Monday, February 9, 2026
26 changes · saas-19.1
Resolved issues and error corrections
This update resolves an issue where non-manager users were receiving an error message when opening validated time off records. The fix prevents unnecessary updates to a field that wasn't required, ensuring a smoother experience for all users. This change improves usability for employees accessing their time off details.
Original PR description
Steps to reproduce: ------------------- 1. Install `l10n_in` and `l10n_in_hr_holidays` 2. Switch to an Indian company 3. Create a user and related employee without Time Off rights 4. Log in with the…
Steps to reproduce: ------------------- 1. Install `l10n_in` and `l10n_in_hr_holidays` 2. Switch to an Indian company 3. Create a user and related employee without Time Off rights 4. Log in with the new user and create a past time off 5. Approve the time off as an time off manager/admin 6. Open the validated time off record as the employee Issue: ------ Opening a validated time off raises the following UserError: ```python You must have manager rights to modify/validate a time off that already begun. ``` Cause: ------ The `_get_durations` method in `l10n_in_hr_holidays` was updating the `l10n_in_contains_sandwich_leaves` field every time it was executed. When a user opened a validated time off record, this triggered a `write()` operation. Since non-manager users are not allowed to write on already started validated leaves, this caused a [UserError](https://github.com/odoo/odoo/blob/047d5b61a5f3fc5c41f5bc3975938a53b5da49a7/addons/hr_holidays/models/hr_leave.py#L793-L798) The field `l10n_in_contains_sandwich_leaves` does not need to be updated when `l10n_in_is_sandwich_leave` is False. See [[1]](https://github.com/odoo/odoo/blob/047d5b61a5f3fc5c41f5bc3975938a53b5da49a7/addons/l10n_in_hr_holidays/models/hr_leave.py#L156-L157) & [[2]](https://github.com/odoo/odoo/blob/047d5b61a5f3fc5c41f5bc3975938a53b5da49a7/addons/l10n_in_hr_holidays/models/hr_leave.py#L62) And this [part of the code](https://github.com/odoo/odoo/blob/047d5b61a5f3fc5c41f5bc3975938a53b5da49a7/addons/l10n_in_hr_holidays/models/hr_leave.py#L160-L173) is responsible to update `l10n_in_contains_sandwich_leaves` value. **NOTE:** Opening future validated time off records as a non-manager user triggers `AccessError` as it is not allowed to update the validated time off record. Solution: --------- Ensure that `l10n_in_contains_sandwich_leaves` is updated only when `indian_leaves` is applicable. opw-5373055 --- I confirm I have signed the CLA and read the PR guidelines at www.odoo.com/submit-pr Forward-Port-Of: odoo/odoo#246078 Forward-Port-Of: odoo/odoo#240056
This update resolves an issue where emails couldn't be sent to applicants who had been archived in the recruitment system. The fix ensures that archived applicants are correctly included when sending emails, preventing a disruption in the applicant communication process. This improves the reliability of the recruitment workflow.
Original PR description
Version: - 17.0 Steps to reproduce: - Create an applicant. - Archive the applicant. - Select the archived applicant. - Click the Send Email action. Issue: - Unable to Send Emails to Refused Applicants Cause: - The applicant_ids many2many field does not include archived applicants. Because of this, when an applicant is archived, the field becomes empty. Solution: - Add active_test to the field context. Task - 5786195 Forward-Port-Of: odoo/odoo#244691
This update resolves an issue where users were unexpectedly logged out when viewing images through certain security proxies (like Cisco Secure Email). The fix disables automatic session saving for image requests, preventing Odoo from creating a new session and triggering the logout. This ensures consistent functionality across browsers.
Original PR description
## Problem A logout occurs when an image in the chatter is requested through a third-party security proxy (like Cisco Secure Email or Microsoft SafeLinks) via a boomerang redirect following this…
## Problem
A logout occurs when an image in the chatter is requested through a third-party security proxy (like Cisco Secure Email or Microsoft SafeLinks) via a boomerang redirect following this flow:
- A user (Person A) opens an Odoo record. The chatter contains an image previously sent by a correspondent (Person B) whose email client or mail server rewrote the image URL to point to a security proxy.
