo/odoo#54325
Update the description of the module to better match the workflow. Closes #11777 Forward-Port-Of: odoo/enterprise#11782
Original PR description
Update the description of the module to better match the workflow. Closes #11777 Forward-Port-Of: odoo/enterprise#11782
Forward-Port-Of: odoo/enterprise#11553
Original PR description
Forward-Port-Of: odoo/enterprise#11553
Account > Account > General Ledger Expand one account entries When journal entries are collected if on a move line a currency_id is defined in the record but the amount_currency is None an error will raise from format_value. opw-2288912 Forward-Port-Of: odoo/enterprise#11775 Forward-Port-Of: odoo/enterprise#11679
Original PR description
Account > Account > General Ledger Expand one account entries When journal entries are collected if on a move line a currency_id is defined in the record but the amount_currency is None an error will raise from format_value. opw-2288912 Forward-Port-Of: odoo/enterprise#11775 Forward-Port-Of: odoo/enterprise#11679