diff options
| author | Andrea Grazioso (agr-odoo) <agr@odoo.com> | 2020-04-30 14:40:42 +0000 |
|---|---|---|
| committer | Andrea Grazioso (agr-odoo) <agr@odoo.com> | 2020-05-04 14:20:46 +0000 |
| commit | 8a57e84a320f3ea8d867aa850d357a89c91af09a (patch) | |
| tree | b6bb0d8917965e94343ddad3086d074c93fd5b4d | |
| parent | 4310ba32146d9a522a0bc14d42a2eb41fda4bfe5 (diff) | |
[FIX] sale_timesheet: fix user permission to set sale order
Create a service product [DEMO] with service tracking
'Create a task in a new project'
Create a sale order SO1 with User 1 with [DEMO] product
Create a sale order SO2 with User 2 with [DEMO] product
SO1 will create a task in a project, edit this task and
assign as parent task the one created by SO2
The action will be blocked by security rules, because user 1 cannnot
see the sale order data of user 2 but the action should be
allowed.
Fixing the error with a sudo call
opw-2243370
closes odoo/odoo#50585
X-original-commit: 8c7d0266cc6d7bd0569721e92128096e64d9c361
Signed-off-by: Nicolas Martinelli (nim) <nim@odoo.com>
| -rw-r--r-- | addons/sale_timesheet/models/project.py | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/addons/sale_timesheet/models/project.py b/addons/sale_timesheet/models/project.py index a50ecc7afbd..97ea7d7335e 100644 --- a/addons/sale_timesheet/models/project.py +++ b/addons/sale_timesheet/models/project.py @@ -226,7 +226,7 @@ class ProjectTask(models.Model): def _compute_sale_order_id(self): for task in self: if task.billable_type == 'task_rate': - task.sale_order_id = task.sale_line_id.order_id or task.project_id.sale_order_id + task.sale_order_id = task.sale_line_id.sudo().order_id or task.project_id.sale_order_id elif task.billable_type == 'employee_rate': task.sale_order_id = task.project_id.sale_order_id elif task.billable_type == 'no': |