- Firefox tries to load the image. The URL points to `cisco.com/...`. (for example)
- The proxy scans the link and redirects the browser back to the original Odoo URL: `odoo.com/web/image/...`.
- Firefox follows the strict (now deprecated) `rfc6265bis` rule: it looks at the whole redirect chain.
Since it sees a cross-site hop (cisco.com), it flags the final request as cross-site.
-> Because Odoo's session_id is `SameSite=Lax`, Firefox refuses to send
the cookie on this "false" redirect
- Odoo receives the request at `/web/image` without a session_id.
- Odoo creates a new, empty session to process the request.
- At the end of the request, because save_session is True by default, Odoo sends a `Set-Cookie: session_id=NEW_EMPTY_ID` header in the response.
- The browser receives this `Set-Cookie` header, and this time *applies a different policy*: it considers the header as same-origin, allowing it to overwrite the previously valid session cookie with this new one that corresponds to a fresh, unauthenticated session.
- The user is instantly logged out of their current Odoo tab.
## Context on Web Compatibility
This "redirect chain consideration" was a controversial part of the `RFC6265bis` draft.
Chrome and Safari never fully implemented it because telemetry showed it broke ~1% of the web. In March 2024, the HTTP Working Group (HTTPWG) officially decided to remove this requirement from the spec (reverting to a more permissive model) because it was deemed not web-compatible. Firefox, however, still enforces this strict behavior in many versions.
## How to we fix this
We set `routing={'save_session': False}` on the `/web/image controller`.
- This prevents Odoo from sending the `Set-Cookie` header if the session is dirty or new.
- Even if Firefox sends the request without a cookie, Odoo won't "reply" with a new session ID.
- The user's legitimate session cookie remains untouched in the browser.
## Sources
- HTTPWG Decision (March 2024): https://github.com/httpwg/http-extensions/issues/2104
- Reverting RFC6265bis: https://github.com/httpwg/http-extensions/pull/2750
opw-5184217
opw-4698750
opw-5166151
Forward-Port-Of: odoo/odoo#242582
Forward-Port-Of: odoo/odoo#242061This update replaces a real tax ID placeholder in the base_vat module for Turkey. This change prevents users from accidentally using the placeholder for actual transactions, ensuring data integrity and compliance. It's a minor update focused on security and accuracy.
Original PR description
The previous placeholder used a real tax ID. Replacing it with a dummy prevents users from using it to submit transactions. task-5441218 --- I confirm I have signed the CLA and read the PR guidelines at www.odoo.com/submit-pr Forward-Port-Of: odoo/odoo#247454 Forward-Port-Of: odoo/odoo#242189
This update removes a problematic feature from the dynamic SVG builder to prevent errors and improve stability. The 'image shape' option, previously available for dynamic SVGs, was causing issues due to unsupported shape functionality. Removing this option ensures a smoother user experience.
Original PR description
The image shape option was added for dynamic SVG with the new builder in saas-18.4. However, this seems to be an error since shapes are not supported with dynamic SVG. The image shape option will not appear anymore in such cases to avoid tracebacks for the user. task-5451405 Forward-Port-Of: odoo/odoo#247440 Forward-Port-Of: odoo/odoo#242506
This update restores the ability for support staff to edit the IAP token within the IAP account form. Previously, this token was locked down, hindering the process of migrating databases between environments. This change ensures smoother database transitions and operational efficiency.
Original PR description
Currently the IAP token (`account_token`) is readonly in the IAP account form view. It was made readonly in this commit https://github.com/odoo/odoo/commit/8a96f0fc3f18bd1ccfa96e654ef6f74b21593288#diff-f05503a4bccde75e6ef0c6ab5cd0dbd9fa0e32a30da505bdfcab8c7ed3a4a24cR33 Support needs to edit it when moving a DB from test to production though. After this commit it is editable (again; like in lower versions). task-None
This update fixes an error that occurred when all variants of a product were deleted, preventing the Shop page from loading correctly. The issue stemmed from an outdated system requirement that no longer allowed empty IDs. This change ensures the Shop page remains functional even after variants are removed, improving the user experience.
