diff --git a/addons/auth_ldap/users_ldap.py b/addons/auth_ldap/users_ldap.py
index 2c7523db430..92d723af3d9 100644
--- a/addons/auth_ldap/users_ldap.py
+++ b/addons/auth_ldap/users_ldap.py
@@ -249,6 +249,10 @@ class users(osv.osv):
return user_id
registry = RegistryManager.get(db)
with registry.cursor() as cr:
+ cr.execute("SELECT id, active FROM res_users WHERE lower(login)=%s", (login,))
+ res = cr.fetchone()
+ if res:
+ return False
ldap_obj = registry.get('res.company.ldap')
for conf in ldap_obj.get_ldap_dicts(cr):
entry = ldap_obj.authenticate(conf, login, password)
diff --git a/addons/payment/__openerp__.py b/addons/payment/__openerp__.py
index c192bec7c1b..a3843a872c1 100644
--- a/addons/payment/__openerp__.py
+++ b/addons/payment/__openerp__.py
@@ -12,6 +12,7 @@
'views/payment_acquirer.xml',
'views/res_config_view.xml',
'security/ir.model.access.csv',
+ 'security/payment_security.xml',
],
'installable': True,
'auto_install': True,
diff --git a/addons/payment/security/ir.model.access.csv b/addons/payment/security/ir.model.access.csv
index 18f98939472..f52f9a44d4e 100644
--- a/addons/payment/security/ir.model.access.csv
+++ b/addons/payment/security/ir.model.access.csv
@@ -2,6 +2,6 @@ id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink
payment_acquirer_all,payment.acquirer.all,model_payment_acquirer,,1,0,0,0
payment_acquirer_user,payment.acquirer.user,model_payment_acquirer,base.group_user,1,1,1,0
payment_acquirer_system,payment.acquirer.system,model_payment_acquirer,base.group_system,1,1,1,1
-payment_transaction_all,payment.transaction.all,model_payment_transaction,,1,1,1,0
+payment_transaction_all,payment.transaction.all,model_payment_transaction,,1,0,0,0
payment_transaction_user,payment.transaction.user,model_payment_transaction,base.group_user,1,1,1,0
payment_transaction_system,payment.transaction.system,model_payment_transaction,base.group_system,1,1,1,1
\ No newline at end of file
diff --git a/addons/payment/security/payment_security.xml b/addons/payment/security/payment_security.xml
new file mode 100644
index 00000000000..7bae346c648
--- /dev/null
+++ b/addons/payment/security/payment_security.xml
@@ -0,0 +1,24 @@
+
+
+
+
+
+ Access own payment transaction only
+
+ [
+ '|',
+ ('partner_id','=',False),
+ ('partner_id','=',user.partner_id.id)
+ ]
+
+
+
+
+ Access every payment transaction
+
+ [(1, '=', 1)]
+
+
+
+
+
diff --git a/addons/payment_paypal/models/paypal.py b/addons/payment_paypal/models/paypal.py
index 3021c685e90..c94622a690b 100644
--- a/addons/payment_paypal/models/paypal.py
+++ b/addons/payment_paypal/models/paypal.py
@@ -14,6 +14,7 @@ from openerp.addons.payment.models.payment_acquirer import ValidationError
from openerp.addons.payment_paypal.controllers.main import PaypalController
from openerp.osv import osv, fields
from openerp.tools.float_utils import float_compare
+from openerp import SUPERUSER_ID
_logger = logging.getLogger(__name__)
@@ -69,13 +70,14 @@ class AcquirerPaypal(osv.Model):
res = cr.fetchall()
for (company_id, company_paypal_account) in res:
if company_paypal_account:
- company_paypal_ids = self.search(cr, uid, [('company_id', '=', company_id), ('name', '=', 'paypal')], limit=1, context=context)
+ company_paypal_ids = self.search(cr, uid, [('company_id', '=', company_id), ('provider', '=', 'paypal')], limit=1, context=context)
if company_paypal_ids:
self.write(cr, uid, company_paypal_ids, {'paypal_email_account': company_paypal_account}, context=context)
else:
paypal_view = self.pool['ir.model.data'].get_object(cr, uid, 'payment_paypal', 'paypal_acquirer_button')
self.create(cr, uid, {
- 'name': 'paypal',
+ 'name': 'Paypal',
+ 'provider': 'paypal',
'paypal_email_account': company_paypal_account,
'view_template_id': paypal_view.id,
}, context=context)
@@ -104,7 +106,7 @@ class AcquirerPaypal(osv.Model):
return fees
def paypal_form_generate_values(self, cr, uid, id, partner_values, tx_values, context=None):
- base_url = self.pool['ir.config_parameter'].get_param(cr, uid, 'web.base.url')
+ base_url = self.pool['ir.config_parameter'].get_param(cr, SUPERUSER_ID, 'web.base.url')
acquirer = self.browse(cr, uid, id, context=context)
paypal_tx_values = dict(tx_values)
diff --git a/addons/point_of_sale/point_of_sale.py b/addons/point_of_sale/point_of_sale.py
index 67fdf5cf196..aeb1ca8ea46 100644
--- a/addons/point_of_sale/point_of_sale.py
+++ b/addons/point_of_sale/point_of_sale.py
@@ -396,6 +396,7 @@ class pos_session(osv.osv):
if not cashids:
cashids = journal_proxy.search(cr, uid, [('journal_user','=',True)], context=context)
+ journal_proxy.write(cr, uid, cashids, {'journal_user': True})
jobj.write(cr, uid, [pos_config.id], {'journal_ids': [(6,0, cashids)]})
