diff options
| author | Martin Trigaux <mat@odoo.com> | 2021-02-04 14:25:07 +0000 |
|---|---|---|
| committer | Martin Trigaux <mat@odoo.com> | 2021-02-05 09:36:36 +0000 |
| commit | 33868b4e14124800035ea99df111b35b4199ae60 (patch) | |
| tree | a5760061c130d2dedcfc7d570968a03780300233 /odoo | |
| parent | f8cecfcc95fb46b0ea1c265e18c49769cb785784 (diff) | |
[FIX] base: query company dependant as superuser
When retrieving company dependant values, the computed domain called
search_multi method of ir.property as normal user.
Since odoo/odoo@8f578637076d4b65 ir.property records are no longer
readable by a normal classical user.
To reproduce:
Add a domain using a company_dependant field
e.g. on res.partner, with purchase installed, modify the parent_id
field in form view to
<field name="parent_id" ... domain="[('property_purchase_currency_id','=',property_purchase_currency_id)]" />
When clicking on the parent_id with a low priviledge user, an
access-right error is raised, as the user doesn't have access to
ir.property records
Fixes odoo/odoo#65450
closes odoo/odoo#65552
Signed-off-by: Martin Trigaux (mat) <mat@odoo.com>
Diffstat (limited to 'odoo')
| -rw-r--r-- | odoo/addons/test_new_api/tests/test_new_fields.py | 6 | ||||
| -rw-r--r-- | odoo/fields.py | 2 |
2 files changed, 7 insertions, 1 deletions
diff --git a/odoo/addons/test_new_api/tests/test_new_fields.py b/odoo/addons/test_new_api/tests/test_new_fields.py index 45a7f8a4c35..652ae349ae0 100644 --- a/odoo/addons/test_new_api/tests/test_new_fields.py +++ b/odoo/addons/test_new_api/tests/test_new_fields.py @@ -1374,6 +1374,12 @@ class TestFields(TransactionCaseWithUserDemo): self.assertEqual(attribute_record.company.foo, 'DEF') self.assertEqual(attribute_record.bar, 'DEFDEF') + # a low priviledge user should be able to search on company_dependent fields + company_record.env.user.groups_id -= self.env.ref('base.group_system') + self.assertFalse(company_record.env.user.has_group('base.group_system')) + company_records = self.env['test_new_api.company'].search([('foo', '=', 'DEF')]) + self.assertEqual(len(company_records), 1) + def test_30_read(self): """ test computed fields as returned by read(). """ discussion = self.env.ref('test_new_api.discussion_0') diff --git a/odoo/fields.py b/odoo/fields.py index b936d6c83fd..935dccf26a5 100644 --- a/odoo/fields.py +++ b/odoo/fields.py @@ -607,7 +607,7 @@ class Field(MetaField('DummyField', (object,), {})): Property._set_multi(self.name, self.model_name, values) def _search_company_dependent(self, records, operator, value): - Property = records.env['ir.property'] + Property = records.env['ir.property'].sudo() return Property.search_multi(self.name, self.model_name, operator, value) # |