The groups were set only on the view which does not prevent abuses.
The fact that users can bypass the groups on the view is not critical as the
changes are logged but this should be improved nevertheless.

In master, proper record rules should be set.

Closes #20427

In 11.0, this part of the code has been removed.

When choosing the shipping address in the cart, if a tax has been mapped
by a fiscal position, the subtotal was not correctly computed.

opw:778405

adapting #20279 to v10

Before this commit, when starting a livechat session as a public user and continuing as a portal user, the livechat crashed
(the poral user couldn't see the channel created before as Admin)

After this commit, the conversation is kept and security insured by the uuid in the cookie

OPW 775568

closes #20281

The method `_process_jobs` provides an alternative API to process the cron
jobs, that does not catch exceptions and log them.  This makes the processing
of cron jobs easier for scripting.

In case we are not uploading a file but add a slide based on google doc url
or youtube link, post['datas'] is not set and the code will crash.

Javascript don't check the onError, so the user never see the error and wait
 that nothing happend.

ERROR: column reference "action" is ambiguous

This commit closes #13839

- Create a user A
- Create a lead, assign to A
- Deactivate user A
- Duplicate the lead

A notification email is sent to A (user assigned to the lead).

Since the user is archived, he should not receive any email since it
might contain sensitive information.

opw-778825

[FIX] *: do not use groups when extending an asset bundle
Using groups when declaring an extension of an asset bundle leads to a
different generated asset bundle according to the user's group. This
is not something we want because a dynamic asset bundle's content
means that it could (and it does) trigger unwanted cache invalidation.

website_event, website_blog, website_forum and website_sale add
functions to . These functions are bound to
server side qweb nodes protected by groups. We can always add the
functions; if a user tries to use the routes he should receive a
traceback because of lack of access rules

website_blog adds a  module, but is guarded by
the presence of a node in the DOM. We use the same logic to guard the
module added by website_sale with the  node.

website_gengo is working as expected.

Closes #20724

Use case to reproduce:
- Set a product to be expensed
- Set the expense_policy to something else than no
- Do a delivery order with a picking
- Validate the picking
-> Delivered quantity to 0 and impossible to create an invoice
if the invoice_policy is delivered_quantity

It happens due to this commit 48ea59d4
What does it do:
- The move could be generated by an expense.
- If the move has 'no' as expense policy thus we won't add it in the invoice
Problem we can't guess if the move come from an expense or not (limitation).

This commit add an onchange on can_be_expense is order to set the expense
policy back to 'no' when the user uncheck it.

Courtesy of amoyaux

opw-777139

When opening the POS in this specific case:
- Under Mozilla Firefox
- auto printing the receipt is True
- invoicing is True

Before this commit, when issuing an invoice for a customer, a Traceback was thrown to the user and the invoice was not downloaded.
This was because the invoiced parameter resolved before the printing action was.

After this commit, we constain the invoiced parameter to be resolved when the action returns.
There is no traceback, and the invoice is downloaded

OPW 777647

closes #20570

`tax_amount` is not defined here, making it impossible to remove an
order line...

- Create a tax:
  Fixed amount: 10
  Price included
- Add it by default to a product costing 100
- In a SO/PO/Invoice, add 2 units of the product

The total price is 210 instead of 200.

opw-779696

The `sale_stock.tour` failed in the case the admin was not
part of the group
`product.group_stock_packaging`
or the group
`sale.group_mrp_properties`

because then the sale order was working with the editable list,
which does not open a dialog,
while the test was relying on the dialog to be opened,
in order to close it.

The fix is simply to pass the fact to close the dialog if
there is none.

opw-779308

In Enterprise:
- Go in Settings > Technical > Mail > Templates
- Edit a template
- In the editor, upload an image
- Choose "Upload image without optimization"

You are sent back to the app switcher.

opw-778918

Location and Company are non-stored fields. Therefore, grouping by these
fields leads to a traceback.

opw-779564

Only products without company can have taxes of different companies

Closes #20256 
Fixes #20250

The link does not work anymore.
Even when it was, it did not provide any information as can be seen in
https://web.archive.org/web/20160608025556/http://www.buckaroo-payments.com:80/business/customers/online-payment/

Fixes #16987

Do not try to run `action_assign` on the next move if it is done or
cancelled. The issue is that `action_assign` will first unlink the
existing pack operations before creating new ones, and the system
forbids to unlink these ones.

To reproduce this issue:
1. Create a product, routes manufacturing and MTO
2. Create SO with that product
3. Go to DO and force assign then cancel the delivery
4. Go to Manufacturing order created and produce

opw 778897

Suppose a tax of 20% with price_included = True and apply this tax on 399.99:
- base = 399.99 / 1.2 = 333.32500000000005
- tax_amount = base * 0.2 = 66.665
- round(base) + round(tax_amount) = 333.33 + 66.67 = 400.0 (!= 399.99: WRONG)

-opw: 777925

In 7eab8e26 res.partner was converted
to the new API, at that point company_type was changed from a stored
field manually synchronised with is_company (through create/write
overrides) into a proper computed field.

However to make it "editable" it was simply marked as
"readonly=False", which means even though UI-wise it looks editable
editing it does not actually do anything (things work in the partners
form because there's also an onchange which updates is_company on the
fly).

Fix by implementing an inverse function and actually do this
correctly.

Fixes #20623

- Go to Maintenance Requests, Create
- Go to 'Equipment' field, 'Create and edit'
- Go to 'Product Information' tab
- Click on 'Vendor' field, 'Create and edit'

'Is a Vendor' field is False

opw-779200

Fields `amount_type` on `account.tax` and `account.tax.template` are
already defined in the `account` module.
Redefining them here (with the same parameters) breaks every other
module that would have used `selection_add=` on those fields.

Actually, it is the case in `account_tax_python`, and thus, all the
localizations/customizations that depend on it were broken by this one.

~ Old API backport of 5d0d80af ~

Fields `amount_type` on `account.tax` and `account.tax.template` are
already defined in the `account` module.
Redefining them here (with the same parameters) breaks every other
module that would have used `selection_add=` on those fields.

Actually, it is the case in `account_tax_python`, and thus, all the
localizations/customizations that depend on it were broken by this one.

(issue spotted by 11.0-nightly)

Closes #19812 #20596

Remove weird special case: when the first field of the first line of a one2many
is empty, replace this first field by the comma-separated names of the lines,
and discard the other lines.

Fine tuning of this commit: 51d072db

When clicking on the group of the Inventory at Date, the
product.price.inventory must follow the same order as the
read_group in stock.history.

opw:747857

- Create an asset, post one line.
- Go back to the asset => the button is green
- Click again on the line => the button is orange

There is no protection to prevent the user to post the same entry
several times (a new account move is created every time it is clicked).

We fix the JS widget, but we add an extra layer of protection at the
Python level.

opw-778756

Closes #20556
Closes #20557

Before this commit, when trying to access website_public_price from the backend (when adding this field to a view for example), a traceback saying that the website attribute on the request object was non existent was raised.

After this commit, we control for this and the field displays correctly

OPW 778586

closes #20536

Before this commit, when opening the POS in IE11, then the customer list, the list was empty.
This was due to condition that was wrongly evaluated as false due to the fact that IE11 apparently only wants ECMA5.1 to deal with constructing Date() from a string.

After this commit, we construct the Date() object with the right string, and the list of customers doesn't disappear.

OPW 776463

For reference:
http://www.ecma-international.org/ecma-262/5.1/#sec-15.9.1.15

closes #20468