Sunday, May 12, 2024
6 changes · saas-17.2
Miscellaneous changes
Steps to reproduce: Create a Service Product with the Invoicing Policy "Based on Milestones" and publish its eCommerce page. When logged out, click on "Add to Cart" on the product's eCommerce page. an error message occurs Bug: since this commit[1] "delivered_milestones" is only a valid selection for users with the group "group_project_milestone" Fix: compute the field as sudo to avoid access error but still only allow the correct group to manually set that value opw-3892462 [1]
Original PR description
Steps to reproduce: Create a Service Product with the Invoicing Policy "Based on Milestones" and publish its eCommerce page. When logged out, click on "Add to Cart" on the product's eCommerce page. an error message occurs Bug: since this commit[1] "delivered_milestones" is only a valid selection for users with the group "group_project_milestone" Fix: compute the field as sudo to avoid access error but still only allow the correct group to manually set that value opw-3892462 [1]:https://github.com/odoo/odoo/commit/50ffc339991b136b48525b2d60aa34a3039bb8 Forward-Port-Of: odoo/odoo#165133 Forward-Port-Of: odoo/odoo#164714
We only care about data fields when it comes to restricting access to message attachments. As some modules may use these attachments directly, it may be desirable for them to use the attachment name or similar metadata fields. "write" is only restricted if writing on a data field, as it's effectively the same as unlinking for our purposes. Other fields have the same access rights as prior to [1] Additional changes: - Admins can delete attachments from message in the UI again - Check r
Original PR description
We only care about data fields when it comes to restricting access to message attachments. As some modules may use these attachments directly, it may be desirable for them to use the attachment name or similar metadata fields. "write" is only restricted if writing on a data field, as it's effectively the same as unlinking for our purposes. Other fields have the same access rights as prior to [1] Additional changes: - Admins can delete attachments from message in the UI again - Check returns True instead of None when it succeeds, to match its parent - AccessError is raised with a cause so that we can detect if it was raised because of the message check 1: odoo/odoo@4c4e63f01aefa01c2377f15f2020485cb0f7e4da task-3519815 Forward-Port-Of: odoo/odoo#165158 Forward-Port-Of: odoo/odoo#164894
Currently only the author of a message or an admin is allowed to edit a message However any user that can see a message in a chatter can delete the attachments linked to it. While it isn't usually a big issue, it still seems unreasonable to allow anyone to delete potentially important attachments from messages. task-3519815 --- I confirm I have signed the CLA and read the PR guidelines at www.odoo.com/submit-pr Forward-Port-Of: odoo/odoo#165157 Forward-Port-Of: odoo/odoo#157970
Original PR description
Currently only the author of a message or an admin is allowed to edit a message However any user that can see a message in a chatter can delete the attachments linked to it. While it isn't usually a big issue, it still seems unreasonable to allow anyone to delete potentially important attachments from messages. task-3519815 --- I confirm I have signed the CLA and read the PR guidelines at www.odoo.com/submit-pr Forward-Port-Of: odoo/odoo#165157 Forward-Port-Of: odoo/odoo#157970
When receiving emails, the attachments of the email may be made directly into a document. This will not make a copy, meaning restrictions on message attachments apply on these attachments. By extension this means the related fields on documents cannot be used properly. We now do a second check, filtering documents, if the access rights check fails because of message attachment restrictions. The reason to do two checks is that we do not want to add querries in the most common cases where th
Original PR description
When receiving emails, the attachments of the email may be made directly into a document. This will not make a copy, meaning restrictions on message attachments apply on these attachments. By extension this means the related fields on documents cannot be used properly. We now do a second check, filtering documents, if the access rights check fails because of message attachment restrictions. The reason to do two checks is that we do not want to add querries in the most common cases where the check will succeed regardless of filtering. issue introduced in odoo/odoo@4c4e63f01aefa01c2377f15f2020485cb0f7e4da task-3519815 Forward-Port-Of: odoo/enterprise#62322 Forward-Port-Of: odoo/enterprise#62174
Before, only the fiscal country of the company was checked. Because of that, a Belgian company with a foreign VAT fiscal position in Luxembourg could for example not define those fields on its accounting firm, making it impossible for it to submit its tax declaration file to the government (since generating the file required those fields to be set). opw-3875483 Forward-Port-Of: odoo/enterprise#62317 Forward-Port-Of: odoo/enterprise#62126
Original PR description
Before, only the fiscal country of the company was checked. Because of that, a Belgian company with a foreign VAT fiscal position in Luxembourg could for example not define those fields on its accounting firm, making it impossible for it to submit its tax declaration file to the government (since generating the file required those fields to be set). opw-3875483 Forward-Port-Of: odoo/enterprise#62317 Forward-Port-Of: odoo/enterprise#62126
In the mutlicurrency report, there is a filter that allow to change the currency rate dynamically, and we authorize the input to be 0 which will cause a division by zero error. task-3869928 Forward-Port-Of: odoo/enterprise#62269 Forward-Port-Of: odoo/enterprise#60760
Original PR description
In the mutlicurrency report, there is a filter that allow to change the currency rate dynamically, and we authorize the input to be 0 which will cause a division by zero error. task-3869928 Forward-Port-Of: odoo/enterprise#62269 Forward-Port-Of: odoo/enterprise#60760