diff options
Diffstat (limited to 'addons')
7 files changed, 19 insertions, 15 deletions
diff --git a/addons/hr_timesheet_invoice/hr_timesheet_invoice.py b/addons/hr_timesheet_invoice/hr_timesheet_invoice.py index a1aa1eed26c..c81ab6016de 100644 --- a/addons/hr_timesheet_invoice/hr_timesheet_invoice.py +++ b/addons/hr_timesheet_invoice/hr_timesheet_invoice.py @@ -203,7 +203,7 @@ class account_analytic_line(osv.osv): unit_price = total_price*-1.0 / total_qty factor = self.pool['hr_timesheet_invoice.factor'].browse(cr, uid, factor_id, context=uom_context) - factor_name = factor.customer_name + factor_name = factor.customer_name or '' curr_invoice_line = { 'price_unit': unit_price, 'quantity': total_qty, diff --git a/addons/hr_timesheet_sheet/report/hr_timesheet_report.py b/addons/hr_timesheet_sheet/report/hr_timesheet_report.py index 6d41cc6443d..6725f67abe9 100644 --- a/addons/hr_timesheet_sheet/report/hr_timesheet_report.py +++ b/addons/hr_timesheet_sheet/report/hr_timesheet_report.py @@ -73,7 +73,7 @@ class hr_timesheet_report(osv.osv): htss.state""" def _from(self): - return super(hr_timesheet_report, self)._from() + "left join hr_timesheet_sheet_sheet as htss ON (hat.sheet_id=htss.id) join totals as t on (t.sheet_id = hat.sheet_id and t.date = aal.date)" + return super(hr_timesheet_report, self)._from() + "left join hr_timesheet_sheet_sheet as htss ON (hat.sheet_id=htss.id) left join totals as t on (t.sheet_id = hat.sheet_id and t.date = aal.date)" def _group_by(self): return super(hr_timesheet_report, self)._group_by() + """, diff --git a/addons/procurement_jit/procurement_jit.py b/addons/procurement_jit/procurement_jit.py index 67a87ff4b5c..05586baf9a7 100644 --- a/addons/procurement_jit/procurement_jit.py +++ b/addons/procurement_jit/procurement_jit.py @@ -33,14 +33,14 @@ class procurement_order(osv.osv): self.check(cr, uid, [procurement_id], context=context) return procurement_id - def run(self, cr, uid, ids, context=None): + def run(self, cr, uid, ids, autocommit=False, context=None): context = dict(context or {}, procurement_autorun_defer=True) - res = super(procurement_order, self).run(cr, uid, ids, context=context) + res = super(procurement_order, self).run(cr, uid, ids, autocommit=autocommit, context=context) procurement_ids = self.search(cr, uid, [('move_dest_id.procurement_id', 'in', ids)], order='id', context=context) if procurement_ids: - return self.run(cr, uid, procurement_ids, context=context) + return self.run(cr, uid, procurement_ids, autocommit=autocommit, context=context) return res class stock_move(osv.osv): diff --git a/addons/stock_account/wizard/stock_valuation_history.py b/addons/stock_account/wizard/stock_valuation_history.py index e1ae51c79eb..dc5e9ed8605 100644 --- a/addons/stock_account/wizard/stock_valuation_history.py +++ b/addons/stock_account/wizard/stock_valuation_history.py @@ -56,8 +56,10 @@ class stock_history(osv.osv): for product_id in ids: line_ids.add(product_id) line_ids = list(line_ids) - cr.execute('SELECT id, product_id, price_unit_on_quant, company_id, quantity FROM stock_history WHERE id in %s', (tuple(line_ids),)) - lines_rec = cr.dictfetchall() + lines_rec = {} + if line_ids: + cr.execute('SELECT id, product_id, price_unit_on_quant, company_id, quantity FROM stock_history WHERE id in %s', (tuple(line_ids),)) + lines_rec = cr.dictfetchall() lines_dict = dict((line['id'], line) for line in lines_rec) product_ids = list(set(line_rec['product_id'] for line_rec in lines_rec)) products_rec = self.pool['product.product'].read(cr, uid, product_ids, ['cost_method', 'product_tmpl_id'], context=context) diff --git a/addons/web_calendar/static/src/js/web_calendar.js b/addons/web_calendar/static/src/js/web_calendar.js index acbfb9c4dc2..540e1fe8b75 100644 --- a/addons/web_calendar/static/src/js/web_calendar.js +++ b/addons/web_calendar/static/src/js/web_calendar.js @@ -565,7 +565,7 @@ openerp.web_calendar = function(instance) { attendee_showed += 1; if (attendee_showed<= MAX_ATTENDEES) { if (self.avatar_model !