Original PR description
When all variants of a product template are deleted, opening the Shop page on the website raises a traceback. Steps to reproduce the error: - Install ``website_sale`` module - Go to settings > Enable…
When all variants of a product template are deleted, opening the Shop page on the website raises a traceback. Steps to reproduce the error: - Install ``website_sale`` module - Go to settings > Enable variants - Create a product template > In Attributes & Variants Tab > add one attribute with two values > Save - Click on the variants smart button > select all > delete - Go to Website > Shop Traceback: ```py AssertionError: Invalid falsy real id ``` https://github.com/odoo/odoo/blob/b6598c11a3580cfc6ff1ffeb67b0d388c55383d1/addons/website_sale/controllers/main.py#L456 After [commit](https://github.com/odoo/odoo/commit/4290724a4c8c57fba4f4d3d688d38f65dadcc38f), falsy IDs are no longer allowed in ``browse()``. When all variants of a product template are deleted, ``product._get_first_possible_variant_id()`` returns False. This falsy value is later passed to ``browse()``, which triggers the above traceback. [1]: https://github.com/odoo/odoo/commit/4290724a4c8c57fba4f4d3d688d38f65dadcc38f sentry-7201563878 --- I confirm I have signed the CLA and read the PR guidelines at www.odoo.com/submit-pr
This update fixes an issue where TDS report amounts were incorrectly displayed as negative values in version 19.1. The fix adds a necessary negative sign prefix to the report formulas, ensuring TDS amounts are shown accurately as positive values, aligning with previous versions.
Original PR description
**Steps to reproduce:** * Install the **l10n_in** module. * Create vendor bills with applicable **TDS taxes** (e.g. Section **194C**, **194A**, **195**). * Post the bills. * Go to **Accounting → Reporting → TDS Report**. **Observed behavior:** * TDS amounts are displayed as **negative values** across all sections (192, 193, 194A–Q, 195, etc.). * This differs from versions up to **18.3**, where TDS amounts were shown as positive. **Cause:** * In v19, the automatic **+/− sign handling** was removed from the tax grid logic. [REF](https://github.com/odoo/odoo/commit/17a6117ed88c29b5bc4db0c872bcdbc109a7d98b) * TDS report formulas were missing an explicit **negative sign prefix**, causing amounts to appear inverted. **Fix:** * Add the required **negative sign prefix** to all TDS section formulas in `account_tax_report_tds_data.xml`. * Ensures TDS amounts are displayed as **positive values**. * Applies to all TDS sections. opw-5502385 Forward-Port-Of: odoo/odoo#247123
This update resolves an issue where users with read-only access to shared documents were encountering errors when opening the chatter associated with those documents. The fix ensures the system verifies a user's access rights before attempting to update document thumbnails, preventing the error and improving usability.
Original PR description
How to reproduce: - Install documents - Create a folder at the root (company) not shared to anyone (including internal user) - Open that folder and ensure the chatter is closed - Upload a document in it and share it with Marc Demo with view access - Connect with Marc Demo, click on that shared document and open the chatter You get an error because the client try to update the thumbnail of the attachment for the chatter but the user has only view access to it. The user doesn't have write access to the attachment because it is linked to a document with only read access. To solve the problem, we modify the check that trigger the thumbnail update to also check that the user has access to the related record. Task-5360962 Forward-Port-Of: odoo/odoo#244205
This update corrects a visual issue with the mega menu on the website, specifically aligning the toggle elements in desktop views when using the 'Hamburger' template. The fix ensures consistent alignment across different screen sizes, improving the user experience. This resolves a previous misalignment that was present in the mobile view but not the desktop.
Original PR description
The PR [1] updated the templates for many headers to adapt the nav-item positions in desktop/mobile views. However, the hamburger menu was not updated correctly. In the desktop view, the mega menu toggle elements were not aligned properly (unlike in the mobile view). This commit fixes the PR by adding the necessary <xpath>. Steps to reproduce the issue: - Go to Website - Add a Mega Menu (edit menu) - Click on the header - Set the template to "Hamburger" - Set the text alignment to center for the desktop view => The mega menu toggle is not centered. task-5416632 --------------------------------------------- [1]: https://github.com/odoo/odoo/pull/225672 Forward-Port-Of: odoo/odoo#242475
This update fixes a discrepancy in the French chart of accounts where expense accounts were incorrectly assigned sale taxes instead of purchase taxes. This change ensures accurate tax calculations for expense reporting in the French version of Odoo, aligning with accounting regulations. The fix was driven by a previous support ticket (opw-5891867).
