diff options
| author | Thibault Delavallée <tde@odoo.com> | 2017-05-24 10:59:21 +0200 |
|---|---|---|
| committer | Thibault Delavallée <tde@odoo.com> | 2017-06-01 13:54:04 +0200 |
| commit | 7eca402b11c6032a671993d587ea52772ee4e3bb (patch) | |
| tree | 150869f34e9751597e0d4baf4eaa28cedbbbedaa | |
| parent | 7736eabf0d97d4e6d92d4067bf1807ea81a4ac8f (diff) | |
[FIX] website_portal_sale: fix access rights issues when viewing quotes
Portal users do not have access on invoices or invoice lines. However when
viewing an online quotation in website_portal_sale some computation is
performed based on invoices and invoice lines. We therefore iterate on
invoice and invoice lines as superuser as we do not want to grant any
additional access on those models for portal users.
| -rw-r--r-- | addons/website_portal_sale/controllers/main.py | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/addons/website_portal_sale/controllers/main.py b/addons/website_portal_sale/controllers/main.py index 86a56b0509b..0edaffb85de 100644 --- a/addons/website_portal_sale/controllers/main.py +++ b/addons/website_portal_sale/controllers/main.py @@ -150,11 +150,12 @@ class website_account(website_account): order.check_access_rule('read') except AccessError: return request.render("website.403") - order_invoice_lines = {il.product_id.id: il.invoice_id for il in order.invoice_ids.mapped('invoice_line_ids')} + order_sudo = order.sudo() + order_invoice_lines = {il.product_id.id: il.invoice_id for il in order_sudo.invoice_ids.mapped('invoice_line_ids')} history = request.session.get('my_orders_history', []) values = { - 'order': order.sudo(), + 'order': order_sudo, 'order_invoice_lines': order_invoice_lines, } values.update(get_records_pager(history, order)) |