summaryrefslogtreecommitdiff
path: root/addons/web/static/src/js/views/basic/basic_controller.js
diff options
context:
space:
mode:
authorRomain Derie <rde@odoo.com>2019-03-12 10:07:04 +0000
committerRomain Derie <rde@odoo.com>2019-03-14 10:28:02 +0000
commit9608d4551d2ef9c2774c2d9574181f2c98923005 (patch)
tree37ecfd4ca073f5d2833249c9cbe24376b9b9cc7b /addons/web/static/src/js/views/basic/basic_controller.js
parenta5a5a57e482ccecb3e18abf7f04778ffe3c63d38 (diff)
[FIX] website_sale: prevent compute search to be run in sudo
Before this commit, when accessing an user's pricelist, it would raise a 500 error in multi-company environment. Indeed, when doing `self.env.user.partner_id.property_product_pricelist`, even if self.env is not un sudo mode, the compute from `property_product_pricelist` is executed as sudo. Since this method is then doing a `search()`, it won't use the multi-company pricelist ir.rule. It will return all the pricelist, including the ones from other companies. Then, when trying to read that pricelist, it will raise an access error. Now, we correctly execute the compute (and so the search) in the user env, it won't get pricelists from other companies.
Diffstat (limited to 'addons/web/static/src/js/views/basic/basic_controller.js')
0 files changed, 0 insertions, 0 deletions