Original PR description
**PROBLEM** In the fr chart of account, default taxes for expense account are sale taxes while they should be purchase taxes. opw-5891867
This update resolves an issue where portal users couldn't properly close recurrent tasks. The fix uses a temporary bypass of security restrictions to ensure the task state is correctly updated when a portal user changes the task's status. This enhancement improves the portal user experience and ensures tasks are managed as expected.
Original PR description
to reproduce: ============= - create a project with recurrent task and share it with a portal user - log in with the portal user and open the recurrent task - change the state to 'Done' and save -> the state is not changed to 'Done' and the task is not closed problem: ======== the method responsible for creating the next occurrence of a recurrent task executes some operations that portal users are not allowed to do, causing the whole operation to fail and preventing the task from being updated. solution: ========= use sudo() to bypass access rights checks when creating the next occurrence of the recurrent task. This is safe because the operations being performed do not involve any sensitive data or actions that could compromise security. opw-5442919 --- I confirm I have signed the CLA and read the PR guidelines at www.odoo.com/submit-pr Forward-Port-Of: odoo/odoo#247001
This update ensures the Odoo codebase is checked for code style issues using Ruff, a modern Python linter. The change includes support for the OLS noqa directive, improving code readability and consistency. This is a routine maintenance update to maintain best practices for our development environment.
Original PR description
- update for ruff 0.15.0 - support OLS noqa Description of the issue/feature this PR addresses: Current behavior before PR: Desired behavior after PR is merged: --- I confirm I have signed the CLA and read the PR guidelines at www.odoo.com/submit-pr Forward-Port-Of: odoo/odoo#247771
This update resolves a bug that prevented a key tour from running correctly. The fix automatically ensures the product column is visible during the tour process, eliminating a manual step. Additionally, the update improves compatibility with the purchase product matrix module.
Original PR description
Commit 01848b5 missed a case causing the `test_add_section_from_product_catalog_on_invoice_tour` tour to fail. To resolve this, `showProductColumn()` is now called automatically within `addSectionFromProductCatalog()`. This ensures the product column is visible before content verification, removing the need for manual calls in other tours. Additionally, the `showProductColumn()` trigger is updated to support both `product_id` and `product_template_id`, ensuring compatibility with the `purchase_product_matrix` module. runbot-234872 --- I confirm I have signed the CLA and read the PR guidelines at www.odoo.com/submit-pr Forward-Port-Of: odoo/odoo#247176
This update fixes an issue where the IoT Box sometimes updated before the database, leading to outdated handler files. By ensuring the correct ETags are removed, the system now reliably re-downloads handler files to the IoT Box, maintaining data consistency. This prevents errors and ensures proper functionality.
Original PR description
The IoT Box will, most of the time, update before the database does. In such event, the custom handlers will be removed from the IoT Box, but the etag of the files downloaded from the server will be kept, making the db return a 304 (not modified) when trying to download the handlers again. We now ensure that this etag is removed, so that the database sends the files again.
This update fixes a confusing user experience where the 'New Project' and 'Share Project' buttons used the same shortcut (Alt+R). The shortcut has been changed to Alt+C to prevent accidental activation of the wrong function, ensuring a smoother project creation process.
Original PR description
Steps to Reproduce: - - Go to Project → open any project. - Press Alt key to display shortcut hints. - Both New and Share buttons show the same shortcut. Issue: - The New button and the Share Project button use the same shortcut, leading to a conflict. Cause: - The New button and the Share Project button share the same shortcut (Alt+R) causing the wrong action to trigger. Solution: - Changed the shortcut for the New button from Alt+R to Alt+C to avoid conflict and ensure correct behavior. task-5270075 Forward-Port-Of: odoo/odoo#237694
A shortcut issue was resolved that caused users to unintentionally change task priorities instead of creating new tasks. The New button's shortcut was changed from Alt+R to Alt+C to prevent this conflict and ensure the intended functionality is consistently available.
