Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package trytond for openSUSE:Factory checked in at 2026-10-07 19:32:25 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/trytond (Old) and /work/SRC/openSUSE:Factory/.trytond.new.3698736 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "trytond" Wed Oct 7 19:32:25 2026 rev:120 rq:1382862 version:7.0.58 Changes: -------- --- /work/SRC/openSUSE:Factory/trytond/trytond.changes 2026-08-14 22:09:36.704695754 +0200 +++ /work/SRC/openSUSE:Factory/.trytond.new.3698736/trytond.changes 2026-10-07 19:32:59.405604904 +0200 @@ -1,0 +2,5 @@ +Tue Oct 6 19:13:01 UTC 2026 - Axel Braun <[email protected]> + +- Version 7.0.58 - Security Bugfix Release https://bugs.tryton.org/15032 + +------------------------------------------------------------------- Old: ---- trytond-7.0.55.tar.gz New: ---- trytond-7.0.58.tar.gz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ trytond.spec ++++++ --- /var/tmp/diff_new_pack.ykuDdg/_old 2026-10-07 19:33:00.323643243 +0200 +++ /var/tmp/diff_new_pack.ykuDdg/_new 2026-10-07 19:33:00.325643326 +0200 @@ -30,7 +30,7 @@ ##%%endif Name: trytond -Version: %{majorver}.55 +Version: %{majorver}.58 Release: 0 Summary: An Enterprise Resource Planning (ERP) system License: GPL-3.0-or-later ++++++ trytond-7.0.55.tar.gz -> trytond-7.0.58.tar.gz ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/trytond-7.0.55/CHANGELOG new/trytond-7.0.58/CHANGELOG --- old/trytond-7.0.55/CHANGELOG 2026-08-04 12:05:58.000000000 +0200 +++ new/trytond-7.0.58/CHANGELOG 2026-10-02 00:32:12.674301100 +0200 @@ -1,4 +1,20 @@ +Version 7.0.58 - 2026-10-01 +--------------------------- +* Bug fixes (see mercurial logs for details) +* Escape title and text when rendering HTML editor (issue15032) +* Allow trytond-admin to manage any user + +Version 7.0.57 - 2026-09-16 +--------------------------- +* Bug fixes (see mercurial logs for details) + + +Version 7.0.56 - 2026-08-15 +--------------------------- +* Bug fixes (see mercurial logs for details) + + Version 7.0.55 - 2026-08-04 --------------------------- * Bug fixes (see mercurial logs for details) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/trytond-7.0.55/PKG-INFO new/trytond-7.0.58/PKG-INFO --- old/trytond-7.0.55/PKG-INFO 2026-08-04 12:06:02.040366600 +0200 +++ new/trytond-7.0.58/PKG-INFO 2026-10-02 00:32:19.143636500 +0200 @@ -1,6 +1,6 @@ Metadata-Version: 2.4 Name: trytond -Version: 7.0.55 +Version: 7.0.58 Summary: Tryton server Home-page: http://www.tryton.org/ Download-URL: http://downloads.tryton.org/7.0/ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/trytond-7.0.55/trytond/__init__.py new/trytond-7.0.58/trytond/__init__.py --- old/trytond-7.0.55/trytond/__init__.py 2026-07-15 18:24:00.000000000 +0200 +++ new/trytond-7.0.58/trytond/__init__.py 2026-09-16 23:05:28.798376800 +0200 @@ -12,7 +12,7 @@ from ._safe_genshi import genshi_patch -__version__ = "7.0.55" +__version__ = "7.0.58" if not os.environ.get('TRYTOND_APPNAME'): os.environ['TRYTOND_APPNAME'] = os.path.basename( diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/trytond-7.0.55/trytond/cache.py new/trytond-7.0.58/trytond/cache.py --- old/trytond-7.0.55/trytond/cache.py 2025-09-22 21:34:39.000000000 +0200 +++ new/trytond-7.0.58/trytond/cache.py 2026-09-14 19:30:48.999355000 +0200 @@ -63,7 +63,15 @@ return {m for m, in cursor} -class BaseCache(object): +class _CacheMeta(type): + def __call__(cls, *args, **kwargs): + inst = super().