Daily updates from Odoo
Tuesday, December 3, 2024
21 changes · master
Security fixes and vulnerability patches
Odoo's code sandbox was redesigned to reduce security risks and improve compatibility with future Python versions. Several templates and payroll, appointment, localization, reporting, and Studio areas were updated so existing business flows continue working under the safer rules.
Original PR description
Context ======= `safe_eval` is Odoo's sandbox, this mechanism allows users and eveloppers to write templates, server actions, and more without worrying about the security risks associated with…
Context
=======
`safe_eval` is Odoo's sandbox, this mechanism allows users and
eveloppers to write templates, server actions, and more without
worrying about the security risks associated with arbitrary code execution.
The current version of the sandbox heavily relies on Python's bytecodes
and compile-time verifications. This causes 2 major problems:
1) In every release of Python, its bytecodes are updated or modified.
Which makes Odoo unusable until the security / framework team updates the
whitelist of bytecode.
2) Most sandboxing issues we have faced for the last years was due to a
lack of runtime checks (functions inputs (arguments) and outputs
(return values)). All most every times those kind of issues were
fixed with "dirty" hacks such as adding a list of
"unsafe attribute" or adding a wrapper for modules that are exposing
unsafe objects (such as the `sys` module)
Goal of the change
==================
During this rewrite we had a few goals:
1) Retain compatibility with the original version:
* Find a way to keep the old checks (deny dunders, attribute storing
and deleting)
* Keep the same exposed API, limiting the amount of code that needs
to be rewritten as much as possible
2) Add runtime checks to verify that every types passed and returns are
safe by checking their type. The way that the sandbox does it is by
using two set of types. One for the types we allow to instanciate
(the ones that we have absolute trust, most of them are primitive
types such as `str` and `int`) and the ones that we only allow as
instance, this means that you CANNOT instanciate them inside of the
sandbox (for example the sql cursor or the Odoo environement).
3) Eliminate the issues with the `.format` and `.format_map`.
This is a well known issue within the Python security community, if
you want more info : https://lucumr.pocoo.org/2016/12/29/careful-with-str-format/
Linked with https://github.com/odoo/odoo/pull/138611Enhancements to existing features
The recruitment analysis report has been renamed from Applicant Analysis to Application Analysis for clearer wording. Users can now filter out duplicate applications for the same job position, making reporting cleaner and easier to interpret.
Original PR description
`Applicant Analysis` report was renamed to `Application Analysis`. This PR also adds a filter which allows the user to filter out duplicate applications for a job position. A duplicate application is defined as an application to a job position where there is already another application with the same candidate_id. Task-4222501
The sales timesheet app's automated tests were moved to a newer testing framework. This helps keep future maintenance smoother and reduces reliance on older test tooling, with no expected change for end users.
Original PR description
Purpose of this commit is to convert the qunit testcases that depends on 'mail/../tests/helpers/test_utils' to hoot Part of: 3818666
General Ledger Excel exports now show both the foreign currency amount and the related currency code for multi-currency companies. This makes exported reports clearer for business users while leaving the on-screen report and PDF export unchanged.
Original PR description
The general ledger report has a column 'Currency' for multi-currency companies. This column includes the symbol of the currency in the view and in the PDF export. However in the Excel report, the column does not include the currency symbol, and the user has no information about what currency the column is in. This solution: - Renames the 'Currency' column to 'Amount Currency', which contains the amount as before - Adds a column 'Currency' with the currency code. - Adds an option 'show_currency' to ensure that the new column is only displayed in an excel report, by overriding export_to_xlsx. As a result of this commit, there are no changes to the view or PDF export, but in the Excel export, an additional column with the currency code is visible. task-4011008
Forecast reports now handle warehouse selections in a consistent way, whether users select one warehouse or several. This simplifies the underlying process and helps reduce maintenance complexity without changing the user-facing workflow.
Original PR description
In this PR
========================
1. For the forecast report, always pass warehouses as a list, regardless of whether it's one or more. This reduces unnecessary code and simplifies the logic.
The main goal is to clean this PR: https://github.com/odoo/enterprise/pull/69760
TaskId :4214109The Documents app test setup was updated by removing older mail testing helpers and replacing them with the newer approach. This is an internal maintenance improvement that helps keep automated tests easier to maintain without changing day-to-day user behavior.
Original PR description
This PR aims to remove legacy mail test_utils. Part of Task-3818666
The manufacturing work order screen was updated to align with a recent platform change that removed an older favorite-search deletion hook. This keeps favorite search editing behavior compatible and reduces maintenance risk without changing day-to-day workflows.
