[FIX] account: res.partner: limit access to "total_invoiced" field to group "group_account_invoice". Use SUPERUSER_ID to access data

1 files changed, 6 insertions, 3 deletions

diff --git a/addons/account/partner.py b/addons/account/partner.py
index 36ad47fb159..2de2c0fd4d9 100644
--- a/addons/account/partner.py
+++ b/addons/account/partner.py
@@ -22,6 +22,7 @@
 from operator import itemgetter
 import time
 
+from openerp import SUPERUSER_ID
 from openerp.osv import fields, osv
 
 class account_fiscal_position(osv.osv):
@@ -166,8 +167,9 @@ class res_partner(osv.osv):
         result = {}
         account_invoice_report = self.pool.get('account.invoice.report')
         for partner in self.browse(cr, uid, ids, context=context):
-            invoice_ids = account_invoice_report.search(cr, uid, [('partner_id','child_of',partner.id)], context=context)
-            invoices = account_invoice_report.browse(cr, uid, invoice_ids, context=context)
+            domain = [('partner_id', 'child_of', partner.id)]
+            invoice_ids = account_invoice_report.search(cr, SUPERUSER_ID, domain, context=context)
+            invoices = account_invoice_report.browse(cr, SUPERUSER_ID, invoice_ids, context=context)
             result[partner.id] = sum(inv.user_currency_price_total for inv in invoices)
         return result
 
@@ -210,7 +212,8 @@ class res_partner(osv.osv):
             fnct_search=_credit_search, string='Total Receivable', multi='dc', help="Total amount this customer owes you."),
         'debit': fields.function(_credit_debit_get, fnct_search=_debit_search, string='Total Payable', multi='dc', help="Total amount you have to pay to this supplier."),
         'debit_limit': fields.float('Payable Limit'),
-        'total_invoiced': fields.function(_invoice_total, string="Total Invoiced", type='float'),
+        'total_invoiced': fields.function(_invoice_total, string="Total Invoiced", type='float', groups='account.group_account_invoice'),
+
         'contracts_count': fields.function(_journal_item_count, string="Contracts", type='integer', multi="invoice_journal"),
         'journal_item_count': fields.function(_journal_item_count, string="Journal Items", type="integer", multi="invoice_journal"),
         'property_account_payable': fields.property(