diff options
| author | Nicolas Martinelli <nim@odoo.com> | 2019-10-07 16:10:04 +0000 |
|---|---|---|
| committer | Nicolas Martinelli <nim@odoo.com> | 2019-10-08 08:13:21 +0000 |
| commit | e42aa1e34462256fcd17015f32cebd5f4f79df5e (patch) | |
| tree | 19f3fabeb96f9bc77975eae4c6220e4534c425a4 | |
| parent | 8d910c59b5cef5501384cad73976384f429fcd25 (diff) | |
[FIX] hr_attendance: do not allow grouping
The user for the kiosk mode must have access to personal information of
the employees. To avoid easily leaking information, prevent grouping.
Fixes #34231
opw-2079330
closes odoo/odoo#38120
Signed-off-by: Nicolas Martinelli (nim) <nim@odoo.com>
| -rw-r--r-- | addons/hr_attendance/i18n/hr_attendance.pot | 6 | ||||
| -rw-r--r-- | addons/hr_attendance/models/hr_employee.py | 6 | ||||
| -rw-r--r-- | addons/hr_attendance/static/src/js/kiosk_mode.js | 6 |
3 files changed, 17 insertions, 1 deletions
diff --git a/addons/hr_attendance/i18n/hr_attendance.pot b/addons/hr_attendance/i18n/hr_attendance.pot index 5760f9a2e42..11dccff52c5 100644 --- a/addons/hr_attendance/i18n/hr_attendance.pot +++ b/addons/hr_attendance/i18n/hr_attendance.pot @@ -655,6 +655,12 @@ msgid "Sign out" msgstr "" #. module: hr_attendance +#: code:addons/hr_attendance/models/hr_employee.py:155 +#, python-format +msgid "Such grouping is not allowed." +msgstr "" + +#. module: hr_attendance #: model_terms:ir.actions.act_window,help:hr_attendance.hr_attendance_action #: model_terms:ir.actions.act_window,help:hr_attendance.hr_attendance_action_employee msgid "The attendance records of your employees will be displayed here." diff --git a/addons/hr_attendance/models/hr_employee.py b/addons/hr_attendance/models/hr_employee.py index f52b2acb11e..e3f61c64046 100644 --- a/addons/hr_attendance/models/hr_employee.py +++ b/addons/hr_attendance/models/hr_employee.py @@ -141,3 +141,9 @@ class HrEmployeeBase(models.AbstractModel): raise exceptions.UserError(_('Cannot perform check out on %(empl_name)s, could not find corresponding check in. ' 'Your attendances have probably been modified manually by human resources.') % {'empl_name': self.sudo().name, }) return attendance + + @api.model + def read_group(self, domain, fields, groupby, offset=0, limit=None, orderby=False, lazy=True): + if 'pin' in groupby or 'pin' in self.env.context.get('group_by', '') or self.env.context.get('no_group_by'): + raise exceptions.UserError(_('Such grouping is not allowed.')) + return super(HrEmployeeBase, self).read_group(domain, fields, groupby, offset=offset, limit=limit, orderby=orderby, lazy=lazy) diff --git a/addons/hr_attendance/static/src/js/kiosk_mode.js b/addons/hr_attendance/static/src/js/kiosk_mode.js index 5370874a1b9..6ce0c0260a5 100644 --- a/addons/hr_attendance/static/src/js/kiosk_mode.js +++ b/addons/hr_attendance/static/src/js/kiosk_mode.js @@ -11,7 +11,11 @@ var QWeb = core.qweb; var KioskMode = AbstractAction.extend({ events: { - "click .o_hr_attendance_button_employees": function(){ this.do_action('hr_attendance.hr_employee_attendance_action_kanban'); }, + "click .o_hr_attendance_button_employees": function() { + this.do_action('hr_attendance.hr_employee_attendance_action_kanban', { + additional_context: {'no_group_by': true}, + }); + }, }, start: function () { |