Original PR description
This commit deletes the deleteFavorite method extension from mrp_workorder because the original method is removed in https://github.com/odoo/odoo/pull/185954 task-4280784
The Documents chatter has been visually refreshed to feel more polished and easier to use. This improves the day-to-day experience for users reviewing document discussions and activity.
Original PR description
The chatter has been enhanced for a more polished and user-friendly experience, featuring updated text and design for improved functionality and appeal. **FROM** https://tinyurl.com/2752tz2d **TO** https://tinyurl.com/2bow4ade Task-4312893
Departure reason codes are now managed separately for each country where they are needed, instead of using one shared code field. This helps Belgian and Saudi payroll processes use the correct local codes and avoids confusion when different countries require different values.
Original PR description
Remove the `reason_code` from `hr.hr_departure_reason` because it is only relevant in certain localizations. Replace with one field per localization where it is relevant, this is needed because the code is not necessarily the same in every localization that uses it. task-4320913
Features or functions removed from Odoo
The Subscription app no longer includes built-in automation rules or depends on the automation module. This simplifies the app and removes the unused subscription health indicator from orders and reports; customers who need similar automations can still add them through other tools such as Studio.
Original PR description
This commits removes the dependency of 'base_automation' in the Subscription application and its derived code. The objective of this task is removing the code since it does not add much value and the customer can install automations from others modules if needed (such as Studio). In addition, we are also removing the 'health' field from sale orders and its reports, as it will be no longer used. task-4181465
Code cleanup and technical improvements
This change updates several enterprise messaging-related apps to use a more generic internal data preparation approach. It helps keep approvals, VoIP, and WhatsApp integrations aligned with the main Odoo platform, reducing future maintenance work without changing day-to-day user workflows.
Original PR description
Enterprise counter-part. Part of task-3605717 https://github.com/odoo/odoo/pull/183014
Documents and Studio were updated to stay compatible with recent Kanban view changes in the core platform. This is an internal cleanup that helps keep document and view editing screens working consistently without changing business workflows.
Original PR description
Adaptation of the code of documents/web_studio to the changes brought by https://github.com/odoo/odoo/pull/189109
Miscellaneous changes
Add some hooks and tweaks to improve the experience to customize/improve on top of this module. Info: @wt-io-it Forward-Port-Of: odoo/enterprise#72123
Original PR description
Add some hooks and tweaks to improve the experience to customize/improve on top of this module. Info: @wt-io-it Forward-Port-Of: odoo/enterprise#72123
**Email layout is not translated to targeted sender's language with Sign mails** Impacted versions: - 16.0 - 17.0 - 18.0 Steps to reproduce: 1. Create a partner with language other than the current user's language. 2. Create a sign request and send the request to the created partner. 3. The strings from the email layout like Odoo's `Powered By` and `Your Document` (Your Signature Request) are not translated to the partner's language, but translated with the user's language. This
Original PR description
**Email layout is not translated to targeted sender's language with Sign mails** Impacted versions: - 16.0 - 17.0 - 18.0 Steps to reproduce: 1. Create a partner with language other than the current…
**Email layout is not translated to targeted sender's language with Sign mails** Impacted versions: - 16.0 - 17.0 - 18.0 Steps to reproduce: 1. Create a partner with language other than the current user's language. 2. Create a sign request and send the request to the created partner. 3. The strings from the email layout like Odoo's `Powered By` and `Your Document` (Your Signature Request) are not translated to the partner's language, but translated with the user's language. This differs from the language in the body. Current behavior: Before this commit, the language of the logged in user and the language given in kwargs would be used to translate the content. The email layout would translate to the user language and the body content would use the kwarg's language. This lead to translation discrepancies. Expected behavior: After this commit, only the language given in the kwargs is used and therefore fixing the translations issues. Forward-Port-Of: odoo/enterprise#73784
Problem ---------- Since 1st October, the SHIF replace the NHIF, the only difference is the computation of the amount. All payslip before and on the 9 October use the NHIF and all new payslip from the 9 October use the SHIF Objective ---------- Adapt the salary rules to compute the good rule. Adapt the NHIF Report to make NHIF or SHIF reports. Solution ---------- Create new SHIF rule parameter with a min amount and rate computation. Create a new report wizard to manage the 2 differe
Original PR description
