**Steps to reproduce:**
- Make sure that PyPDF2 is in version 1.26.0
- Install l10n_mx_edi
- Switch to a Mexican company
- Create an invoice:
  * Customer: [a Mexican customer]
  * Payment Way: [Effectivo]
  * An invoice line with a product having a UNSPSC Category
- Confirm the invoice
- Generate CFDI via "Send & Print" button
- Register a payment with "Efectivo" Payment Way
- Update Payments on the invoice
- Go to the payment
- Force CFDI
- Make sure the CFDI status of the payment is "Signed"
- Print "Payment Receipt"

**Issue:**
PyPDF2 raises a traceback:
"IndexError: list index out of range".

**Cause:**
PyPDF2 is executing this code to format a warning: file = filename.replace("/", "\\").rsplit("\\", 1)[1] where filename is something liked "<xxx>" (coming from the qweb compilation). Therefore, there is no index 1.
The warning is coming from lxml and is due to the fact that we are evaluating a xml value as it is in a qweb template:
"FutureWarning: Use specific 'len(elem)' or 'elem is not None' test instead." And since this commit:
https://github.com/odoo/odoo/commit/fd67b56fc695526d09706d2b6218519ea255fc30 Python's "warning.py" is overridden in PyPDF2.

**Solution:**
Use "len(cfdi['cfdi_node'])" as advised to check if the xml node has children in the payment receipt template.

opw-4359466
opw-4366016

Forward-Port-Of: odoo/enterprise#75227

### Steps to reproduce:
- Create two storable product: Final Product (FP) and Component (COMP)
- Create and confirm an MO for FP with a raw move: 1 x COMP
> The move should be: "not available" since 0 unit of COMP are in Stock
- Go to the barcode module > Operations > Manufacturing
- Remove the MO Ready filter > Click on your MO and then exit barcode
- Go back to the MO in the back end (mrp module)
#### > The raw move has been reserved and is hence marked as available.

### Cause of the issue:

Exiting the barcode will launch an rpc call of the `split_uncompleted_moves` in order to split uncomplete moves in 2 if necessary (for the records to be appropriately set the next time you enter the barcode):
https://github.com/odoo/enterprise/blob/71f979d5bdf88207cb94c83bd6a69633da649d1e/stock_barcode/static/src/models/barcode_picking_model.js#L1327-L1329 https://github.com/odoo/enterprise/blob/71f979d5bdf88207cb94c83bd6a69633da649d1e/stock_barcode/models/stock_move.py#L9-L11 Furthermore, since c29f61fdded2e80d0bb3c06199c6a196feac8076 in case of a production the component move are rather splitted on the move lines to avoid odd split of the component moves on the MO. However, in that case if a unassigned move is splitted, a move line will be generated and associated to that move, which makes it reserved and hence available.

opw-4338827
---

Forward-Port-Of: odoo/enterprise#74244

Steps to reproduce
===================
- Open the resource schedule, and go into day mode.
- Switch to tomorrow, and click new.
- The start date has been changed but not the end date, which is still
  now +duration.
- Which creates a default duration of `-23:00 hours`.

Second issue:
- Open the resource type appointment and then create the booking from the Gantt
  view using the new button.
- We get the wrong appointment type there.

Technical
===========
- Earlier, the stop was calculated based on the current time instead of `start`
  in the default_stop. we set stop datetime inside `onAddClicked` by default to
  start + 1 hour to override the calendar.event's default_stop.

- Earlier, we fell into the condition of fetching only the user appointment when
  we were not providing any resources inside the default_get method, which led to
  having the user-based appointment instead of the resource-based one. Here, we
  added a separate condition to fetch the resource-based when going through the
  action of resource gantt.

After this PR
===================
- This PR addresses the issue and fixes it  by adding the default stop for
  1 hour after the start time and assigning the correct appointment type.

Task-4330924

Forward-Port-Of: odoo/enterprise#74144

### Steps to reproduce:
- Install "l10n_hu_edi" and switch to a Hungarian company
- Create an invoice
- Click "Send & Print", uncheck "NAV 3.0" and send it
- Repeat step 3
- Error

### Cause:
With l10n_hu_edi, Odoo is supposed to regenerate the invoices at each Send&Print. The way it was done is by overriding `_need_invoice_document` to not check anymore if `invoice.invoice_pdf_report_id` is empty. As the function `_prepare_invoice_pdf_report` from `account` is called when `_need_invoice_document` returns True, it is always called. But this function checks again if `invoice.invoice_pdf_report_id` is empty (https://github.com/odoo/odoo/blob/17.0/addons/account/wizard/account_move_send.py#L394-L395). So `invoice_data` doesn't have the key 'pdf_attachment_values' and it crashes at this line: 
`pdf_values = invoice_data.get('pdf_attachment_values') or invoice_data['proforma_pdf_attachment_values']` 
because it tries reading 'proforma_pdf_attachment_values' but the key is not there either.

