Daily updates from Odoo
Navigate
Branch
Tuesday, September 19, 2023
23 changes
Security fixes and vulnerability patches
Email links used to sign documents now include an expiration check, reducing the risk if an email is forwarded or an inbox is compromised. If a signing link has expired or is missing the required security details, the signer can request a fresh link by email.
Original PR description
Currently when you receive a link for signing a document in your email, this link is valid forever. So if your inbox was leaked or the email was forwarded, the link would still be valid. In order to improve the security of sign, it was decided to add an expiry date to the link. This commit implements this feature by adding an encrypted string and a timestamp to the signature URL. The string is the result of the encryption of the timestamp and the sign request item id with the server secret being used as key. When trying to sign, we can decrypt this string and check that it is valid and that the signing date is before the expiry timestamp. If the link is expired or the params were not present in the URL, we allow the user to receive a new link in his email. task-3234539
Enhancements to existing features
The SEPA Direct Debit payment flow has been aligned with the updated payment status page. This helps customers see consistent payment status information after checkout or payment confirmation.
Original PR description
task-3125913 See also: - https://github.com/odoo/odoo/pull/119473
Resolved issues and error corrections
This update adjusts internal performance test expectations across several Odoo apps so they match the current automated runbot results. It helps keep the test suite reliable while preparing related work for multi-company mail aliases, with no direct change for end users.
Original PR description
Update (some) query counters according to runbot state. Prepares Task-36879 (Mail: Support MultiCompany Aliases)
This fix separates internal calculations that were mixing saved and on-the-fly values across several business apps. It helps prevent inconsistent results or unexpected behavior in areas such as assets, payroll, manufacturing, timesheets, and data cleaning.
Original PR description
Companion of https://github.com/odoo/odoo/pull/98565.
Odoo Studio now loads values for fields that are hidden in form, list, and kanban views when users choose to show invisible fields. This prevents crashes in form editing and avoids incorrect data being shown in list and kanban editors.
The generate offer wizard now displays explanatory text with proper alignment when no template is selected. This removes a visual glitch that could make the form look inconsistent or harder to read.
Original PR description
**Prior to this commit:** While generating offer, when the template is not selected, the text is weirdly aligned. This is because it is getting improper colspan due to the removal of the label. **Post this commit:** By giving the appropriate colspan, the text appears correctly. **Task:** 3430509
A Web Studio issue was corrected where the system made an incorrect assumption about how an internal request handler should behave. This helps prevent errors in Studio-related actions and improves reliability for users customizing Odoo.
Original PR description
model != controller
Basic employees could hit an error when opening the new appraisal form without HR or appraisal permissions. The change hides the appraisal shortcut that caused the problem for users who should not access it, allowing them to continue without a traceback.
Original PR description
Steps to reproduce: - Have a simple user with no hr and appraisal rights - Go to the appraisal and click on the new button We get a traceback saying: EvalError: Can not evaluate python expression: (bool(employee_appraisal_count < 2 or not employee_id)) Error: Name 'employee_appraisal_count' is not defined Explanation: The issue is coming from having 'employee_appraisal_count' on the domain of the smartbutton in the view. If we were to just put 'employee_appraisal_count' on the view, we don't have the issue and we read it properly. Which, probably means that fields (related field in this case) are not read properly for the domain. For a timely fix, we put the groups on the smartbutton. Should be removed once the issue is fixed. task- 3497285
Code cleanup and technical improvements
The point-of-sale order view has been standardized across key screens, reducing duplicated behavior and making future updates more reliable. This also improves consistency for staff using product, ticket, split bill, and related POS flows.
Original PR description
At the moment, the pos displays the selected order in multiple screens, such as the `ProductScreen`, the `TicketScreen`, the `SplitBillScreen`, the `self_order` app, but uses completely different…
At the moment, the pos displays the selected order in multiple
screens, such as the `ProductScreen`, the `TicketScreen`, the
`SplitBillScreen`, the `self_order` app, but uses completely
different implementations for each. This means that when
a change needs to be made to the one, it generally needs to be made
to the other as well, which is error-prone.
In this commit we create generic `OrderWidget` and `Orderline` components,
that have not dependencies on POS objects and we refactor the `ProductScreen`,
the `TicketScreen` and the `SplitBillScreen` to use these components.
The `OrderSummary` component was removed and it's contents are now in the
`OrderWidget`.
We also introduce a very simple new component called `CenteredIcon` that
can be used whenever we want to show an icon that fills a whole div. In this
commit we use it for showing the cart icon when the order is empty.
In a future commit, the `pos_self_order` will be refactored in order
to use the same `OrderWidget` and `Orderline` compoenents as the POS.
