diff options
| author | Thibault Delavallée <tde@odoo.com> | 2017-11-30 12:52:00 +0100 |
|---|---|---|
| committer | Thibault Delavallée <tde@odoo.com> | 2017-11-30 13:25:28 +0100 |
| commit | 7ed8829cd8d2bad81e47f96888584df1651100e0 (patch) | |
| tree | 3cbc001c85354e946971425e69e62672fbfe2b0f | |
| parent | 76fc68a9fcd5d6efb7ccb54f2c964bc2450ce6f0 (diff) | |
[FIX] mail: avoid access issue for portal users
As portal users do not have access to activities it makes sense to
limit access to the various activity_* fields to employees only.
| -rw-r--r-- | addons/mail/models/mail_activity.py | 17 |
1 files changed, 12 insertions, 5 deletions
diff --git a/addons/mail/models/mail_activity.py b/addons/mail/models/mail_activity.py index 6ed049833d5..cc53bab9fa7 100644 --- a/addons/mail/models/mail_activity.py +++ b/addons/mail/models/mail_activity.py @@ -264,28 +264,35 @@ class MailActivityMixin(models.AbstractModel): activity_ids = fields.One2many( 'mail.activity', 'res_id', 'Activities', auto_join=True, + groups="base.group_user", domain=lambda self: [('res_model', '=', self._name)]) activity_state = fields.Selection([ ('overdue', 'Overdue'), ('today', 'Today'), ('planned', 'Planned')], string='State', compute='_compute_activity_state', + groups="base.group_user", help='Status based on activities\nOverdue: Due date is already passed\n' 'Today: Activity date is today\nPlanned: Future activities.') activity_user_id = fields.Many2one( 'res.users', 'Responsible', related='activity_ids.user_id', - search='_search_activity_user_id') + search='_search_activity_user_id', + groups="base.group_user") activity_type_id = fields.Many2one( 'mail.activity.type', 'Next Activity Type', related='activity_ids.activity_type_id', - search='_search_activity_type_id') + search='_search_activity_type_id', + groups="base.group_user") activity_date_deadline = fields.Date( 'Next Activity Deadline', related='activity_ids.date_deadline', - readonly=True, store=True) # store to enable ordering + search + readonly=True, store=True, # store to enable ordering + search + groups="base.group_user") activity_summary = fields.Char( - 'Next Activity Summary', related='activity_ids.summary', - search='_search_activity_summary') + 'Next Activity Summary', + related='activity_ids.summary', + search='_search_activity_summary', + groups="base.group_user",) @api.depends('activity_ids.state') def _compute_activity_state(self): |