4 files changed, 20 insertions, 8 deletions

diff --git a/addons/web/static/src/js/framework/formats.js b/addons/web/static/src/js/framework/formats.js
index 9efd799a481..aafe5766e49 100644
--- a/addons/web/static/src/js/framework/formats.js
+++ b/addons/web/static/src/js/framework/formats.js
@@ -136,10 +136,6 @@ function parse_value (value, descriptor, value_if_empty) {
             return tmp;
         case 'monetary':
         case 'float':
-            tmp = Number(value);
-            if (!isNaN(tmp))
-                return tmp;
-
             var tmp2 = value;
             do {
                 tmp = tmp2;
diff --git a/addons/web/static/src/js/framework/mixins.js b/addons/web/static/src/js/framework/mixins.js
index 0f495392a6c..68c19f6b9f4 100644
--- a/addons/web/static/src/js/framework/mixins.js
+++ b/addons/web/static/src/js/framework/mixins.js
@@ -297,9 +297,12 @@ var PropertiesMixin = _.extend({}, EventDispatcherMixin, {
             // this also has the side effect of introducing a dependency on utils.  Todo:
             // remove this, or move it elsewhere.  Also, learn OO programming.
             if (key === 'value' && self.field && self.field.type === 'float' && tmp && val){
-                var precision = self.field.digits ? self.field.digits[1] : 2;
-                if (utils.float_is_zero(tmp - val, precision)) {
-                    return;
+                var digits = self.field.digits;
+                if (digits !== 0){
+                    digits = digits ? digits[1] : 2;
+                    if (utils.float_is_zero(tmp - val, digits)) {
+                        return;
+                    }
                 }
             }
             changed = true;
diff --git a/addons/web/static/src/js/framework/session.js b/addons/web/static/src/js/framework/session.js
index 8b084f640fd..38fa3465808 100644
--- a/addons/web/static/src/js/framework/session.js
+++ b/addons/web/static/src/js/framework/session.js
@@ -4,6 +4,7 @@ odoo.define('web.Session', function (require) {
 var ajax = require('web.ajax');
 var core = require('web.core');
 var utils = require('web.utils');
+var Model = require('web.Model');
 
 var _t = core._t;
 var qweb = core.qweb;
@@ -41,6 +42,7 @@ var Session = core.Class.extend(mixins.EventDispatcherMixin, {
         // TODO: session store in cookie should be optional
         this.qweb_mutex = new utils.Mutex();
         this.currencies = {};
+        this._groups_def = {};
     },
     setup: function(origin, options) {
         // must be able to customize server
@@ -129,6 +131,17 @@ var Session = core.Class.extend(mixins.EventDispatcherMixin, {
         $.bbq.removeState();
         return this.rpc("/web/session/destroy", {});
     },
+    user_has_group: function(group) {
+        if (!this.uid) {
+            return $.when().resolve(false);
+        }
+        var def = this._groups_def[group];
+        if (!def) {
+            var Users = new Model('res.users');
+            def = this._groups_def[group] = Users.call('has_group', [group]);
+        }
+        return def;
+    },
     get_cookie: function (name) {
         if (!this.name) { return null; }
         var nameEQ = this.name + '|' + name + '=';
diff --git a/addons/web/static/src/js/framework/utils.js b/addons/web/static/src/js/framework/utils.js
index b13688aa538..5caf995c988 100644
--- a/addons/web/static/src/js/framework/utils.js
+++ b/addons/web/static/src/js/framework/utils.js
@@ -138,7 +138,7 @@ function json_node_to_xml (node, human_readable, indent) {
         cr = human_readable ? '\n' : '';
 
     if (typeof(node) === 'string') {
-        return sindent + node;
+        return sindent + node.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;');
     } else if (typeof(node.tag) !== 'string' || !node.children instanceof Array || !node.attrs instanceof Object) {
         throw new Error(
             _.str.sprintf(_t("Node [%s] is not a JSONified XML node"),