Task: 3470365
In addition, this commit solves the issue from the task 3491303.
https://github.com/odoo/odoo/pull/132248Miscellaneous changes
The related commit made it possible to download a file from on /file command of the knowledge app also via the mobile app. The implementation was based on the assumption that is wasn't necessary to download a file from outside the current database. That assumption is wrong regarding the demo knowledge page where the /file demo file (Odoo Survival Guide) is hosted on odoo.com (hence not the current database). The problem is that the `download` function always send a POST XHR even when th
Original PR description
The related commit made it possible to download a file from on /file command of the knowledge app also via the mobile app. The implementation was based on the assumption that is wasn't necessary to…
The related commit made it possible to download a file from on /file command of the knowledge app also via the mobile app. The implementation was based on the assumption that is wasn't necessary to download a file from outside the current database. That assumption is wrong regarding the demo knowledge page where the /file demo file (Odoo Survival Guide) is hosted on odoo.com (hence not the current database). The problem is that the `download` function always send a POST XHR even when there is no data to post (e.g. only download a file given its URL), in case of the Odoo server, POST requests and more restrictive than GET ones: they require a CSRF-token and perform some CORS verifications. In the case of downloading via a POST to Odoo Survival Guide (hosted on odoo.com) from another database, the CORS validation failed and the file couldn't be downloaded. Use `downloadFile` instead, it sends a `GET` XHR. Note: The same problem was solved in saas-16.4 by embeding the Odoo Survival Guide PDF inside the demo data, see second commit. Reference-to: https://github.com/odoo/enterprise/commit/b2588fa ([FIX] knowledge: allow file downloads in mobile app) Reference-to: https://github.com/odoo/enterprise/commit/ed4cc6735daa85e7d90a56971c119391f1e3df53 ([IMP] knowledge: improve onboarding) Forward-Port-Of: odoo/enterprise#47430 Forward-Port-Of: odoo/enterprise#47056
The tags filter are 'filter_analytic', 'filter_analytic_groupby' and 'filter_partner'. In the case where there is several tags fields in the same filter (like in 'filter_analytic_groupby'), make the tags input adapt size if one of them gets bigger (they all get bigger). Forward-Port-Of: odoo/enterprise#47448
Original PR description
The tags filter are 'filter_analytic', 'filter_analytic_groupby' and 'filter_partner'. In the case where there is several tags fields in the same filter (like in 'filter_analytic_groupby'), make the tags input adapt size if one of them gets bigger (they all get bigger). Forward-Port-Of: odoo/enterprise#47448
task-3497285 Forward-Port-Of: odoo/enterprise#47082
Original PR description
task-3497285 Forward-Port-Of: odoo/enterprise#47082
Adding a field related to one of type 'file' doesn't allow you to download the file Steps to reproduce: 1. Install Sales and Studio 2. Open the product form of 'Acoustic Bloc Screens' and toggle Studio 3. Add a file field in the form, close Studio and add any file on the product 4. Open any SO, toggle Studio and edit the sale order line list view 5. Add a related field in the list view related to Product Template > New File and close Studio 6. Create a new SO for any customer, add produ
Original PR description
Adding a field related to one of type 'file' doesn't allow you to download the file Steps to reproduce: 1. Install Sales and Studio 2. Open the product form of 'Acoustic Bloc Screens' and toggle…
Adding a field related to one of type 'file' doesn't allow you to download the file Steps to reproduce: 1. Install Sales and Studio 2. Open the product form of 'Acoustic Bloc Screens' and toggle Studio 3. Add a file field in the form, close Studio and add any file on the product 4. Open any SO, toggle Studio and edit the sale order line list view 5. Add a related field in the list view related to Product Template > New File and close Studio 6. Create a new SO for any customer, add product 'Acoustic Bloc Screens' to the SOL and save 7. Click on the download icon in the related field 8. A connection lost notification appears and the download never happens Solution: When adding a field related to a file with studio, automatically add a field related to the filename so that we can specify the filename for the related file field Problem: The 'filename' attribute was not added on the binary field opw-3377290 Forward-Port-Of: odoo/enterprise#47426 Forward-Port-Of: odoo/enterprise#45155
Forward-Port-Of: odoo/enterprise#47474
Original PR description
Forward-Port-Of: odoo/enterprise#47474
This pull request appears to make a small work-in-progress change in the employee contract salary area. Based on the limited information provided, it likely supports testing or validation work rather than introducing a clear business-facing feature.