__call__(*args, **kwargs) + assert inst._name not in BaseCache._instances, inst._name + BaseCache._instances[inst._name] = inst + return inst + + +class BaseCache(metaclass=_CacheMeta): _instances = {} context_ignored_keys = { 'client', '_request', '_check_access', '_skip_warnings', @@ -92,8 +100,6 @@ self.duration = dt.timedelta(**duration) else: self.duration = None - assert self._name not in self._instances - self._instances[self._name] = self @classmethod def stats(cls): diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/trytond-7.0.55/trytond/ir/routes.py new/trytond-7.0.58/trytond/ir/routes.py --- old/trytond-7.0.55/trytond/ir/routes.py 2025-11-20 20:34:41.000000000 +0100 +++ new/trytond-7.0.58/trytond/ir/routes.py 2026-10-01 23:40:32.482753300 +0200 @@ -2,6 +2,7 @@ # this repository contains the full copyright notices and license terms. import csv import datetime as dt +import html import io import json from numbers import Number @@ -92,8 +93,8 @@ 'class': get_config( ['class', model, field.name], default="''"), 'language': transaction.language, - 'title': title, - 'text': text, + 'title': html.escape(title), + 'text': html.escape(text), 'csrf_token': csrf_token, 'error': error, }, status, content_type='text/html') diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/trytond-7.0.55/trytond/ir/translation.py new/trytond-7.0.58/trytond/ir/translation.py --- old/trytond-7.0.55/trytond/ir/translation.py 2026-07-14 19:16:13.000000000 +0200 +++ new/trytond-7.0.58/trytond/ir/translation.py 2026-08-14 23:09:10.860323000 +0200 @@ -856,13 +856,15 @@ if (model in fs_id2prop and res_id in fs_id2prop[model]): res_id, noupdate = fs_id2prop[model][res_id] + elif res_id: + continue if res_id: try: res_id = int(res_id) except ValueError: - res_id = None - if not res_id: + continue + else: res_id = -1 translation.res_id = res_id diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/trytond-7.0.55/trytond/model/fields/function.py new/trytond-7.0.58/trytond/model/fields/function.py --- old/trytond-7.0.55/trytond/model/fields/function.py 2025-09-22 21:34:39.000000000 +0200 +++ new/trytond-7.0.58/trytond/model/fields/function.py 2026-09-30 08:39:39.440705300 +0200 @@ -44,7 +44,7 @@ ``lazy`` or ``eager``. ''' assert isinstance(field, Field) - self._field = field + self._field = copy.deepcopy(field) self._type = field._type self.getter = getter self.getter_with_context = getter_with_context diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/trytond-7.0.55/trytond/model/modelsql.py new/trytond-7.0.58/trytond/model/modelsql.py --- old/trytond-7.0.55/trytond/model/modelsql.py 2026-07-14 19:14:51.000000000 +0200 +++ new/trytond-7.0.58/trytond/model/modelsql.py 2026-09-30 08:23:34.542991600 +0200 @@ -1526,7 +1526,7 @@ where=foreign_red_sql)) related_records = Model.browse([x[0] for x in cursor]) else: - with without_check_access(), inactive_records(): + with inactive_records(): related_records = Model.search( [(field_name, 'in', sub_ids)], order=[]) @@ -1539,26 +1539,27 @@ sub_ids = list(sub_ids) red_sql = reduce_ids(table.id, sub_ids) - for Model, field_name in foreign_keys_toupdate: - related_records = get_related_records( - Model, field_name, sub_ids) - if related_records: - Model.write(related_records, { - field_name: None, - }) - - for Model, field_name in foreign_keys_todelete: - related_records = get_related_records( - Model, field_name, sub_ids) - if related_records: - Model.delete(related_records) - - for Model, field_name in foreign_keys_tocheck: - if get_related_records(Model, field_name, sub_ids): - error_args = Model.__names__(field_name) - raise ForeignKeyError( - gettext('ir.msg_foreign_model_exist', - **error_args)) + with without_check_access(): + for Model, field_name in foreign_keys_toupdate: + related_records = get_related_records( + Model, field_name, sub_ids) + if related_records: + Model.write(related_records, { + field_name: None, + }) + + for Model, field_name in foreign_keys_todelete: + related_records = get_related_records( + Model, field_name, sub_ids) + if related_records: + Model.delete(related_records) + + for Model, field_name in foreign_keys_tocheck: + if get_related_records(Model, field_name, sub_ids): + error_args = Model.