diff options
| author | Nicolas Martinelli <nim@odoo.com> | 2016-10-31 15:23:12 +0100 |
|---|---|---|
| committer | Nicolas Martinelli <nim@odoo.com> | 2016-11-02 08:43:02 +0100 |
| commit | a4c67f2b9ed619a1dc5a386ea34e5bbde3fbb12b (patch) | |
| tree | e982349b9c3546e60d8fabd9b4a982cb2be0a16d /addons | |
| parent | a699504536a38cbcd631da7d489319b90e9adf5e (diff) | |
[FIX] website_quote: tokenized link in portal
When a user has access to a quote (because he is follower) but he is not
in the same company than the customer, an access error can occur on the
the rendering of the partner field.
We use the tokenized link instead, which will read the SO as a superuser
to avoid this situation.
opw-691740
Diffstat (limited to 'addons')
| -rw-r--r-- | addons/website_quote/views/website_quotation.xml | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/addons/website_quote/views/website_quotation.xml b/addons/website_quote/views/website_quotation.xml index 5453719966a..cd7b7616cad 100644 --- a/addons/website_quote/views/website_quotation.xml +++ b/addons/website_quote/views/website_quotation.xml @@ -692,7 +692,12 @@ <t t-foreach="quotations" t-as="quotation"> <tr> <td> - <a t-attf-href="/quote/#{quotation.id}?#{keep_query()}"><t t-esc="quotation.name"/></a> + <t t-if="quotation.sudo().partner_id.commercial_partner_id != request.env.user.partner_id.commercial_partner_id and request.env.user.share"> + <a t-attf-href="/quote/#{quotation.id}/#{quotation.access_token}?#{keep_query()}"><t t-esc="quotation.name"/></a> + </t> + <t t-if="not (quotation.sudo().partner_id.commercial_partner_id != request.env.user.partner_id.commercial_partner_id and request.env.user.share)"> + <a t-attf-href="/quote/#{quotation.id}?#{keep_query()}"><t t-esc="quotation.name"/></a> + </t> </td> <td><span t-field="quotation.validity_date"/></td> <td> |