diff options
| author | Romain Derie <rde@odoo.com> | 2019-03-12 10:07:04 +0000 |
|---|---|---|
| committer | Romain Derie <rde@odoo.com> | 2019-03-14 10:28:02 +0000 |
| commit | 9608d4551d2ef9c2774c2d9574181f2c98923005 (patch) | |
| tree | 37ecfd4ca073f5d2833249c9cbe24376b9b9cc7b /addons/web/static/src/js/views/basic/basic_controller.js | |
| parent | a5a5a57e482ccecb3e18abf7f04778ffe3c63d38 (diff) | |
[FIX] website_sale: prevent compute search to be run in sudo
Before this commit, when accessing an user's pricelist, it would raise a 500
error in multi-company environment.
Indeed, when doing `self.env.user.partner_id.property_product_pricelist`, even
if self.env is not un sudo mode, the compute from `property_product_pricelist`
is executed as sudo. Since this method is then doing a `search()`, it won't use
the multi-company pricelist ir.rule. It will return all the pricelist,
including the ones from other companies.
Then, when trying to read that pricelist, it will raise an access error.
Now, we correctly execute the compute (and so the search) in the user env, it
won't get pricelists from other companies.
Diffstat (limited to 'addons/web/static/src/js/views/basic/basic_controller.js')
0 files changed, 0 insertions, 0 deletions
