Commit Graph

93342 Commits

Author SHA1 Message Date
Coin Newell 31d817e849 [FIX] web: rotate session identifiers after login/logout
As recommended by OWASP
https://www.owasp.org/index.php/Session_Management_Cheat_Sheet#Renew_the_Session_ID_After_Any_Privilege_Level_Change

Closes #6760
2015-05-19 01:45:46 +02:00
Olivier Dony d5aa22ea5f [FIX] website, website_report: backwards compatibility with outdated templates
* Complements commits a696913364 and
21d4b3fda9 by adding the missing `data-lang`
attribute also in the report layout (in saas-6 a single QWeb
template is used for language links in both reports and website
layouts).

* Fix the "Edit Master" link to work also for outdated templates
where the data-lang attribute is dynamically set to 'default',
and thus cannot be used as URL prefix -> use /website/lang
controller to switch lang instead.
2015-05-18 19:34:11 +02:00
Denis Ledoux 235cd2d015 [FIX] mrp: find company bom when MO created from procurement through cron
Manufacturing Orders can be created from procurements,
as SUPERUSER_ID, since the procurements can be processed
through the WH scheduler, which is always ran as SUPERUSER_ID

In such a case, the record rules are ignored, and a BOM
normally not accessible to a user thanks to the multi-company
record rule could be chosen as the BOM of the MO.

This revision forces to find a BOM from a specific company
in such a case.

opw-640120
2015-05-18 17:20:31 +02:00
Christophe Simonis f722254018 [MERGE] forward port of branch saas-3 up to 0f5b6cf 2015-05-18 17:13:50 +02:00
Christophe Simonis 0f5b6cf60b [MERGE] forward port of branch 7.0 up to c435b84 2015-05-18 17:13:18 +02:00
Jeremy Kersten 30013c57ba [TYPO] website: add semicolon
Thanks @sle-odoo
2015-05-18 16:18:28 +02:00
Jeremy Kersten 21d4b3fda9 [FIX] website: force default lang for edit master option
Since user is redirected automatically in his preferred language, the button edit_master redirect always to
the current lang and so not the master.
2015-05-18 15:53:34 +02:00
Goffin Simon 1c90b9049b [FIX] website_sale_option: update product qty
When there is no user logged in the website, the product id must be written
in the DOM.

opw: 634535
2015-05-18 14:56:56 +02:00
Nicolas Martinelli f6c65a3d9e [FIX] website_sale: prevents the modification of a SO line if SO is not 'draft'
opw-634681
2015-05-18 13:08:01 +02:00
Nicolas Martinelli 6b7e6f6b90 [ADD] stock: onchange on wizard stock_change_product_qty
The proposed value for the new quantity on hand is calculated for the chosen
warehouse.

opw-639641
2015-05-18 12:54:20 +02:00
Denis Ledoux 439cdb6871 [FIX] report: print time in user timezone
In reports calling the internal headers layout,
e.g. the general ledger,
the print time was displayed in UTC,
while it should be in user tz.

closes #3341
opw-612043
2015-05-18 12:44:36 +02:00
Denis Ledoux a4c7c564cf [FIX] stock_account: average cost in multi-company environment
When receiving goods with average price set as costing method,
for a move from another company than the SUPERUSER_id company,
the average price updated was the one from the SUPERUSER company
instead of the one of the move.

opw-634167
2015-05-18 11:49:55 +02:00
Nicolas Lempereur 187ad0a054 [FIX] mail: chatter not shown when should
If the chatter is displayed, display the send message part.

Before it was only displayed if we can edit the record, but we are still
able to post in other case (i.e. if we are in the followers).

closes #6721
opw-631039
2015-05-15 17:08:45 +02:00
Nicolas Lempereur 02fb59fffa [FIX] website: widget share doesn't always work
Depending on the area (in this case a html field), the editor can escape
the url which wasn't taken into account by this widget.

closes #6726
opw-639852
2015-05-15 17:00:26 +02:00
Goffin Simon cab5e3668f [FIX] project: Project Time Unit
The domain set for the field 'project_time_mode_id' must use the xml_id to be
used with every languages.

opw:639603
2015-05-15 16:58:37 +02:00
Nicolas Martinelli bb63e9a012 [FIX] website_sale_delivery: display delivery desciption on the website
opw-639617
2015-05-15 14:22:46 +02:00
Denis Ledoux fb23de77a9 [FIX] google_calendar: multiple times the same reminder in an event
Use a set to prevent adding several time
the same calendar.alarm (reminder) in the same event

opw-639918
2015-05-15 14:04:55 +02:00
Nicolas Martinelli fefc8e0574 [FIX] mrp_repair: calculation of taxes
- Correct tax management in tab "Operations": use unit_price in tax computation
- Add tax calculation in tab "Invoicing" (Fees).