__names__(field_name) + raise ForeignKeyError( + gettext('ir.msg_foreign_model_exist', + **error_args)) super(ModelSQL, cls).delete(list(sub_records)) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/trytond-7.0.55/trytond/model/modelstorage.py new/trytond-7.0.58/trytond/model/modelstorage.py --- old/trytond-7.0.55/trytond/model/modelstorage.py 2026-07-08 08:36:10.000000000 +0200 +++ new/trytond-7.0.58/trytond/model/modelstorage.py 2026-09-14 19:41:25.196922300 +0200 @@ -353,7 +353,8 @@ if random.random() < 1 / _cache_count_clear: cls._count_cache.set(cls.__name__, None) else: - cls._count_cache.set(cls.__name__, count - len(records)) + cls._count_cache.set( + cls.__name__, max(count - len(records), 0)) @classmethod @without_check_access diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/trytond-7.0.55/trytond/res/user.py new/trytond-7.0.58/trytond/res/user.py --- old/trytond-7.0.55/trytond/res/user.py 2026-07-08 08:36:10.000000000 +0200 +++ new/trytond-7.0.58/trytond/res/user.py 2026-09-30 08:48:56.124287000 +0200 @@ -935,7 +935,7 @@ def __setup__(cls): super().__setup__() cls.__rpc__.update({ - 'renew': RPC(readonly=False), + 'renew': RPC(readonly=False, check_access=False), }) @classmethod diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/trytond-7.0.55/trytond/tests/test_bus.py new/trytond-7.0.58/trytond/tests/test_bus.py --- old/trytond-7.0.55/trytond/tests/test_bus.py 2025-09-22 21:34:39.000000000 +0200 +++ new/trytond-7.0.58/trytond/tests/test_bus.py 2026-09-14 19:57:46.972486500 +0200 @@ -126,8 +126,9 @@ notify("Test", "Message", user=1) transaction.commit() # Let the listen thread registers the message - time.sleep(1) - response = Bus.subscribe(DB_NAME, ['user:1']) + while not ( + response := Bus.subscribe(DB_NAME, ['user:1'])).get('message'): + time.sleep(.01) self.assertTrue(response['message'].pop('message_id')) self.assertEqual(response, { diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/trytond-7.0.55/trytond/transaction.py new/trytond-7.0.58/trytond/transaction.py --- old/trytond-7.0.55/trytond/transaction.py 2026-07-08 08:36:10.000000000 +0200 +++ new/trytond-7.0.58/trytond/transaction.py 2026-09-14 19:36:23.209143600 +0200 @@ -186,13 +186,7 @@ # it is strictly before all transactions started after # but it may be also before transactions started before self.started_at = self.monotonic_time() - if not database_name: - database = backend.Database().connect() - else: - database = backend.Database(database_name).connect() - Flavor.set(backend.Database.flavor) self.user = user - self.database = database self.readonly = readonly self.close = close self.context = ImmutableDict(context or {}) @@ -205,6 +199,12 @@ self.counter = 0 self._datamanagers = [] + if not database_name: + database = backend.Database().connect() + else: + database = backend.Database(database_name).connect() + Flavor.set(backend.Database.flavor) + self.database = database self.connection = database.get_connection(readonly=readonly, autocommit=autocommit) count = 0 diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/trytond-7.0.55/trytond/url.py new/trytond-7.0.58/trytond/url.py --- old/trytond-7.0.55/trytond/url.py 2025-09-22 21:34:39.000000000 +0200 +++ new/trytond-7.0.58/trytond/url.py 2026-09-14 19:56:43.674201300 +0200 @@ -27,7 +27,7 @@ context = Transaction().context if context: request = context.get('_request') - if request and request['is_secure']: + if request and request.get('is_secure'): return True return bool( config.get('ssl', 'certificate') @@ -38,7 +38,7 @@ context = Transaction().context if context: request = context.get('_request') - if request: + if request and 'http_host' in request: return request['http_host'] return HOSTNAME diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/trytond-7.0.55/trytond.egg-info/PKG-INFO new/trytond-7.0.58/trytond.egg-info/PKG-INFO --- old/trytond-7.0.55/trytond.egg-info/PKG-INFO 2026-08-04 12:06:01.000000000 +0200 +++ new/trytond-7.0.58/trytond.egg-info/PKG-INFO 2026-10-02 00:32:17.802080400 +0200 @@ -1,6 +1,6 @@ Metadata-Version: 2.4 Name: trytond -Version: 7.0.55 +Version: 7.0.58 Summary: Tryton server Home-page: http://www.tryton.org/ Download-URL: http://downloads.tryton.org/7.0/
