Daily updates from Odoo
Tuesday, June 30, 2026
9 changes · 17.0
Security fixes and vulnerability patches
This update adds validation when customers subscribe to stock notifications, so alerts can only be created for products that are actually available to follow. It also prevents public visitors from using an email address already tied to a registered account, helping protect user accounts and avoid misuse.
Original PR description
Description of the issue/feature this PR addresses: Currently, in the website_sale_stock module, there is no backend validation when subscribing to notifications for products without stock. This…
Description of the issue/feature this PR addresses: Currently, in the website_sale_stock module, there is no backend validation when subscribing to notifications for products without stock. This allows public users to potentially use emails that belong to registered accounts. Current behavior before PR: Users could subscribe to stock notifications for products that don’t exist or cannot be added (no stock). Public users could use emails already associated with registered accounts, allowing them to subscribe on behalf of another user. No validation is enforced, leading to potential security issues. Desired behavior after PR is merged: Adding a subscription for a non-existent or unavailable product raises a ValidationError. Public users trying to subscribe with an email that belongs to a registered user receive an AccessError prompting them to sign in first. Backend validation prevents misuse of registered user emails and improves security. --- I confirm I have signed the CLA and read the PR guidelines at www.odoo.com/submit-pr
Resolved issues and error corrections
This update fixes a survey navigation issue where participants could be sent back to the homepage after reviewing correct answers and clicking Next. It ensures the survey continues to the next page as expected, improving the experience for public users taking scored surveys.
Original PR description
**Step To reproduce :** 1. Create a survey with `Scoring` set to `Scoring with answers after each page` 2. Add at least 2 pages, each with 1+ scorable question 3. As a public user, open the survey…
**Step To reproduce :**
1. Create a survey with `Scoring` set to `Scoring with answers after each page`
2. Add at least 2 pages, each with 1+ scorable question
3. As a public user, open the survey and start answering
4. Fill in the first page and click Continue
5. Correct answers are displayed with green/red highlights, submit button is replaced by Next
6. Click Next
7. Redirected to the homepage instead of the second page
**Issue:**
When survey scoring type is 'scoring_with_answers_after_page', after submitting a page the correct answers are displayed along with a "Next" button. Clicking "Next" redirects the user to the homepage because the answer_token is lost.
**Reason:**
The `<button id="next_page">` has no explicit `type` attribute, so it defaults to `type="submit"` per HTML spec. When clicked, the browser's default form submission fires a POST to `/survey/<survey_token>` (the answer_token is never in the URL path — only in the cookie). On the last page, `_nextScreen()` deletes the survey cookie to clean up after completion. The concurrent form POST then arrives at the server with answer_token=None → `token_required` → `redirect("/")`.
Additionally, jQuery's event delegation matches `button[type="submit"]` against the `type` property (which is `"submit"` by default for bare `<button>` elements), triggering `_onSubmit` which makes a second stale RPC call, compounding the issue.
**Solution:**
Added `event.preventDefault()` in the Next button's click handler within `_showCorrectAnswers` to stop the browser's default form submission behavior at the event level. This prevents the unintended POST request regardless of the button's type attribute, ensuring only the JS-driven `_nextScreen` transition executes.
opw-6268296This update brings in the latest version of the spreadsheet component used by Odoo. It includes fixes for font display on Linux, package and build updates, and dependency requirement adjustments to help keep the spreadsheet feature stable and reliable.
Original PR description
### Contains the following commits: https://github.com/odoo/o-spreadsheet/commit/e2afa94946 [REL] 17.0.101 [Task: 0](https://www.odoo.com/odoo/2328/tasks/0)…
### Contains the following commits: https://github.com/odoo/o-spreadsheet/commit/e2afa94946 [REL] 17.0.101 [Task: 0](https://www.odoo.com/odoo/2328/tasks/0) https://github.com/odoo/o-spreadsheet/commit/1ec83de135 [FIX] Fonts: Add default font for Linux [Task: 6328646](https://www.odoo.com/odoo/2328/tasks/6328646) https://github.com/odoo/o-spreadsheet/commit/1dd2dad5e6 [IMP] package: add runbot script [Task: 6316690](https://www.odoo.com/odoo/2328/tasks/6316690) https://github.com/odoo/o-spreadsheet/commit/e37d05ac2d [FIX] rolldown: Fix cjs file extension [Task: 0](https://www.odoo.com/odoo/2328/tasks/0) https://github.com/odoo/o-spreadsheet/commit/44d7f637bb [FIX] package-lock: update with removing node_modules [Task: 0](https://www.odoo.com/odoo/2328/tasks/0) https://github.com/odoo/o-spreadsheet/commit/fa9c81c197 [FIX] package.json: Update Node.js and npm engine requirements [Task: 0](https://www.odoo.com/odoo/2328/tasks/0) Co-authored-by: Florian Damhaut (flda) <flda@odoo.com> Co-authored-by: Anthony Hendrickx (anhe) <anhe@odoo.com> Co-authored-by: Alexis Lacroix (laa) <laa@odoo.com> Co-authored-by: Lucas Lefèvre (lul) <lul@odoo.com> Co-authored-by: Adrien Minne (adrm) <adrm@odoo.com> Co-authored-by: Ronak Mukeshbhai Bharadiya (rmbh) <rmbh@odoo.com> Co-authored-by: Dhrutik Patel (dhrp) <dhrp@odoo.com> Co-authored-by: Rémi Rahir (rar) <rar@odoo.com> Co-authored-by: Pierre Rousseau (pro) <pro@odoo.com> Co-authored-by: Vincent Schippefilt (vsc) <vsc@odoo.com> Co-authored-by: Marceline Thomas (matho) <matho@odoo.com>
This fix ensures invoice chatter messages show formatted text properly instead of exposing raw HTML tags to users. It improves the readability of communication history in the Chilean electronic invoicing flow.