diff --git a/addons/portal_sale/security/ir.model.access.csv b/addons/portal_sale/security/ir.model.access.csv
index 02c4db9fb1c..88cd0e961d3 100644
--- a/addons/portal_sale/security/ir.model.access.csv
+++ b/addons/portal_sale/security/ir.model.access.csv
@@ -9,3 +9,7 @@ access_product_list,product.pricelist,product.model_product_pricelist,base.group
access_res_partner,res.partner,base.model_res_partner,base.group_portal,1,0,0,0
access_account_tax,account.tax,account.model_account_tax,base.group_portal,1,0,0,0
access_res_partner_category,res.partner.category,base.model_res_partner_category,base.group_portal,1,0,0,0
+access_product_attribute_portal,product.attribute portal,product.model_product_attribute,base.group_portal,1,0,0,0
+access_product_attribute_value_portal,product.attribute value portal,product.model_product_attribute_value,base.group_portal,1,0,0,0
+access_product_attribute_price_portal,product.attribute price portal,product.model_product_attribute_price,base.group_portal,1,0,0,0
+access_product_attribute_line_portal,product.attribute line portal,product.model_product_attribute_line,base.group_portal,1,0,0,0
diff --git a/addons/website_sale/controllers/main.py b/addons/website_sale/controllers/main.py
index 537f2f004f7..75d5a4058af 100644
--- a/addons/website_sale/controllers/main.py
+++ b/addons/website_sale/controllers/main.py
@@ -700,7 +700,7 @@ class website_sale(http.Controller):
}
tx_ids = request.registry['payment.transaction'].search(
- cr, uid, [
+ cr, SUPERUSER_ID, [
'|', ('sale_order_id', '=', order.id), ('reference', '=', order.name)
], context=context)
@@ -715,7 +715,7 @@ class website_sale(http.Controller):
message = ""
validation = None
else:
- tx = request.registry['payment.transaction'].browse(cr, uid, tx_ids[0], context=context)
+ tx = request.registry['payment.transaction'].browse(cr, SUPERUSER_ID, tx_ids[0], context=context)
state = tx.state
if state == 'done':
message = '
%s
' % _('Your payment has been received.')
diff --git a/addons/website_sale/models/sale_order.py b/addons/website_sale/models/sale_order.py
index 60785910834..ebc7bcab5b7 100644
--- a/addons/website_sale/models/sale_order.py
+++ b/addons/website_sale/models/sale_order.py
@@ -205,9 +205,9 @@ class website(orm.Model):
transaction_obj = self.pool.get('payment.transaction')
tx_id = request.session.get('sale_transaction_id')
if tx_id:
- tx_ids = transaction_obj.search(cr, uid, [('id', '=', tx_id), ('state', 'not in', ['cancel'])], context=context)
+ tx_ids = transaction_obj.search(cr, SUPERUSER_ID, [('id', '=', tx_id), ('state', 'not in', ['cancel'])], context=context)
if tx_ids:
- return transaction_obj.browse(cr, uid, tx_ids[0], context=context)
+ return transaction_obj.browse(cr, SUPERUSER_ID, tx_ids[0], context=context)
else:
request.session['sale_transaction_id'] = False
return False
diff --git a/addons/website_sale/views/sale_order.xml b/addons/website_sale/views/sale_order.xml
index ad90e1e7c43..2568ec21603 100644
--- a/addons/website_sale/views/sale_order.xml
+++ b/addons/website_sale/views/sale_order.xml
@@ -8,8 +8,8 @@
-
-
+
+
diff --git a/openerp/models.py b/openerp/models.py
index da53a763376..6b909be1043 100644
--- a/openerp/models.py
+++ b/openerp/models.py
@@ -3694,6 +3694,7 @@ class BaseModel(object):
readonly = None
self.check_field_access_rights(cr, user, 'write', vals.keys())
+ deleted_related = defaultdict(list)
for field in vals.keys():
fobj = None
if field in self._columns:
@@ -3702,6 +3703,10 @@ class BaseModel(object):
fobj = self._inherit_fields[field][2]
if not fobj:
continue
+ if fobj._type in ['one2many', 'many2many'] and vals[field]:
+ for wtuple in vals[field]:
+ if isinstance(wtuple, (tuple, list)) and wtuple[0] == 2:
+ deleted_related[fobj._obj].append(wtuple[1])
groups = fobj.write
if groups:
@@ -3905,7 +3910,8 @@ class BaseModel(object):
for id in ids_to_update:
if id not in done[key]:
done[key][id] = True
- todo.append(id)
+ if id not in deleted_related[model_name]:
+ todo.append(id)
self.pool[model_name]._store_set_values(cr, user, todo, fields_to_recompute, context)
# recompute new-style fields
diff --git a/openerp/modules/loading.py b/openerp/modules/loading.py
index 0568b0d1a38..61e573de3ff 100644
--- a/openerp/modules/loading.py
+++ b/openerp/modules/loading.py
@@ -278,6 +278,7 @@ def load_modules(db, force_demo=False, status=None, update_module=False):
if not openerp.modules.db.is_initialized(cr):
_logger.info("init db")
openerp.modules.db.initialize(cr)
+ update_module = True # process auto-installed modules
tools.config["init"]["all"] = 1
tools.config['update']['all'] = 1
if not tools.config['without_demo']: