[MERGE] forward port of branch 8.0 up to 22bd3bd

7 files changed, 19 insertions, 15 deletions

diff --git a/addons/hr_timesheet_invoice/hr_timesheet_invoice.py b/addons/hr_timesheet_invoice/hr_timesheet_invoice.py
index a1aa1eed26c..c81ab6016de 100644
--- a/addons/hr_timesheet_invoice/hr_timesheet_invoice.py
+++ b/addons/hr_timesheet_invoice/hr_timesheet_invoice.py
@@ -203,7 +203,7 @@ class account_analytic_line(osv.osv):
             unit_price = total_price*-1.0 / total_qty
 
         factor = self.pool['hr_timesheet_invoice.factor'].browse(cr, uid, factor_id, context=uom_context)
-        factor_name = factor.customer_name
+        factor_name = factor.customer_name or ''
         curr_invoice_line = {
             'price_unit': unit_price,
             'quantity': total_qty,
diff --git a/addons/hr_timesheet_sheet/report/hr_timesheet_report.py b/addons/hr_timesheet_sheet/report/hr_timesheet_report.py
index 6d41cc6443d..6725f67abe9 100644
--- a/addons/hr_timesheet_sheet/report/hr_timesheet_report.py
+++ b/addons/hr_timesheet_sheet/report/hr_timesheet_report.py
@@ -73,7 +73,7 @@ class hr_timesheet_report(osv.osv):
                         htss.state"""
 
     def _from(self):
-        return super(hr_timesheet_report, self)._from() + "left join hr_timesheet_sheet_sheet as htss ON (hat.sheet_id=htss.id) join totals as t on (t.sheet_id = hat.sheet_id and t.date = aal.date)"
+        return super(hr_timesheet_report, self)._from() + "left join hr_timesheet_sheet_sheet as htss ON (hat.sheet_id=htss.id) left join totals as t on (t.sheet_id = hat.sheet_id and t.date = aal.date)"
 
     def _group_by(self):
         return super(hr_timesheet_report, self)._group_by() + """,
diff --git a/addons/procurement_jit/procurement_jit.py b/addons/procurement_jit/procurement_jit.py
index 67a87ff4b5c..05586baf9a7 100644
--- a/addons/procurement_jit/procurement_jit.py
+++ b/addons/procurement_jit/procurement_jit.py
@@ -33,14 +33,14 @@ class procurement_order(osv.osv):
             self.check(cr, uid, [procurement_id], context=context)
         return procurement_id
 
-    def run(self, cr, uid, ids, context=None):
+    def run(self, cr, uid, ids, autocommit=False, context=None):
         context = dict(context or {}, procurement_autorun_defer=True)
-        res = super(procurement_order, self).run(cr, uid, ids, context=context)
+        res = super(procurement_order, self).run(cr, uid, ids, autocommit=autocommit, context=context)
 
         procurement_ids = self.search(cr, uid, [('move_dest_id.procurement_id', 'in', ids)], order='id', context=context)
 
         if procurement_ids:
-            return self.run(cr, uid, procurement_ids, context=context)
+            return self.run(cr, uid, procurement_ids, autocommit=autocommit, context=context)
         return res
 