In this commit (https://github.com/odoo/enterprise/commit/c08d44a29d944f73b3ec243a9ead14e815c7ef2c) we broke the stable policy because account_type is not present in the options if you didn't upgrade the module. Forward-Port-Of: odoo/enterprise#47568 Forward-Port-Of: odoo/enterprise#47548
Original PR description
In this commit (https://github.com/odoo/enterprise/commit/c08d44a29d944f73b3ec243a9ead14e815c7ef2c) we broke the stable policy because account_type is not present in the options if you didn't upgrade the module. Forward-Port-Of: odoo/enterprise#47568 Forward-Port-Of: odoo/enterprise#47548
Bugfix. Account 2490 was being referenced twice, in section "Liabilities to credit institutions" and section "Other liabilities", causing an unbalanced Balance Sheet. Solution: - Accounts 2490 (Other current liabilities to credit institutions, customers and suppliers), 2491 (Settlement of game organisers) and 2499 (Other other current liabilities) properly belong to the "Other liabilities" section of the Balance Sheet. - Account 2492 (Bills of exchange payable) belongs to the "Exchange liab
Original PR description
Bugfix. Account 2490 was being referenced twice, in section "Liabilities to credit institutions" and section "Other liabilities", causing an unbalanced Balance Sheet. Solution: - Accounts 2490 (Other current liabilities to credit institutions, customers and suppliers), 2491 (Settlement of game organisers) and 2499 (Other other current liabilities) properly belong to the "Other liabilities" section of the Balance Sheet. - Account 2492 (Bills of exchange payable) belongs to the "Exchange liabilities" section. This PR is part of the wider task of re-balancing the Balance Sheets. taskid:3239795 Forward-Port-Of: odoo/enterprise#47466 Forward-Port-Of: odoo/enterprise#46883
Currently, the error occurs when executing the scheduled action 'EBay: update categories' with apply the wrong credentials for eBay. Step to produce: - Install the 'sale_ebay' module. - Navigate to 'Sale' > 'Configuration' > 'Settings'. - In the 'eBay' section, intentionally input incorrect values in the following fields: 'Developer Key' 'Sandbox Token' 'Sandbox App Key' 'Sandbox Cert Key' - Manually trigger the scheduled action 'eBay: update categori
Original PR description
Currently, the error occurs when executing the scheduled action 'EBay: update categories' with apply the wrong credentials for eBay. Step to produce: - Install the 'sale_ebay' module. - Navigate to…
Currently, the error occurs when executing the scheduled action 'EBay: update categories' with apply the wrong credentials for eBay.
Step to produce:
- Install the 'sale_ebay' module.
- Navigate to 'Sale' > 'Configuration' > 'Settings'.
- In the 'eBay' section, intentionally input incorrect values in the following fields:
'Developer Key'
'Sandbox Token'
'Sandbox App Key'
'Sandbox Cert Key'
- Manually trigger the scheduled action 'eBay: update categories'.
Traceback on sentry:
```
ConnectionError: 'GetStore: Class: RequestError, Severity: Error, Code: 931, Auth token is invalid. Validation of the authentication token in API request failed.'
File "home/odoo/src/enterprise/saas-16.4/sale_ebay/models/product.py", line 358, in _ebay_execute
return ebay_api.execute(verb, data, list_nodes, verb_attrs, files)
File "ebaysdk/connection.py", line 127, in execute
self.error_check()
File "ebaysdk/connection.py", line 223, in error_check
raise ConnectionError(estr, self.response)
UserError: Error Encountered.
'Validation of the authentication token in API request failed.(931)'
File "home/odoo/src/enterprise/saas-16.4/sale_ebay/models/sale_ebay.py", line 47, in _cron_sync
self._sync_categories()
File "home/odoo/src/enterprise/saas-16.4/sale_ebay/models/sale_ebay.py", line 64, in _sync_categories
self._sync_store_categories()
File "home/odoo/src/enterprise/saas-16.4/sale_ebay/models/sale_ebay.py", line 144, in _sync_store_categories
raise e
File "home/odoo/src/enterprise/saas-16.4/sale_ebay/models/sale_ebay.py", line 139, in _sync_store_categories
response = self.env['product.template']._ebay_execute('GetStore')
File "home/odoo/src/enterprise/saas-16.4/sale_ebay/models/product.py", line 380, in _ebay_execute
raise UserError(_("Error Encountered.\n'%s'") % (error_message,))
AttributeError: 'res.users' object has no attribute 'message_post'
File "odoo/tools/safe_eval.py", line 362, in safe_eval
return unsafe_eval(c, globals_dict, locals_dict)
File "ir.actions.server(425,)", line 1, in <module>
File "home/odoo/src/enterprise/saas-16.4/sale_ebay/models/sale_ebay.py", line 51, in _cron_sync
self.env.user.message_post(
ValueError: <class 'AttributeError'>: "'res.users' object has no attribute 'message_post'" while evaluating
'model._cron_sync(True)'
File "odoo/addons/base/models/ir_cron.py", line 373, in _callback
self.env['ir.actions.server'].browse(server_action_id).run()
File "home/odoo/src/custom/trial/saas_trial/models/sentry.py", line 33, in run
res = super().run()
File "odoo/addons/base/models/ir_actions.py", line 688, in run
res = runner(run_self, eval_context=eval_context)
File "odoo/addons/base/models/ir_actions.py", line 558, in _run_action_code_multi
safe_eval(self.code.strip(), eval_context, mode="exec", nocopy=True, filename=str(self)) # nocopy allows to return 'action'
File "odoo/tools/safe_eval.py", line 376, in safe_eval
raise ValueError('%s: "%s" while evaluating\n%r' % (ustr(type(e)), ustr(e), expr))
```
When executing the scheduled action 'EBay: update categories', There's an issue where the system attempts to access the 'message_post' method from 'res.users' object [1] and the 'res.users' object has no attribute 'message_post'.