== null) { - the_title_avatar += '<img title="' + self.all_attendees[the_attendee_people] + '" class="attendee_head" \ + the_title_avatar += '<img title="' + _.escape(self.all_attendees[the_attendee_people]) + '" class="attendee_head" \ src="/web/binary/image?model=' + self.avatar_model + '&field=image_small&id=' + the_attendee_people + '"></img>'; } else { @@ -573,12 +573,12 @@ openerp.web_calendar = function(instance) { tempColor = (self.all_filters[the_attendee_people] !== undefined) ? self.all_filters[the_attendee_people].color : (self.all_filters[-1] ? self.all_filters[-1].color : 1); - the_title_avatar += '<i class="fa fa-user attendee_head color_'+tempColor+'" title="' + self.all_attendees[the_attendee_people] + '" ></i>'; + the_title_avatar += '<i class="fa fa-user attendee_head color_'+tempColor+'" title="' + _.escape(self.all_attendees[the_attendee_people]) + '" ></i>'; }//else don't add myself } } else { - attendee_other += self.all_attendees[the_attendee_people] +", "; + attendee_other += _.escape(self.all_attendees[the_attendee_people]) +", "; } } ); diff --git a/addons/website/static/src/js/website.snippets.animation.js b/addons/website/static/src/js/website.snippets.animation.js index 15f34edcb1d..dd97c19e817 100644 --- a/addons/website/static/src/js/website.snippets.animation.js +++ b/addons/website/static/src/js/website.snippets.animation.js @@ -183,7 +183,7 @@ if (!this.$target.has('.media_iframe_video_size')) { var editor = '<div class="css_editable_mode_display"> </div>'; var size = '<div class="media_iframe_video_size"> </div>'; - this.$target.html(editor+size+'<iframe src="'+this.$target.data("src")+'" frameborder="0" allowfullscreen="allowfullscreen"></iframe>'); + this.$target.html(editor+size+'<iframe src="'+_.escape(this.$target.data("src"))+'" frameborder="0" allowfullscreen="allowfullscreen"></iframe>'); } }, }); diff --git a/addons/website_google_map/controllers/main.py b/addons/website_google_map/controllers/main.py index efddba1b10f..870cda8a435 100644 --- a/addons/website_google_map/controllers/main.py +++ b/addons/website_google_map/controllers/main.py @@ -4,6 +4,7 @@ import json from openerp import SUPERUSER_ID from openerp.addons.web import http from openerp.addons.web.http import request +from openerp.tools import html_escape as escape class google_map(http.Controller): @@ -48,12 +49,13 @@ class google_map(http.Controller): } request.context.update({'show_address': True}) for partner in partner_obj.browse(cr, SUPERUSER_ID, partners_ids, context=context): + # TODO in master, do not use `escape` but `t-esc` in the qweb template. partner_data["partners"].append({ 'id': partner.id, - 'name': partner.name, - 'address': '\n'.join(partner.name_get()[0][1].split('\n')[1:]), - 'latitude': partner.partner_latitude, - 'longitude': partner.partner_longitude, + 'name': escape(partner.name), + 'address': escape('\n'.join(partner.name_get()[0][1].split('\n')[1:])), + 'latitude': escape(str(partner.partner_latitude)), + 'longitude': escape(str(partner.partner_longitude)), }) # generate the map |