 class stock_move(osv.osv):
diff --git a/addons/stock_account/wizard/stock_valuation_history.py b/addons/stock_account/wizard/stock_valuation_history.py
index e1ae51c79eb..dc5e9ed8605 100644
--- a/addons/stock_account/wizard/stock_valuation_history.py
+++ b/addons/stock_account/wizard/stock_valuation_history.py
@@ -56,8 +56,10 @@ class stock_history(osv.osv):
                 for product_id in ids:
                     line_ids.add(product_id)
             line_ids = list(line_ids)
-            cr.execute('SELECT id, product_id, price_unit_on_quant, company_id, quantity FROM stock_history WHERE id in %s', (tuple(line_ids),))
-            lines_rec = cr.dictfetchall()
+            lines_rec = {}
+            if line_ids:
+                cr.execute('SELECT id, product_id, price_unit_on_quant, company_id, quantity FROM stock_history WHERE id in %s', (tuple(line_ids),))
+                lines_rec = cr.dictfetchall()
             lines_dict = dict((line['id'], line) for line in lines_rec)
             product_ids = list(set(line_rec['product_id'] for line_rec in lines_rec))
             products_rec = self.pool['product.product'].read(cr, uid, product_ids, ['cost_method', 'product_tmpl_id'], context=context)
diff --git a/addons/web_calendar/static/src/js/web_calendar.js b/addons/web_calendar/static/src/js/web_calendar.js
index acbfb9c4dc2..540e1fe8b75 100644
--- a/addons/web_calendar/static/src/js/web_calendar.js
+++ b/addons/web_calendar/static/src/js/web_calendar.js
@@ -565,7 +565,7 @@ openerp.web_calendar = function(instance) {
                             attendee_showed += 1;
                             if (attendee_showed<= MAX_ATTENDEES) {
                                 if (self.avatar_model !== null) {
-                                       the_title_avatar += '<img title="' + self.all_attendees[the_attendee_people] + '" class="attendee_head"  \
+                                       the_title_avatar += '<img title="' + _.escape(self.all_attendees[the_attendee_people]) + '" class="attendee_head"  \
                                                             src="/web/binary/image?model=' + self.avatar_model + '&field=image_small&id=' + the_attendee_people + '"></img>';
                                 }
                                 else {
@@ -573,12 +573,12 @@ openerp.web_calendar = function(instance) {
                                             tempColor = (self.all_filters[the_attendee_people] !== undefined) 
                                                         ? self.all_filters[the_attendee_people].color
                                                         : (self.all_filters[-1] ? self.all_filters[-1].color : 1);
-                                        the_title_avatar += '<i class="fa fa-user attendee_head color_'+tempColor+'" title="' + self.all_attendees[the_attendee_people] + '" ></i>';
+                                        the_title_avatar += '<i class="fa fa-user attendee_head color_'+tempColor+'" title="' + _.escape(self.all_attendees[the_attendee_people]) + '" ></i>';
                                     }//else don't add myself
                                 }
                             }
                             else {
-                                attendee_other += self.all_attendees[the_attendee_people] +", ";
+                                attendee_other += _.escape(self.all_attendees[the_attendee_people]) +", ";
                             }
                         }
                     );
diff --git a/addons/website/static/src/js/website.snippets.animation.js b/addons/website/static/src/js/website.snippets.animation.js
index 15f34edcb1d..dd97c19e817 100644
--- a/addons/website/static/src/js/website.snippets.animation.js
+++ b/addons/website/static/src/js/website.snippets.animation.js
@@ -183,7 +183,7 @@
             if (!this.$target.has('.media_iframe_video_size')) {
                 var editor = '<div class="css_editable_mode_display">&nbsp;</div>';
                 var size = '<div class="media_iframe_video_size">&nbsp;</div>';
-                this.$target.html(editor+size+'<iframe src="'+this.$target.data("src")+'" frameborder="0" allowfullscreen="allowfullscreen"></iframe>');
+                this.$target.html(editor+size+'<iframe src="'+_.escape(this.$target.data("src"))+'" frameborder="0" allowfullscreen="allowfullscreen"></iframe>');
             }
         },
     });
diff --git a/addons/website_google_map/controllers/main.py b/addons/website_google_map/controllers/main.py
index efddba1b10f..870cda8a435 100644
--- a/addons/website_google_map/controllers/main.py
+++ b/addons/website_google_map/controllers/main.py
@@ -4,6 +4,7 @@ import json
 from openerp import SUPERUSER_ID
 from openerp.addons.web import http
 from openerp.addons.web.http import request
+from openerp.tools import html_escape as escape
 
 
 class google_map(http.Controller):
@@ -48,12 +49,13 @@ class google_map(http.Controller):
         }
         request.context.update({'show_address': True})
         for partner in partner_obj.browse(cr, SUPERUSER_ID, partners_ids, context=context):
+            # TODO in master, do not use `escape` but `t-esc` in the qweb template.
             partner_data["partners"].append({
                 'id': partner.id,
-                'name': partner.name,
-                'address': '\n'.join(partner.name_get()[0][1].split('\n')[1:]),
-                'latitude': partner.partner_latitude,
-                'longitude': partner.partner_longitude,
+                'name': escape(partner.name),
+                'address': escape('\n'.join(partner.name_get()[0][1].split('\n')[1:])),
+                'latitude': escape(str(partner.partner_latitude)),
+                'longitude': escape(str(partner.partner_longitude)),
                 })
 
         # generate the map