Line[1]: https://github.com/odoo/enterprise/blob/6c8c7dd78f354ba7dc2b2d176243046e1fed26bf/sale_ebay/models/sale_ebay.py#L52-L53
This commit solves this issue by accessing the 'message_post' method from the 'res.partner' object instead of 'res.users'.
sentry-4457508544
Forward-Port-Of: odoo/enterprise#47462
Forward-Port-Of: odoo/enterprise#47347### Summary Currently, numbers and dates can be wrapped on reports. ### Steps to reproduce * create and confirm an invoice that has a line with a long label. * print the general ledger followup to: 4ea06ced880969abdde0a44f97ce96273ca91df2 opw-3462774 Before:  After:  Forwar
Original PR description
### Summary Currently, numbers and dates can be wrapped on reports. ### Steps to reproduce * create and confirm an invoice that has a line with a long label. * print the general ledger followup to: 4ea06ced880969abdde0a44f97ce96273ca91df2 opw-3462774 Before:  After:  Forward-Port-Of: odoo/enterprise#47286
…it time Forward-Port-Of: odoo/enterprise#47396
Original PR description
…it time Forward-Port-Of: odoo/enterprise#47396
- Employee smartbutton should not be displayed if contract is not double signed - Inactive contracts should not be displayed - Fix some translations task-3471583 Forward-Port-Of: odoo/enterprise#46150
Original PR description
- Employee smartbutton should not be displayed if contract is not double signed - Inactive contracts should not be displayed - Fix some translations task-3471583 Forward-Port-Of: odoo/enterprise#46150
Before this commit, when a new timesheet was created from the timesheet grid, and no line were corresponding to the duo 'project/task' of the new timesheet, a manual reload of the page was needed in order for that new line to appear. Step to reproduce : - open the timesheet grid view - start the timer - create a new project and/or a new task - stop the timer a new line with the new project is supposed to appear, but it doesn't. Why : in the previous version, a reload was trigger eve
Original PR description
Before this commit, when a new timesheet was created from the timesheet grid, and no line were corresponding to the duo 'project/task' of the new timesheet, a manual reload of the page was needed in…
Before this commit, when a new timesheet was created from the timesheet grid, and no line were corresponding to the duo 'project/task' of the new timesheet, a manual reload of the page was needed in order for that new line to appear. Step to reproduce : - open the timesheet grid view - start the timer - create a new project and/or a new task - stop the timer a new line with the new project is supposed to appear, but it doesn't. Why : in the previous version, a reload was trigger every time a change occurred on the timesheet header, this was removed for performance issue. Solution: In order to not trigger too many reload, we reload the view only once the timer is stopped, and only if the current timesheet does not belong to any of the current lines of the grid. Details of the implementation: The method stopTimer was updated to trigger a reload in case the timesheetHeader does not have any row, for this is possible only when none of the row in the rowsKeyToIdMapping correspond the project/task of the header. Some tests were added/updated to ensure the reload is only triggered when needed task - 3471368 Forward-Port-Of: odoo/enterprise#47184 Forward-Port-Of: odoo/enterprise#46549
Issue: ------ A user without rights for Survey app (or appraisal/admin) but who is manager of an appraisal is not able to see the result of surveys. A user witout rights for Survey app get an access error if he tries to access to the survey template via "Ask Feedback" wizard. Solution: --------- Backport of commit: 808ec18c3941a32cde6dbe02cd34f93ddc976121 Add a new rule for the model `survey.question`. Forward-Port-Of: odoo/enterprise#47479 Forward-Port-Of: odoo/enterprise#472
Original PR description
Issue: ------ A user without rights for Survey app (or appraisal/admin) but who is manager of an appraisal is not able to see the result of surveys. A user witout rights for Survey app get an access error if he tries to access to the survey template via "Ask Feedback" wizard. Solution: --------- Backport of commit: 808ec18c3941a32cde6dbe02cd34f93ddc976121 Add a new rule for the model `survey.question`. Forward-Port-Of: odoo/enterprise#47479 Forward-Port-Of: odoo/enterprise#47291