- Fix ACL test assumptions about browse() behavior
* Update tests to check field-level access instead of browse().exists()
* Correct test methodology for AccessError validation
- Implement buddy method pattern for RPC security
* Refactor all sudo()/api.model methods to use public/private pattern
* Public methods perform access checks, private methods contain privileged ops
* Prevents RPC privilege escalation vulnerabilities
- Enhanced security architecture
* Add comprehensive mail activity portal access rules
* Strengthen partner access controls
* Update controller method references to use secure public methods
- Test suite improvements
* Add extensive mail activity portal access tests
* Update player removal tests to use public method interfaces
* Improve test coverage for security scenarios
- Security best practices enforcement
* All privileged operations now encapsulated in private methods
* Clear separation between public API and internal operations
* Maintains functionality while securing RPC access
Resolves RPC security vulnerabilities and establishes proper ACL enforcement patterns.
- Removed models/injury_models.py and all its references
- Converted relational fields to character fields:
- body_location_id → body_location
- injury_type_id → injury_type
- Updated portal templates to use text inputs instead of dropdowns
- Updated controller code to process the new field formats
- Removed related access rights from security CSV
- Modified test files to accommodate the new structure
This refactoring simplifies the data model by removing unnecessary
classifications that were adding complexity without significant benefit.
The direct text fields maintain the same functionality while reducing
the database overhead and simplifying the UI.
- Change view type from 'tree' to 'list' for Odoo 18 compatibility
- Update XML structure to use <list> instead of <tree> tags
- Fix parent menu reference to use existing sports_clinic_root menu
- Refactor portal templates to eliminate intra-module template inheritance
- Integrate emergency contacts section into player injuries template
- Add full internal admin views for treatment notes with chatter support
- Fix ORM warning in test_rights by using proper ORM commands
- Update manifest to reflect new functionality (v18.0.1.9.0)
This refactoring improves template stability by removing XPath errors and
provides treatment professionals with better access to emergency contacts
and treatment notes both in portal and backend interfaces.
- Fix: partners can no longer have default carrier accounts that are
archived.
- Refactor: remove write/create overrides to replace them with
computed/stored fields.
- Disable sending of notification emails when events are created or updated
in Odoo during a CalDAV server synchronization.
- General code cleanup with improved type hints.
Prior to this fix, the organizer on events was being incorrectly set to
the database's admin user in some cases, when synchronizing an event
from the CalDAV server.
Since Odoo 18, emails coming in to an alias creating account moves
(vendor bills) get rejected if they do not contain an attachment that
can be read by the system. This means that sending a plain email receipt
with no attachment bounces, when it would be nice to have a vendor bill
with the message in the chatter as a minimum.
This module checks for attachments and injects one, in the form of a
simple pdf containing the email header and contents, if there was no
attachment to begin with.
This should enable sending of a simple email and not having it bounce
due to there being no attachment.
Fixes an issue where creating the bills from the purchase orders could
create a bill with quantities vastly different from the received batch
quantities. This would happen when the purchase orders had lines with
quantities to invoice that did not match the receipt quantities.
Instead of creating the bills from the POs, we now generate the bill
and its line values directly from the quantities on the move lines
related to the batch.
