Daily updates from Odoo
Navigate
Branch
Tuesday, July 22, 2025
17 changes
16 changes
Security fixes and vulnerability patches
Direct debit payment notification emails no longer show full bank account numbers. The account number is now hidden except for the last four characters, reducing the risk of exposing sensitive customer banking information.
Original PR description
Before this fix, The bank account was shown in clear inside the direct debit payment notification mail Now, we replace all chars by * except the 4 last ones. task-4592821 Forward-Port-Of: odoo/enterprise#85735
Enhancements to existing features
This update prevents Odoo from showing misleading warnings when internal processes update fields that users cannot edit directly. It reduces noise in automated workflows and test scenarios across several business apps without changing everyday user behavior.
Closed subscriptions can no longer be reopened through the portal when more than one billing period has been missed. Customers now see the amount due when reopening is allowed, or a message to contact their sales manager when payment is blocked.
Original PR description
Before, The portal allowed to reopen closed subscriptions without checking how many billing periods were overdue. - The amount to pay was not clearly displayed. - The number of missing periods was incorrectly computed (X instead of X + 1). After this commit, - Blocking the payment option when more than one billing period is overdue (i.e., next_invoice_date + 1 period < today). - Displays a message to contact the sales manager if multiple billing periods are missed. - The payable amount is displayed when reopening is allowed. task-4724154
The HR Documents app replaces the old action for sending an HR access link with a more flexible email-sending option. This lets users send different types of HR-related emails from documents, improving communication workflows for employee records.
Original PR description
With this commit; the old server action "send hr access link" is replaced by "send email" to allow the user to send differents kind of email. task-3927412
Brazilian product tax setup now supports Avalara exception codes for NCM classifications. This helps businesses handle special tax rules, reduced rates, and benefits more accurately when calculating taxes through Avalara.
Original PR description
Added support for Avalara's EX Citations to handle tax exceptions for products with special tax rules (e.g., ICMS, IPI, PIS, COFINS), such as reduced rates or special benefits. It simplifies tax setups and improves calculation flexibility. In this commit: --- - Added an `EX` field to the NCM model to capture Avalara's exception codes. - Integrated EX field with Avalara tax calculations. - Updated NCM form view to include the EX field. task-4929018
Account return handling now uses a single, clearer view that brings together the return status, related checks, and discussion history. VAT returns also include a new Lock step before submission, making it clearer when the period is finalized and required files are generated.
Original PR description
This commit improves the user flow for account returns. When selecting a return, the chatter no longer opens in a side panel. Instead, a new view is shown displaying: - The return card (with stages…
This commit improves the user flow for account returns. When selecting a return, the chatter no longer opens in a side panel. Instead, a new view is shown displaying: - The return card (with stages and buttons), - The related checks (as a kanban view), - And the chatter on the side. This unified view offers better clarity and usability. Since the checks are shown in a kanban view, users can benefit from filters and search functionality on them. Additionally, a new stage "Lock" has been added between "Review" and "Submit" in the VAT return flow. This clarifies to the user that the return period will be locked before submission. This new stage generates the closing move and files (xml, pdf, ...) which can then be used in the submission stage. For Belgian localization (l10n_be_reports), this change implies that prorata and potential restitution parameters are now requested at the "Lock" stage, as they're essential for generating the XML file. The return checks also see significant changes. They no longer use a dedicated form view or an associated chatter. The approval process of a check is now more robust. Both Bookkeepers and Accountants can validate a check. If a Bookkeeper approves a check, an Accountant can subsequently "supervise" it. Once supervised by an Accountant, that specific check can no longer be invalidated by a Bookkeeper. Finally, Bookkeepers can no longer reset a tax return. task-4891073
IoT boxes can now use a direct browser connection through WebRTC when the user is on the same local network. This can improve responsiveness for IoT interactions while keeping existing connection methods as a fallback when WebRTC is unavailable.
Original PR description
Community PR: https://github.com/odoo/odoo/pull/218871 This PR adds a third connection type to the IoT box, using the WebRTC protocol. This commit handles the browser side of the connection. The…
Community PR: https://github.com/odoo/odoo/pull/218871 This PR adds a third connection type to the IoT box, using the WebRTC protocol. This commit handles the browser side of the connection. The WebRTC connection is added as a third connection type to the existing `iot_http` service, with the highest priority. The first time it is used, the connection will not be open yet so it will fail, but will begin establishing the connection in the background. The next time an IoT message is sent, it can use the WebRTC connection. We use the Browser APIs `RTCPeerConnection` and `RTCDataChannel` to setup the WebRTC connection to the IoT box. The flow is as follows: 1. Browser creates an `RTCPeerConnection` instance, generates an 'offer' and sends it to the IoT box via the existing WebSocket connection. 2. The IoT box receives this offer, and sends us back an 'answer', again via the WebSocket connection. 3. At this point the browser will automatically establish the connection to the IoT box. Any future calls to `iot_http` will use this connection (unless it fails, in which case it will fallback to the other connection types as before). This implementation is intentionally very simple. This means we do not use a STUN server, and so the connection will only work on the local network. This isn't a huge problem because in the case you are not on the same network as the IoT box, the WebSocket connection will still work and there would be little gain from using WebRTC. task-4894918
Resolved issues and error corrections
Fixed an issue that could prevent project task overlap checks from correctly handling filters based on related task information. This helps ensure planning conflicts are detected accurately and reduces the risk of missed scheduling issues.
