diff options
| author | Romain Derie <rde@odoo.com> | 2019-07-22 09:34:39 +0000 |
|---|---|---|
| committer | Romain Derie <rde@odoo.com> | 2019-07-22 09:47:57 +0000 |
| commit | 4d942852c82414bd986112230a3e8e2d183b5c59 (patch) | |
| tree | d36b37622c7a0ce42e90072128bda537e478ad61 /addons | |
| parent | a55fb7ad0c0223b42ab647035621ce8fba58522d (diff) | |
[FIX] portal: correctly return the document in sudo
Since 1e6c3bec2c5 that refactored the sudo in general, the
`_document_check_access` method from portal that was supposed to return the
document in sudo mode was not returning the expected record.
It was not with the admin UID, making some code to crash, for instance:
https://github.com/odoo/odoo/blame/120f890ecf57969878399d9543b49080e7618c60/addons/stock/models/stock_quant.py#L252
Which is doing `self.with_user(self._uid).check_access_rights('read')`.
Step to reproduce:
- Install `sale_stock` module.
- Create a quotation for a portal user
- As the portal user, try to sign the quotation
- It will crash on `stock.quant` right access
closes odoo/odoo#35030
Signed-off-by: Xavier Dollé (xdo) <xdo@odoo.com>
Diffstat (limited to 'addons')
| -rw-r--r-- | addons/portal/controllers/portal.py | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/addons/portal/controllers/portal.py b/addons/portal/controllers/portal.py index 2efa54b5c17..581f2351e7d 100644 --- a/addons/portal/controllers/portal.py +++ b/addons/portal/controllers/portal.py @@ -8,7 +8,7 @@ import re from werkzeug import urls -from odoo import fields as odoo_fields, tools, _ +from odoo import fields as odoo_fields, tools, _, SUPERUSER_ID from odoo.exceptions import ValidationError, AccessError, MissingError, UserError from odoo.http import content_disposition, Controller, request, route from odoo.tools import consteq @@ -242,7 +242,7 @@ class CustomerPortal(Controller): def _document_check_access(self, model_name, document_id, access_token=None): document = request.env[model_name].browse([document_id]) - document_sudo = document.sudo().exists() + document_sudo = document.with_user(SUPERUSER_ID).exists() if not document_sudo: raise MissingError("This document does not exist.") try: |