Problem ---------- Since 1st October, the SHIF replace the NHIF, the only difference is the computation of the amount. All payslip before and on the 9 October use the NHIF and all new payslip from the 9 October use the SHIF Objective ---------- Adapt the salary rules to compute the good rule. Adapt the NHIF Report to make NHIF or SHIF reports. Solution ---------- Create new SHIF rule parameter with a min amount and rate computation. Create a new report wizard to manage the 2 different rules NHIF and SHIF task-4294419 Forward-Port-Of: odoo/enterprise#74242
Commit 1: Reproduce: 1. Open a project's settings as Admin/Demo (project managers) 2. Make sure "Use Documents" is checked 3. Try quick creating a folder 4. Access Error This occurs because you are not allowed to create in the restricted "Projects" folder. This commit adapts demo data so that flows can easily be demonstrated and tested without requiring extra configuration steps for a common flow. Commit 2: Quick create folders instead of requests to centralize projects' docum
Original PR description
Commit 1: Reproduce: 1. Open a project's settings as Admin/Demo (project managers) 2. Make sure "Use Documents" is checked 3. Try quick creating a folder 4. Access Error This occurs because you are not allowed to create in the restricted "Projects" folder. This commit adapts demo data so that flows can easily be demonstrated and tested without requiring extra configuration steps for a common flow. Commit 2: Quick create folders instead of requests to centralize projects' documents. Also, the `documents_folder_many2one` widgets links to the documents kanban view of the folder instead of the less useful form view, as it is done in the other apps and bridges. Task-4344434 Forward-Port-Of: odoo/enterprise#74076
4 news appraisals templates have been added to improve their understanding for users. task-4206744 Forward-Port-Of: odoo/enterprise#70708
Original PR description
4 news appraisals templates have been added to improve their understanding for users. task-4206744 Forward-Port-Of: odoo/enterprise#70708
In this commit, we fix sign_resend_expired_link_tour tour by doing click in step action instead of doing nothing. Forward-Port-Of: odoo/enterprise#74977 Forward-Port-Of: odoo/enterprise#74767
Original PR description
In this commit, we fix sign_resend_expired_link_tour tour by doing click in step action instead of doing nothing. Forward-Port-Of: odoo/enterprise#74977 Forward-Port-Of: odoo/enterprise#74767
Purpose ======= The field was introduced when the overtime generation mechanism was already existing. But was included into the decision process to generate overtime work entries. Forward-Port-Of: odoo/enterprise#74562
Original PR description
Purpose ======= The field was introduced when the overtime generation mechanism was already existing. But was included into the decision process to generate overtime work entries. Forward-Port-Of: odoo/enterprise#74562
Version: - saas-17.4 Steps to reproduce: 1. Install sale_subscription. 2. Create a Sales Order and invoice it. 3. Click on upsell. 4. Duplicate the upsell. 5. Change the start date. Issue: - When duplicating the upsell and changing the start date, an error occurs due to a missing next_invoice_date value. Solution: - Added a condition to retrieve next_invoice_date if it's missing, preventing the error. task:4325916 Forward-Port-Of: odoo/enterprise#73371
Original PR description
Version: - saas-17.4 Steps to reproduce: 1. Install sale_subscription. 2. Create a Sales Order and invoice it. 3. Click on upsell. 4. Duplicate the upsell. 5. Change the start date. Issue: - When duplicating the upsell and changing the start date, an error occurs due to a missing next_invoice_date value. Solution: - Added a condition to retrieve next_invoice_date if it's missing, preventing the error. task:4325916 Forward-Port-Of: odoo/enterprise#73371
Follow-up of https://github.com/odoo/enterprise/pull/74131 PR above attempts to solve an issue of every-growing unpinned whatsapp conversations that make it harder to use Discuss for performance reasons, due to reaching the technical limit of around 2000 pinned conversations. To do so, it automatically forces unpinning whatsapp conversation after 2 weeks of inactivity, even if the conversation was unread. While this is an improvement, if there are around 150 whatsapp new whatsapp conversat
Original PR description
Follow-up of https://github.com/odoo/enterprise/pull/74131 PR above attempts to solve an issue of every-growing unpinned whatsapp conversations that make it harder to use Discuss for performance reasons, due to reaching the technical limit of around 2000 pinned conversations. To do so, it automatically forces unpinning whatsapp conversation after 2 weeks of inactivity, even if the conversation was unread. While this is an improvement, if there are around 150 whatsapp new whatsapp conversations made every day, then the 2 week force unpin is not enough, because the 2000 pinned conversation limit is reached. This commit fixes the problem by reducing the force unpin of whatsapp conversation to 5 days. The architecture of Discuss should scale better, but this is hardly achievable in short manner, hence why the current solution to this problem is prevent reaching a high amount of pinned conversations. opw-4330847 Forward-Port-Of: odoo/enterprise#74703