Original PR description
The query that determines overlapping tasks is making two different Query objects: the first one for the main task and the second one for overlapping tasks. The second query is joined into the first one, injecting the second one's where clause as join condition, but that composition does not work if the second query has extra joins. Those extra joins come from related fields that may occur from the domain. The fix consists in recomposing the query with a join condition that does not depend on a dynamic domain, and injecting the domain in the where clause of the main query. With this strategy, the joins that appear because of the related fields in the domain are part of the main query, and are no longer lost by the composition. Note also that the test test_same_user_overlap_with_allocated_hours_less_than_workable_hours was actually broken, because the field allocated_hours wasn't flushed when doing the SQL query. The new query flushes the field, and the test has been fixed.
This fix makes Odoo more stable when working with newly created records before they are saved. It prevents errors during automatic field updates and display-name calculations, reducing interruptions in workflows such as field service reporting and Belgian tax reporting.
AI-generated values for HTML fields now keep the same formatting regardless of optional conversion tools installed on the system. This prevents inconsistent output and resolves related automated test failures, improving reliability for teams using AI fields.
Original PR description
Purpose: ------- After the changes introduced in commit e6438de, depending on if markdown2 is installed or not, ai values for html fields did not have the same format (a trailing "\n" was added with markdown2). This commit removes the unnecessary "\n" added by markdown2. Fixes runbot errors 230097 and 230098
Users with view-only access to shared PDF documents no longer see the split PDF option. This prevents them from running an action they are not allowed to complete, avoiding a confusing error and improving the document sharing experience.
Original PR description
When a user with only view permissions attempts to split a PDF, an error occurs: Unexpected token '<', "<!doctype "... is not valid JSON **Steps to Reproduce:** - Go to Documents. - Choose a PDF file. - Click on Share and select Internal Users with Viewer permission. - Copy the generated link. - Open the link in another window as a non-manager user. - Click on split PDF then split The fix consists in hiding the pdf split functionality for users without edit permission. opw-4354451 Forward-Port-Of: odoo/enterprise#89764 Forward-Port-Of: odoo/enterprise#75803
This change fixes an access problem that could prevent users from using the salary configurator correctly. It removes an unnecessary company-related recalculation that was causing permissions issues, while keeping company filtering already handled elsewhere.
Original PR description
Since this commit: https://github.com/odoo/enterprise/commit/b68569868c00765bca910b5630a72db75347c03d, the salary configurator had an access issue on hr.job model. This is due to the compute method on company_id introduced in the previous commit. As the properties definition field of the hr_job is defined on the company, it was recomputed every time the company commute is triggered. Additionnaly, this compute on the company_id is useless as the domain on the contract_template_id is already filetered based on the company. A test for this is added in this PR: https://github.com/odoo/enterprise/pull/90412 task-4951648
This fixes a configuration issue in Swiss payroll ELM transmission by removing an inappropriate default value from a linked setting. It helps ensure payroll transmission settings reflect the company configuration correctly and avoids misleading preset values.
Original PR description
…lated field Forward-Port-Of: odoo/enterprise#90490 Forward-Port-Of: odoo/enterprise#90425
When a report is opened in Studio without an existing template, the system now automatically creates the standard views it needs. This prevents crashes and lets users continue editing reports created from the technical menu.
Users without administrator settings access can now use the Reload AI Data button on invoices without hitting an access error. This keeps AI-powered invoice processing available to functional users while preserving the existing tax localization check.
Original PR description
When clicking on the "Reload AI Data" button (`account.move::action_reload_ai_data`), a user not in `base.group_system` group encounters an access rights error when searching on `ir.module.module` model in `account.move::is_indian_taxes()`:
```python
def is_indian_taxes(self):
l10n_in = self.env['ir.module.module'].search([('name', '=', 'l10n_in')])
return self.company_id.country_id.code == "IN" and l10n_in and l10n_in.state == 'installed'
```
This commit adds `sudo()` to the `search` call to ensure that the check for the 'l10n_in' module does not fail for users not belonging to "Administration/Settings" group.
This prevents a traceback and ensures that functional users can reload AI data.
Forward-Port-Of: odoo/enterprise#90021Code cleanup and technical improvements
This change makes automated checks in Odoo Studio wait for the exact content they need before continuing. It reduces intermittent test failures, helping teams validate Studio reporting behavior more consistently without changing end-user functionality.
Original PR description
In this commit, we simplify the assertions made in run functions with more explicit triggers that use Hoot's pseudo-selectors. This is almost the same thing, except that the macro system waits to…
In this commit, we simplify the assertions made in run functions with more explicit triggers that use Hoot's pseudo-selectors. This is almost the same thing, except that the macro system waits to find the trigger (animationFrame by animationFrame). If, for some reason, the parent element already exists but not the child element sought in the run function, then the tour spits out... indeterministically.
So this commit can also fix tours.
For example:
{
trigger: ".o-web-studio-report-container :iframe body",
run() {
assertEqual(
this.anchor.querySelector(".test-added-0").textContent,
"in document view"
);
assertEqual(this.anchor.querySelector(".test-added-1").textContent, "in main view");
},
},
:iframe body is present but not ".test-added-0" yet ... then the assertion failed when it is enough just to wait for the element to be in the dom.
Is fixed with :
{
trigger: ".o-web-studio-report-container :iframe body .test-added-0:contains(in document view)",
},
{
trigger: ".o-web-studio-report-container :iframe body .test-added-1:contains(in main view)",
}
Forward-Port-Of: odoo/enterprise#904041 change
Code cleanup and technical improvements
This update replaces repeated logic with a shared check for early payment discounts in the accounting reconciliation flow. It keeps behavior aligned with the main Odoo codebase and reduces maintenance risk without changing day-to-day user workflows.
Original PR description
This is repeated code from what already exists in odoo community. OPW-4895365 See: [odoo/odoo#215615](https://github.com/odoo/odoo/pull/215615)