opw-639660
2015-05-15 10:17:05 +02:00
Yoshi Tashiro 6e2d610908 [CLA] RoomsForHK CCLA 2015-05-13 18:10:14 +02:00
Yoshi Tashiro 9eeb5deab7 [ADD] l10n_jp 2015-05-13 18:09:03 +02:00
Olivier Dony 223541edb4 [FIX] hw_scanner: spurious method rename in 5b19ae8a59
`scanner` is the route method to override in hw_proxy
2015-05-13 18:06:29 +02:00
Goffin Simon c435b8438e [FIX] web: With safari, UnicodeDecodeError
The headers returned by content_disposition must be either in Unicode or in ASCII.
The encode function expects a Unicode or ASCII string.
The quote function from urllib2 expects a UTF-8 string and retruns a ASCII string.

opw:634205
Fixes #6160, #6557
2015-05-13 16:56:12 +02:00
Goffin Simon 787a1422d7 [FIX] sale_stock: Additional information on invoice
When invoicing "on delivery", the "additional information" must be passed
from the SO to the invoice. Same behaviour as "on demand".

opw:639590
2015-05-13 14:36:37 +02:00
Nicolas Martinelli 769fc81140 [FIX] stock_account: fix dependencies
Purchase and Sale are not part of the dependencies of stock_account, so purchase_line_id
and sale_line_id might not exist.

Fixes #6619
2015-05-13 12:51:18 +02:00
Denis Ledoux 3e14a4ee5e [FIX] product: supplier pricelist field in partner form
This is related to revision 73432ffe9f.

The inherited view adding
the purchase pricelist field on the partner form
no longer worked for user being in the purchase pricelist group
but not in the sale pricelist group, since the field was added
after the sale pricelist field, which was no longer in the view
for these users.

This revision partially revert the above revision, but
add the purchase pricelist group in the groups of the view,
so the view is loaded only if the user is part of one group
or the other.

opw-639685
2015-05-13 11:57:11 +02:00
Denis Ledoux acd61f8f0e [FIX] purchase: deletion of PO lines in states other than approved/done
This is related to revision 65d7cc524d

The `order_line` field of `purchase.order` is readonly within states
aprroved, done. See the field definition. This means it should be
possible to remove lines of a `purchase.order` when the PO is in
any other state than approved or done.

Therefore, the deletion of lines shouldn't be prevented
when the PO is not in state approved or done

opw-634538
2015-05-13 11:42:09 +02:00
Goffin Simon 71b3861a54 [FIX] stock: Inventory adjustment
When importing a csv in Inventory Adjustement, a default product_uom_id is set if there 's
no product_uom_id given in the csv.

opw:634612
2015-05-13 09:14:49 +02:00
Goffin Simon 661f76c94a [FIX] product_visible_discount: discount computation
The new_list_price(subtotal) variable must be computed with the currency set on
the price_type of the price_list rule applied.

opw:630039
2015-05-13 09:09:57 +02:00
Denis Ledoux ddb8d40e3b [MERGE] forward port of branch saas-3 up to ffc40b6 2015-05-12 18:03:04 +02:00
Denis Ledoux ffc40b611b [MERGE] forward port of branch saas-3 up to e2bfb96 2015-05-12 17:55:50 +02:00
Olivier LAURENT 242e61796b [FIX] mail: missing spaces in email subjects composed of several encoding
sometimes some blank spaces are lost in subject of some incoming messages

There is a bug in `decode_header` in Python < 3.3,
which leads to lost some spaces in the email subjects
when several encodings are used in this subject.

See
- Issue: http://bugs.python.org/issue1079
- Fix: https://hg.python.org/cpython/rev/8c03fe231877

Joining the strings returned in the result of `decode_header`
solves most cases. Only extreme cases, like having
a subject with several different encodings following
each other without white spaces between them could lead
to have extra spaces in the subject. It won't happen
most of the time.

Closes #6629
2015-05-12 17:53:16 +02:00
Stéphane Bidoul d83befdb0f [FIX] account: tax amount for include_base_amount
The tax_amount on account.move.line generated from the validation of an invoice
did not include the taxes with 'include in base amount' enabled.
Instead of using the line total, use the price_unit of the tax which is
correctly computed through compute_all method.
Fixes #5939
2015-05-12 16:07:24 +02:00
Raphael Collet 78a20a3dba [FIX] model: wrong alias used in read query for multi-inherited field
In commit 04ba0e99, we introduced an optimization for reading inherited fields
in a single query.  There is an issue when you have more than one level of
`_inherits`.  The query looks like:

    SELECT ...
    FROM table0, table1 AS alias1, table2 AS alias2
    WHERE table0.link0 = alias1.id AND table1.link1 = alias2.id AND ...
                                       ^^^^^^
                             should be alias1

This fixes the issue, and adds a test to reproduce it.  The fix is based on
@emiprotechnologies's own proposal, but is cleaner and does not break APIs.
2015-05-12 13:42:27 +02:00
Nicolas Martinelli 1d40f6b8ae [FIX] account_voucher: allow forcing the period of the generated journal in create "Customer Payment"
opw-634696
2015-05-12 13:37:50 +02:00
Denis Ledoux 4f03a6224d [FIX] calendar: calendar_last_notif_ack is not user self readable.
`calendar_last_notif_ack` is not in the self readable fields list
of `res.users`. See `SELF_READABLE_FIELDS` in res_users.py.

