Daily updates from Odoo
Wednesday, December 24, 2025
2 changes · 17.0
Resolved issues and error corrections
This update resolves an issue related to invoice QR codes generated for ZATCA compliance. Previously, the QR code included timezone information, which was incorrect. This change ensures the time data is sent in the correct Asia/Riyadh timezone format, meeting ZATCA requirements and avoiding potential processing delays.
Original PR description
In ZATCA phase 1, after converting the time to Asia/Riyadh timezone, the time information is added to the qr code in iso format which concatenates the timezone ("+03:00"). However, ZATCA expects the time to simply be sent as is in Asia/Riyadh timezone.
Task: 5319097
Description of the issue/feature this PR addresses:
Current behavior before PR:
Desired behavior after PR is merged:
---
I confirm I have signed the CLA and read the PR guidelines at www.odoo.com/submit-prThis update enhances security by ensuring that checks for employee addresses within the account batch payment process are performed with elevated permissions (sudo). Previously, this required users to be part of HR groups, which is now corrected to prevent unauthorized access to employee data. This change addresses a potential security vulnerability.
Original PR description
In commit a6ed1bd, new logic for handling employee addresses was introduced. However, the _get_all_addr function requires employee_ids, which implicitly requires access to the Employees model and, therefore, be in HR groups. During the compute process, _get_all_addr is only used to check whether an employee has an address; no address data is exposed. To fix this issue, the call to _get_all_addr should be executed with sudo(). OPW-5428523