Original PR description
Steps to Reproduce: - - Open Project → Tasks. - Press Alt key to view shortcut hints. - New button control show Alt+R. - Pressing Alt+R triggers priority change instead of creating a new record. Issue: - Pressing the shortcut displayed on the New button (Alt+R) does not create a new task but instead changes the task priority. Cause: - The New button and the Priority widget share the same shortcut (Alt+R), causing the wrong action to trigger. Solution: - Changed the shortcut for the New button from Alt+R to Alt+C to avoid conflict and ensure correct behavior. task-5270075 Forward-Port-Of: odoo/odoo#237555
This update resolves an issue where date-filtered data disappeared in POS tours after page refreshes. The fix introduces a mechanism to save and restore the frozen time using session storage, ensuring tours continue to function correctly and tests pass reliably. This improves the overall user experience during POS training and demonstrations.
Original PR description
Mocking time in tours via `freezeDateTime` is lost when the page reloads , causing date-filtered data to disappear and tests to fail. Introduce `withTimeFreeze(millis, steps)`, which persists the mock timestamp in `sessionStorage`. POS now checks this storage on module load to automatically re-apply the freeze, ensuring the clock survives refreshes while handling cleanup after the steps finish. runbot-232601 Related Enterprise PR: odoo/enterprise#106724 Forward-Port-Of: odoo/odoo#247596
This update fixes an inconsistent visual issue in the Field Service Report generated from the Bubble document layout. Previously, table borders appeared with mixed rounded and sharp edges. The fix adds a class to the table tags, ensuring a consistent and professional look for these reports.
Original PR description
Steps to reproduce: -------------------------------- 1. Install `industry_fsm_sale` module 2. Go to Settings > Configure Document Layout 3. Select the Bubble document layout and save 4. Open any…
Steps to reproduce: -------------------------------- 1. Install `industry_fsm_sale` module 2. Go to Settings > Configure Document Layout 3. Select the Bubble document layout and save 4. Open any Field Service task 5. Use the Products smart button to add one or more products 6. Click the Settings icon > Print > Field Service Report Observation: -------------------------------- In Time & Material tables using the Bubble layout, table borders show a mix of rounded corners and sharp edges, resulting in inconsistent visuals Issue: -------------------------------- The table tags in the report were missing the `table-borderless` class. As a result, the layout-applied rounded borders conflicted with the default table borders Solution: -------------------------------- Add the `table-borderless` class to the affected table tags so the tables inherit consistent rounded borders from the document layout Before: <img width="787" height="317" alt="before_css" src="https://github.com/user-attachments/assets/dac136a8-022a-4c36-8cdb-1c0fbb048f3e" /> After: <img width="816" height="372" alt="after_css" src="https://github.com/user-attachments/assets/b5f96e75-2cd3-44cf-89e3-9a3b564c8369" /> opw-5401612 Forward-Port-Of: odoo/enterprise#105616
This update fixes an issue where the Kanban view for manufacturing orders wasn't correctly filtering by the selected operation type. Previously, all active manufacturing orders were displayed. Now, the view accurately shows only those orders associated with the currently chosen operation type, ensuring accurate order tracking.
Original PR description
**Steps to reproduce:** * Install the *stock_barcode_mrp* module. * Go to *Inventory* ‣ *Configuration* ‣ *Operation Types*. * Create two operation types with *Type of Operation* set to…
**Steps to reproduce:**
* Install the *stock_barcode_mrp* module.
* Go to *Inventory* ‣ *Configuration* ‣ *Operation Types*.
* Create two operation types with *Type of Operation* set to *Manufacturing*.
* Create two manufacturing orders.
* In each manufacturing order, under the *Miscellaneous* tab
set a different *Operation Type* created above.
* Ensure sufficient *On Hand Quantity* exists for a product used in manufacturing.
* Open the *Barcode* application.
* Open one of the created manufacturing operation types.
**Observed behavior:**
* The kanban view displays **all** manufacturing orders whose picking
types are active, instead of only those related to the selected operation type.
**Cause:**
* In 19.0, the context key *`'search_default_picking_type_id': self.id`* was removed
from `_get_action` function in this [commit](https://github.com/odoo/odoo/commit/9ed7109b8f11260084374f2d7fa7073a9ad3c240)
* Previously, this context value restricted results to the current picking type by default.
