[FIX] web: no export button if user not in export group

PR #45400 disabled the export feature for those who were not in
group 'base.group_allow_export'. However, it only considered the
'Export' link in the actions menu. In list view, an export button
was still displayed in the control panel (next to 'Create'),
whether the user was in the group or not.

This commit fixes this issue.

Task 2348571

closes odoo/odoo#58890

X-original-commit: 1a9c58e4dbd4e7adbc05eada01ec85ac6eb3d427
Related: odoo/enterprise#13722
Signed-off-by: Mathieu Duckerts-Antoine <Polymorphe57@users.noreply.github.com>
Signed-off-by: Aaron Bohy (aab) <aab@odoo.com>

2 files changed, 51 insertions, 2 deletions

diff --git a/addons/web/static/src/xml/base.xml b/addons/web/static/src/xml/base.xml
index 6ca423f4552..c52c7e0ac60 100644
--- a/addons/web/static/src/xml/base.xml
+++ b/addons/web/static/src/xml/base.xml
@@ -822,7 +822,7 @@
                 Create
             </button>
         </t>
-        <t t-if="widget.is_action_enabled('export_xlsx')">
+        <t t-if="widget.is_action_enabled('export_xlsx') and widget.isExportEnable">
             <button type="button" class="btn btn-secondary fa fa-download o_list_export_xlsx" title="Export All"/>
         </t>
     </div>
diff --git a/addons/web/static/tests/views/list_tests.js b/addons/web/static/tests/views/list_tests.js
index 900375d0b59..2a356fae9fe 100644
--- a/addons/web/static/tests/views/list_tests.js
+++ b/addons/web/static/tests/views/list_tests.js
@@ -245,8 +245,40 @@ QUnit.module('Views', {
         list.destroy();
     });
 
+    QUnit.test('export feature in list for users not in base.group_allow_export', async function (assert) {
+        assert.expect(5);
+
+        const list = await createView({
+            View: ListView,
+            model: 'foo',
+            data: this.data,
+            viewOptions: { hasActionMenus: true },
+            arch: '<tree><field name="foo"/></tree>',
+            session: {
+                async user_has_group(group) {
+                    if (group === 'base.group_allow_export') {
+                        return false;
+                    }
+                    return this._super(...arguments);
+                },
+            },
+        });
+
+        assert.containsNone(list.el, 'div.o_control_panel .o_cp_action_menus');
+        assert.ok(list.$('tbody td.o_list_record_selector').length, 'should have at least one record');
+        assert.containsNone(list.el, 'div.o_control_panel .o_cp_buttons .o_list_export_xlsx');
+
+        await testUtils.dom.click(list.$('tbody td.o_list_record_selector:first input'));
+        assert.containsOnce(list.el, 'div.o_control_panel .o_cp_action_menus');
+        await cpHelpers.toggleActionMenu(list);
+        assert.deepEqual(cpHelpers.getMenuItemTexts(list), ['Delete'],
+            'action menu should not contain the Export button');
+
+        list.destroy();
+    });
+
     QUnit.test('list with export button', async function (assert) {
-        assert.expect(4);
+        assert.expect(5);
 
         const list = await createView({
             View: ListView,
@@ -266,6 +298,7 @@ QUnit.module('Views', {
 
         assert.containsNone(list.el, 'div.o_control_panel .o_cp_action_menus');
         assert.ok(list.$('tbody td.o_list_record_selector').length, 'should have at least one record');
+        assert.containsOnce(list.el, 'div.o_control_panel .o_cp_buttons .o_list_export_xlsx');
 
         await testUtils.dom.click(list.$('tbody td.o_list_record_selector:first input'));
         assert.containsOnce(list.el, 'div.o_control_panel .o_cp_action_menus');
@@ -287,6 +320,14 @@ QUnit.module('Views', {
             model: 'foo',
             data: this.data,
             arch: '<tree><field name="foo"/></tree>',
+            session: {
+                async user_has_group(group) {
+                    if (group === 'base.group_allow_export') {
+                        return true;
+                    }
+                    return this._super(...arguments);
+                },
+            },
         });
 
         assert.containsN(list, '.o_data_row', 4);
@@ -312,6 +353,14 @@ QUnit.module('Views', {
             data: this.data,
             arch: '<tree><field name="foo"/></tree>',
             domain: [["id", "<", 0]], // such that no record matches the domain
+            session: {
+                async user_has_group(group) {
+                    if (group === 'base.group_allow_export') {
+                        return true;
+                    }
+                    return this._super(...arguments);
+                },
+            },
         });
 
         assert.isNotVisible(list.el.querySelector('.o_list_export_xlsx'));