diff options
| author | Julien (juc) Castiaux <juc@odoo.com> | 2018-11-15 09:32:37 +0000 |
|---|---|---|
| committer | Nicolas Martinelli <nim@odoo.com> | 2018-11-26 09:49:50 +0000 |
| commit | 5c38c87ddd0538aaa75d5cbf153a274637edbd64 (patch) | |
| tree | 7a07cb1c8982136c6abb478d1695d53159f25206 /addons/web/static/src/js/fields/basic_fields.js | |
| parent | c9e32872c00e8b324a540fb2cf5045b67420b364 (diff) | |
[FIX] mail: access error for the id of another company
When creating a mail for a user in an other company then the
record, the "send" button fails with a traceback because on
specific template try to access the company.id of the user
which is not accessible due to the access controle.
This PR fixes the problem by sudoing the access to company id.
The mail now sends without problem.
Step to reproduce:
1. Use two companies (comp1 and comp2)
2. Use 3 users (user1, user2, user3)
3. Be sure every user has a confirmed account
4. Change the users to set both company as allowed.
5. Set the current company of the users as follow:
user1: comp1
user2: comp2
user3: comp2
6. Install the project module
7. In `settings > security > record rules`, archive the rules named:
- `Project: multiple-company`
- `Project/Task: multiple-company`
- `user rule`
8. Using user1, create a new project and a new task.
9. Using user2, go to `Project module > Search`, remove `My tasks` filter,
select the task created by user1, in the chatter add user3 as follower.
10. Send the mail => access error.
The `AccessError` is due to user2 trying to access comp1, in particular
`company.name`.
By adding a `sudo`, we also make sure that the template rendering won't
fail bacause of a similar `AccessError`.
opw-1907844
closes odoo/odoo#28710
Diffstat (limited to 'addons/web/static/src/js/fields/basic_fields.js')
0 files changed, 0 insertions, 0 deletions