* The method `get_action_picking_tree_ready_kanban` in *stock_barcode_mrp*
now overrides the domain with only *`('picking_type_id.active', '=', True)`*.
* This domain checks that the picking type is active but does not filter by
the selected picking type, causing unrelated MOs to be shown.
**Fix:**
* This ensures only manufacturing orders belonging to
the selected operation type are displayed.
---
opw-5819358
Forward-Port-Of: odoo/enterprise#105327This update resolves an issue where users with limited sign rights couldn't access the sample template. The fix ensures that users can correctly create and manage sign items within the sample template, allowing them to test and utilize the sample document. This improves the user experience for those exploring the sign workflow.
Original PR description
**Issue** Users without 'Admin' Sign rights could in some cases not access the sample template. **Steps to reproduce** 1. Go to 'Templates' and archive the existing one in order to have the 'Try our…
**Issue** Users without 'Admin' Sign rights could in some cases not access the sample template. **Steps to reproduce** 1. Go to 'Templates' and archive the existing one in order to have the 'Try our sample document' shown and click on it. 2. Add some sign items to the template, and send it for a signature request. 3. With an user having only 'User: Own Templates' Sign rights, go to 'Templates' and click 'Try our sample document'. Access Error: Blame the following rules: - sign.item: group_sign_user: Create and manage template items **Cause** When the template has an associated sign request, it is copied. The problem is that the user currently doesn't have enough rights to create sign items for the copied template: https://github.com/odoo/enterprise/blob/2e8fb2ca274a0cf15d7b78a663bffe9cbb700153/sign/security/security.xml#L92-L101 **Change** Change the `user_id` of the new template to allow creating the sign items for it. opw-5254566 Forward-Port-Of: odoo/enterprise#105656 Forward-Port-Of: odoo/enterprise#102227
This update resolves a technical issue where the user ID was sometimes missing during payments processed through the POS IoT Six module. This fix ensures accurate payment tracking and reporting within the system. It corrects a previous change that introduced this problem.
Original PR description
This PR reinstates https://github.com/odoo/enterprise/pull/98021 broken by https://github.com/odoo/enterprise/pull/98203 This fixes user id being undefined for pos_iot_six payments Forward-Port-Of: odoo/enterprise#106737
This update automatically generates unique employee IDs and sets the initial marital status to the employee's birthday by default for single individuals. This simplifies data entry and ensures more accurate employee records, enhancing the overall user experience.
Original PR description
For quality of life improvement, the unique employee identification is now automatically generated and initial marital status date is set to the birthday by default if the person is single Forward-Port-Of: odoo/enterprise#106752
This update corrects a minor issue in the calculation of payroll fees and deductions, specifically related to union and professional association fees. The change ensures more accurate processing of these deductions, leading to improved financial reporting and compliance for Australian businesses using the Enterprise module.
Original PR description
. Update `Union and professional association fees` code in computations of `Fees and Deductions` rule task-5402666 Forward-Port-Of: odoo/enterprise#104911
This update resolves a technical error that was preventing the correct display of names within Odoo's spreadsheet feature. The fix ensures that spreadsheet cell threads can accurately show the intended names, improving the user experience. This change was necessary to stabilize the spreadsheet functionality.
Original PR description
**Before this change** We were trying to set the `display_name` of one spreadsheet cell thread record to a set of more than one `display_name`s coming from a set of potentially multiple spreadsheets. **After this change** We use `record` instead of `self` when calling `_get_spreadsheet_record` so that it can only return a set of 1 `display_name`, preventing the crash that occurs when trying to set that field value. opw-5380947 Forward-Port-Of: odoo/enterprise#106673 Forward-Port-Of: odoo/enterprise#106230
This update resolves an issue where the restaurant appointment tour would fail after a page refresh due to a reset of the simulated time. The fix utilizes a new tool to maintain the correct date, ensuring the tour accurately displays appointments and functions consistently.
Original PR description
The `RestaurantAppointmentTour` fails when page refreshes reset the mock clock to system time, causing the frontend to filter out mock appointments and the tour to timeout. Refactor the tour to use the new `withTimeFreeze` helper, ensuring the simulated date persists across reloads so appointments remain visible. runbot-232601 Related Community PR: odoo/odoo#247596 Forward-Port-Of: odoo/enterprise#106724