This field must therefore be read as SUPERUSER.

opw-634402
2015-05-12 12:21:56 +02:00
Denis Ledoux 417f012ce9 [IMP] mail: use `has_group` to check a user is part of a group
`has_groups` is more efficient, and won't lead to useless
prefetches.

opw-634402
2015-05-12 12:21:56 +02:00
Denis Ledoux 5d4560676e [FIX] res_users: action_id must be readable by the user
`action_id` is the loaded (window) action on user sign in.
It must thefore be readable by the user.

opw-634402
2015-05-12 11:33:43 +02:00
Denis Ledoux 55fb3f6ff2 [FIX] share: do not add new rules for `res.company`
When trying to share a partner through the share feature,
a new record rule was added on `res.company`,
allowing the access to this model only if
the `partner_id` of the `res.company` was equal
to the user `partner_id`.
Except that the share users must have access
to the company he is currently in.

opw-634402
2015-05-12 11:33:43 +02:00
Denis Ledoux 953a5509d2 [IMP] mail: use `has_group` to check a user is part of a group
`has_groups` is more efficient, and won't lead to useless
prefetches.

opw-634402
2015-05-12 11:33:43 +02:00
Denis Ledoux 73432ffe9f [FIX] *: accesses of views concernings specific groups
If the whole view relates to a specific group,
apply the group on the view itself instead of
each view part (each fields, each page, each div,...),
so the view is loaded / added to the base view
only if the user is in the right group.
So the view is not loaded uselessly
and the fields are not read for nothing
(performances & security).

Indeed, when a group is applied on a field itself, the field content
is read, but hidden, therefore reading the content of the field
uselessly, and potentially leading to accesses issues
if the user hasn't the rights to read the field.
(e.g. reading a property when not having access to the model
of the proprty, pricelists on partners for instance)

opw-634402
2015-05-12 11:33:43 +02:00
Josse Colpaert cf6d7479d5 [IMP] Stock valuation: Avoid consumables with real-time valuation
When the product is a consumable, avoid to use real-time valuation, by adapting
the onchange in the views and making the valuation field invisible when the
product is a consumable / service.
2015-05-12 09:53:20 +02:00
Christophe Simonis d8d3b38cbd [FIX] ir.logging: cursor should be in auto-commit 2015-05-11 19:01:37 +02:00
Matthieu Dietrich d1c4d16a3a [FIX] account: Don't copy many2many when copying statement line
When duplicating confirmed bank statement lines,
the many2many `move_ids` links were preserved, and,
therefore, there were links between the duplicated
lines and the move entries of the original lines.

Closes #6617
2015-05-11 16:54:30 +02:00
Christophe Simonis 04b252b72c [FIX] Cursor.closed property
`_obj` doesn't exists anymore when the cursor is effectively closed.
2015-05-11 16:24:33 +02:00
Nicolas Martinelli 46d446fd47 [FIX] mrp_repair: add calculation of taxes in subtotal, reset taxes after invoice creation
The calculation of the taxes is added in the calculation of the subtotal.
When the invoice is created, a reset of the taxes is performed so the user does not have to do
it himself.
opw-634711
2015-05-11 15:51:32 +02:00
Goffin Simon bff6dffbb4 [FIX] website_sale: Coupon Code
The pricelist linked to the coupon code is just applied in the cart.
In the shop, the pricelist of the user is applied.

opw:634639
2015-05-11 14:25:11 +02:00
Goffin Simon af86f029c9 [FIX] account: Translation of journal name
The journal name showed in the pop over of the reconciliation bank statement wizard
must be in the language of the user.

opw:634378
2015-05-11 14:16:15 +02:00
Goffin Simon 740efb9349 [FIX] point_of_sale: bad indentation 2015-05-11 14:10:12 +02:00
Goffin Simon 163e7ee5ed [FIX] point_of_point: POS sales details
Total of the day must include the invoiced lines.

opw:634098
2015-05-11 13:52:44 +02:00
Julien De Coster 2d260b78d8 [FIX] Don't send mail to opt-outed contacts in mass mailing 2015-05-11 13:45:28 +02:00