Original PR description
Some invoice chatter messages are containing raw HTML tags. Because they are passed as standard strings instead of using the `Markup` wrapper, they are escaped them, causing the actual HTML tags to be displayed as literal text in the chatter. opw-6318439
This update adds the missing scheduling component needed by the rental module. It prevents errors when users open views that rely on the planning timeline, improving stability for rental operations.
Original PR description
Module was introduced without a dependency on the `web_gantt` module despite using `gantt` views. Already fixed in 19+ runbot error 237883
When users open the detailed list from a grid cell grouped by a selection field, the list title now shows the human-friendly label instead of the internal technical value. This makes the interface easier to understand and avoids confusing names like "non_billable" appearing to end users.
Original PR description
When grouping a grid view by a selection field and clicking on the cell magnifier, the list title showed the technical name (e.g. non_billable) instead of the display name (e.g. "Non Billable"). This commit adds a condition specifically for selection fields, ensuring that their display names are used. task-5980035
Uploaded WebP images are now checked against the same maximum resolution limit as other image formats. This prevents very large images from being accepted on the website or in attachments, helping keep uploads consistent and avoiding oversized files.
Original PR description
Since 17.0, `webp` images can be uploaded at any resolution, whereas every other format is refused above IMAGE_MAX_RESOLUTION (50 Mpx) when the attachment is created on the server. Root cause…
Since 17.0, `webp` images can be uploaded at any resolution, whereas every other format is refused above IMAGE_MAX_RESOLUTION (50 Mpx) when the attachment is created on the server. Root cause =========== `ImageProcess` grouped webp together with empty sources and SVG and set `self.image = False`, returning before the `verify_resolution` check. As a result the resolution limit enforced for `png/jpeg/...` was never applied to `webp`. Fix === Split `webp` out of the skip branch: it is still not processed as before, but its resolution is now read from the RIFF header with `get_webp_size()` and checked against `IMAGE_MAX_RESOLUTION`, so oversized webp images are refused on upload like any other format. Steps to reproduce =================== 1. Edit any page with the website editor 2. Upload a `webp` image larger than 50 Mpx (e.g. 8000x8000) => The image is accepted, while a `png/jpeg` of the same size is refused task-4134430 --- I confirm I have signed the CLA and read the PR guidelines at www.odoo.com/submit-pr
This fix ensures users can only set default values for fields they are allowed to edit. It prevents people from creating defaults on restricted fields, which helps keep data entry behavior consistent with their permissions.
Original PR description
Users should be able to set default values only for fields they have access to. --- I confirm I have signed the CLA and read the PR guidelines at www.odoo.com/submit-pr
The Mexican trial balance XML report now follows the SAT-recommended order for account nodes. This brings the generated file in line with the official structure, helping avoid validation or review issues when submitting reports.
Original PR description
**Steps to reproduce:** - Install the `l10n_mx_reports` module and switch to a Mexican company. - Navigate to Accounting > Reporting > Trial Balance. - From the dropdown menu, click `SAT (XML)`. -…
**Steps to reproduce:** - Install the `l10n_mx_reports` module and switch to a Mexican company. - Navigate to Accounting > Reporting > Trial Balance. - From the dropdown menu, click `SAT (XML)`. - Open the generated XML file and inspect the `<BCE:Ctas>` nodes. **Observation:** - The generated XML uses the following attribute order: `Debe > NumCta > Haber > SaldoFin > SaldoIni` - However, the SAT-recommended structure is: `NumCta > SaldoIni > Debe > Haber > SaldoFin` **Root Cause:** At [1], the attributes of the `<BCE:Ctas>` node are defined in an order that differs from the SAT-recommended structure. While the XML remains valid, the generated report does not match the layout recommended by the Mexican government specification. **Fix:** This commit reorders the `<BCE:Ctas>` attributes to follow the SAT-recommended structure, aligning the generated XML with the behavior introduced at [2] for `saas-19.3`. backport-of: https://github.com/odoo/enterprise/pull/115374 [1]: https://github.com/odoo/enterprise/blob/cb9c19272309d793379fa4d23145162f72fa5552/l10n_mx_reports/data/templates/cfdibalance.xml#L15-L20 [2]: https://github.com/odoo/enterprise/blob/acf0929a88ec788aecd44f6b4c647e468dc0a319/l10n_mx_reports/data/templates/cfdibalance.xml#L17-L22 opw-6297711