Tuesday, September 3, 2024
5 changes · saas-17.2
Miscellaneous changes
The route `/website_mail/follow` can create new contacts, for that reason, it should be protected with recaptcha similar to `/website/form/<string:model_name>` and `/website_mass_mailing/subscribe` This PR adds the Recaptcha check on the endpoint: `/website_mail/follow` Before this PR it was possible to create as much dummy contact as you wanted as an attacker with a simple script opw-4023724 Forward-Port-Of: odoo/odoo#178435 Forward-Port-Of: odoo/odoo#175083
Original PR description
The route `/website_mail/follow` can create new contacts, for that reason, it should be protected with recaptcha similar to `/website/form/<string:model_name>` and `/website_mass_mailing/subscribe` This PR adds the Recaptcha check on the endpoint: `/website_mail/follow` Before this PR it was possible to create as much dummy contact as you wanted as an attacker with a simple script opw-4023724 Forward-Port-Of: odoo/odoo#178435 Forward-Port-Of: odoo/odoo#175083
*= event_crm_sale, website_event_crm * -Probably miss by script since https://github.com/odoo/odoo/pull/104741/commits/332c117f60a36f723c450f61ce2e0e7181d66c21 Description of the issue/feature this PR addresses: Current behavior before PR: Desired behavior after PR is merged: --- I confirm I have signed the CLA and read the PR guidelines at www.odoo.com/submit-pr Forward-Port-Of: odoo/odoo#177703
Original PR description
*= event_crm_sale, website_event_crm * -Probably miss by script since https://github.com/odoo/odoo/pull/104741/commits/332c117f60a36f723c450f61ce2e0e7181d66c21 Description of the issue/feature this PR addresses: Current behavior before PR: Desired behavior after PR is merged: --- I confirm I have signed the CLA and read the PR guidelines at www.odoo.com/submit-pr Forward-Port-Of: odoo/odoo#177703
### Steps to reproduce the issue: 1. Make sure you have access to the Analytic Distribution fields 2. Create an expense 3. Open the Split Expense Wizard and add Analytic Distribution to the new Expenses - Click out of the Analytic Distribution widget to close it, don't use the close icon 4. Finish the splitting process 5. On the Tree view that follows, the Analytic Distribution fields are empty ### Explanation: `onWindowClick` checks if the `analytic_distirbution` widget should
Original PR description
### Steps to reproduce the issue: 1. Make sure you have access to the Analytic Distribution fields 2. Create an expense 3. Open the Split Expense Wizard and add Analytic Distribution to the new…
### Steps to reproduce the issue:
1. Make sure you have access to the Analytic Distribution fields
2. Create an expense
3. Open the Split Expense Wizard and add Analytic Distribution to the new Expenses
- Click out of the Analytic Distribution widget to close it, don't use the close icon
4. Finish the splitting process
5. On the Tree view that follows, the Analytic Distribution fields are empty
### Explanation:
`onWindowClick` checks if the `analytic_distirbution` widget should close. If the conditions are met, `forceCloseEditor` is called and the data is saved.
In this case, one of the `selectors` is retrieved by `ev.target.closest`, namely `.modal:not(.o_inactive_modal)`, therefore not meeting the conditions to call `forceCloseEditor`, but the widget still closes.
### Fix reasoning:
We want `forceCloseEditor` to be called in this situation, since the user is not clicking on an element related to `analytic_distribution`. We can use `o_act_window` to filter Search More modals from Wizards, as it is absent from the former.
opw-4001757
Forward-Port-Of: odoo/odoo#177161Before, the default user assigned to the self order was a standard pos user. This commit changes the default user to pos_manager to avoid any access rights issues. RB error: 70391 Forward-Port-Of: odoo/odoo#173102
Original PR description
Before, the default user assigned to the self order was a standard pos user. This commit changes the default user to pos_manager to avoid any access rights issues. RB error: 70391 Forward-Port-Of: odoo/odoo#173102
If the model `account.move.line` has custom field with name `source_line_id` or `source_move_id` or `source_line_account_type` then, when the computed field `payment_state` in model `account.move` is computed it causes `psycopg2.errors.AmbiguousColumn` during `GROUP BY` operation here[^1]. Because **account_move_line** is one of the joined tables in that query and it causes issue while grouping. Actually the issue can occur if any of the joined tables in that[^2] query has custom field with the
Original PR description
If the model `account.move.line` has custom field with name `source_line_id` or `source_move_id` or `source_line_account_type` then, when the computed field `payment_state` in model `account.move` is…
If the model `account.move.line` has custom field with name `source_line_id` or `source_move_id` or `source_line_account_type` then, when the computed field `payment_state` in model `account.move` is computed it causes `psycopg2.errors.AmbiguousColumn` during `GROUP BY` operation here[^1]. Because **account_move_line** is one of the joined tables in that query and it causes issue while grouping. Actually the issue can occur if any of the joined tables in that[^2] query has custom field with the names above, it will cause same issue.
To resolve this issue, I added a table alias
to the all 3 elements in GROUP BY clause.
Steps to reproduce:
1. Install module account in any version >= `saas~15.3`
2. Add custom field to the model `account.move.line` with name `source_move_id`.
3. Try to create invoice
You will face issue similar to this:
```
File "/home/odoo/src/odoo/saas-15.3/addons/account/models/account_move.py", line 1430, in _compute_amount
self._cr.execute(' UNION ALL '.join(queries), [stored_ids, stored_ids])
File "/home/odoo/src/odoo/saas-15.3/odoo/sql_db.py", line 356, in execute
res = self._obj.execute(query, params)
psycopg2.errors.AmbiguousColumn: column reference "source_move_id" is ambiguous
LINE 20: GROUP BY source_line_id, source_move_id,...
```
I targeted this PR to `16.0` because branch `saas-15.3` is disbaled
[^1]: https://github.com/odoo/odoo/blob/8346b2a7561c178fd7e9f9d1fbd7dac3e3843fd1/addons/account/models/account_move.py#L912
[^2]: https://github.com/odoo/odoo/blob/8346b2a7561c178fd7e9f9d1fbd7dac3e3843fd1/addons/account/models/account_move.py#L896-L912
Description of the issue/feature this PR addresses:
Current behavior before PR:
Desired behavior after PR is merged:
---
I confirm I have signed the CLA and read the PR guidelines at www.odoo.com/submit-pr
Forward-Port-Of: odoo/odoo#177579