### Solution:
Extend `_prepare_invoice_pdf_report` to remove `invoice.invoice_pdf_report_id`.

opw-4363559

Forward-Port-Of: odoo/odoo#189442

### Context:
In its current form, the HTTP route using `/rate/<string:token>/<int:rate>`, that is used in URL links generated by emails asking for customer feedback, will have a "one-click write" behavior that commits the rating encoded in `<int:rate>`. So the record is already updated with the new value. Only then renders the feedback submit Form, where the user can change their preselected rating and leave a commentary before submitting it via a POST request.

Over the last years email providers and third party services will preemptively crawl URL in emails to verify if they are "dangerous" (e.g. Microsoft's Safe link and Defender fatures).
By doing so, the rating for the records will be set to the last clicked URL using the above HTTP route, without any input from a human user.

It will be creating a number of false positive or negative ratings that do not represent the real satisfaction of the surveyed customer.

### Proposed solution:
We are removing the implicit "one-click write" behavior of the route and favoring the Form submission expecting human input. This will increase the likelihood a given rating was the result of the customer clicking on the link and taking the time to leave a feedback, versus random inputs from URL bots.

### Future outlook:
With the ever-changing landscape of URL crawler bots, trying to develop counter measures to identify and flag bot behavior is possible, but would add immense overhead and maintenance cost of the code for an arguably minor feature, i.e. the customer can rate the ticket by just clicking the picture in the email.
Other methods to make these routes more resilient to URL crawlers might be revisited in the future, but for the short-term this seems like a sufficient solution to the unwanted behavior.

OPW-3411799
OPW-4292166

---
I confirm I have signed the CLA and read the PR guidelines at www.odoo.com/submit-pr

Forward-Port-Of: odoo/odoo#189146
Forward-Port-Of: odoo/odoo#187373

### Steps to reproduce:

- Enable Multi-Steps Routes in the settings
- Inventory > Configuration > Warehouse Management > Locations
- Pick any location
- With studio add the one2Many field `Store to sublocation` (`location_out_id` of `stock.putaway.rule`) > Close studio
- Try to add a line on the associated list
#### > Traceback

### Cause of the issue:

Adding a line will trigger an onchange of the`stock.putaway.rule` model in order to compute the default data of the new subrecord. However, the code will crash during the `_search_count` of the `_onchange_location_in` because of an invalid domain: https://github.com/odoo/odoo/blob/29939aa5fb1455af89a37293d2f76541ff1645ef/addons/stock/models/product_strategy.py#L80-L88 THis crashed since in our case the `location_out_id` will be a new record created during the onchange to represent the 'stock.location' and from which we are looking at the form. As such, a NewId will be given and treated as an integer in the domain leading to a traceback when the db is served.

### Fix:

Onchange method should be robust with respect to the usage of New records and hence the records used here should be replace by their origin if it even exists.

opw-4126731
---
I confirm I have signed the CLA and read the PR guidelines at www.odoo.com/submit-pr

Forward-Port-Of: odoo/odoo#189469
Forward-Port-Of: odoo/odoo#188053

Problem: A loyalty rewards points member don't receive their points for their confirmed order if they don't sign into their account when signing their quotation online from a link they received in their email. This bug only occurs if the quotation is set to "online signature" only. The bug is not reproducible when the quotation is set to both "online signature" and "online payment" or if website_sale_loyalty is not installed.

Purpose: It is expected that customers should receive their reward points for their order without needing to sign in because they accessed the link to sign the quotation from their email. It should be consistent with the behavior exhibited from having "online payment" set for the quotation or without website_sale_loyalty installed.

Steps to Reproduce on Runbot:
1. Install Sales app,  website_sale_loyalty, loyalty, sale_loyalty
2. Create a loyalty program that reward points based on orders
3. Create a quotation for a partner, set "online signature" in Other info, and click "Send by email"
4. Access the email in Settings > Technical > Emails
5. Copy the "Accept & sign" link and paste into incognito window
6. Sign the quote as a public user
7. Observe that the loyalty card  for the partner did not update the points

opw-4205826

---
I confirm I have signed the CLA and read the PR guidelines at www.odoo.com/submit-pr

Forward-Port-Of: odoo/odoo#182545

**Issue:**
Survey's PDF certifications generation is only allowed to users having rights on the company of the user who answered the survey.

**Expected:**
Any user having generation rights to surveys should be able to generate the certification PDF.

**Steps to reproduce:**
- Activate Survey app and ensure there are, at least, 2 companies;
- Create a survey with certification and ensure `Require Login` is unchecked;
- Share the survey (copy the `Survey Link`);
- Navigate to Settings / Users & Companies / Users;
- Filter on `Inactive Users` and select `Public user`;
- Setup the user's `Default Company` on Company A;
- Setup an active user's `Default Company` on Company B and ensure its `Allowed Companies` don't contain Company A;
- In a private navigator (to ensure no login data are saved), answer the survey (using the copied link above);
- Log in as the active user and go to Surveys / Participations;
- Look for the record of your test (`Contact` field should be empty);
- Click the `Certifications` action button;

**Cause:**
The user is not allowed to retrieve the other company's data to fill needed texts to display on the certificate.

**Fix:**
Allow any user to retrieve the logo and name of the restricted company using a `sudo` on these fields.


opw-4266445

---
I confirm I have signed the CLA and read the PR guidelines at www.odoo.com/submit-pr

Forward-Port-Of: odoo/odoo#189368