diff options
26 files changed, 31 insertions, 25 deletions
diff --git a/addons/account/models/account_move.py b/addons/account/models/account_move.py index 91bdaedbd3a..343a08ac9e0 100644 --- a/addons/account/models/account_move.py +++ b/addons/account/models/account_move.py @@ -1271,6 +1271,8 @@ class AccountMoveLine(models.Model): @api.model def _query_get(self, domain=None): + self.check_access_rights('read') + context = dict(self._context or {}) domain = domain or [] if not isinstance(domain, (list, tuple)): @@ -1328,6 +1330,10 @@ class AccountMoveLine(models.Model): tables = '' if domain: query = self._where_calc(domain) + + # Wrap the query with 'company_id IN (...)' to avoid bypassing company access rights. + self._apply_ir_rules(query) + tables, where_clause, where_clause_params = query.get_sql() return tables, where_clause, where_clause_params diff --git a/addons/account/report/account_aged_partner_balance.py b/addons/account/report/account_aged_partner_balance.py index 7b9c5c33f93..35a423b1550 100644 --- a/addons/account/report/account_aged_partner_balance.py +++ b/addons/account/report/account_aged_partner_balance.py @@ -211,7 +211,7 @@ class ReportAgedPartnerBalance(models.AbstractModel): return res, total, lines @api.model - def get_report_values(self, docids, data=None): + def _get_report_values(self, docids, data=None): if not data.get('form') or not self.env.context.get('active_model') or not self.env.context.get('active_id'): raise UserError(_("Form content is missing, this report cannot be printed.")) diff --git a/addons/account/report/account_balance.py b/addons/account/report/account_balance.py index 3c54e886d13..020a71efea6 100644 --- a/addons/account/report/account_balance.py +++ b/addons/account/report/account_balance.py @@ -59,7 +59,7 @@ class ReportTrialBalance(models.AbstractModel): @api.model - def get_report_values(self, docids, data=None): + def _get_report_values(self, docids, data=None): if not data.get('form') or not self.env.context.get('active_model'): raise UserError(_("Form content is missing, this report cannot be printed.")) diff --git a/addons/account/report/account_general_ledger.py b/addons/account/report/account_general_ledger.py index be46e7b361b..ce7ce9f113f 100644 --- a/addons/account/report/account_general_ledger.py +++ b/addons/account/report/account_general_ledger.py @@ -109,7 +109,7 @@ class ReportGeneralLedger(models.AbstractModel): return account_res @api.model - def get_report_values(self, docids, data=None): + def _get_report_values(self, docids, data=None): if not data.get('form') or not self.env.context.get('active_model'): raise UserError(_("Form content is missing, this report cannot be printed.")) diff --git a/addons/account/report/account_invoice_report.py b/addons/account/report/account_invoice_report.py index 0ec63187a9a..16f7f5360ee 100644 --- a/addons/account/report/account_invoice_report.py +++ b/addons/account/report/account_invoice_report.py @@ -179,7 +179,7 @@ class ReportInvoiceWithPayment(models.AbstractModel): _name = 'report.account.report_invoice_with_payments' @api.model - def get_report_values(self, docids, data=None): + def _get_report_values(self, docids, data=None): report = self.env['ir.actions.report']._get_report_from_name('account.report_invoice_with_payments') return { 'doc_ids': docids, diff --git a/addons/account/report/account_journal.py b/addons/account/report/account_journal.py index 083dae336a7..8521ecffc05 100644 --- a/addons/account/report/account_journal.py +++ b/addons/account/report/account_journal.py @@ -95,7 +95,7 @@ class ReportJournal(models.AbstractModel): return self.env['account.move.line'].with_context(data['form'].get('used_context', {}))._query_get() @api.model - def get_report_values(self, docids, data=None): + def _get_report_values(self, docids, data=None): if not data.get('form'): raise UserError(_("Form content is missing, this report cannot be printed.")) diff --git a/addons/account/report/account_overdue_report.py b/addons/account/report/account_overdue_report.py index 99463c482bb..12e25678b3e 100644 --- a/addons/account/report/account_overdue_report.py +++ b/addons/account/report/account_overdue_report.py @@ -31,7 +31,7 @@ class ReportOverdue(models.AbstractModel): return res @api.model - def get_report_values(self, docids, data=None): + def _get_report_values(self, docids, data=None): totals = {} lines = self._get_account_move_lines(docids) lines_to_display = {} diff --git a/addons/account/report/account_partner_ledger.py b/addons/account/report/account_partner_ledger.py index 68fe77f8f40..ccd2c41d647 100644 --- a/addons/account/report/account_partner_ledger.py +++ b/addons/account/report/account_partner_ledger.py @@ -69,7 +69,7 @@ class ReportPartnerLedger(models.AbstractModel): return result @api.model - def get_report_values(self, docids, data=None): + def _get_report_values(self, docids, data=None): if not data.get('form'): raise UserError(_("Form content is missing, this report cannot be printed.")) diff --git a/addons/account/report/account_report_financial.py b/addons/account/report/account_report_financial.py index e68e5d6d9fb..5f0f5bd497c 100644 --- a/addons/account/report/account_report_financial.py +++ b/addons/account/report/account_report_financial.py @@ -144,7 +144,7 @@ class ReportFinancial(models.AbstractModel): return lines @api.model - def get_report_values(self, docids, data=None): + def _get_report_values(self, docids, data=None): if not data.get('form') or not self.env.context.get('active_model') or not self.env.context.get('active_id'): raise UserError(_("Form content is missing, this report cannot be printed.")) diff --git a/addons/account/report/account_tax.py b/addons/account/report/account_tax.py index 97cdff1484a..e41ee0564f0 100644 --- a/addons/account/report/account_tax.py +++ b/addons/account/report/account_tax.py @@ -8,7 +8,7 @@ class ReportTax(models.AbstractModel): _name = 'report.account.report_tax' @api.model - def get_report_values(self, docids, data=None): + def _get_report_values(self, docids, data=None): if not data.get('form'): raise UserError(_("Form content is missing, this report cannot be printed.")) return { diff --git a/addons/account_test/report/report_account_test.py b/addons/account_test/report/report_account_test.py index ac64c1faea0..1420f647cf8 100644 --- a/addons/account_test/report/report_account_test.py +++ b/addons/account_test/report/report_account_test.py @@ -61,7 +61,7 @@ class ReportAssertAccount(models.AbstractModel): return result @api.model - def get_report_values(self, docids, data=None): + def _get_report_values(self, docids, data=None): report = self.env['ir.actions.report']._get_report_from_name('account_test.report_accounttest') records = self.env['accounting.assert.test'].browse(self.ids) return { diff --git a/addons/hr_holidays/report/holidays_summary_report.py b/addons/hr_holidays/report/holidays_summary_report.py index 1532f49e0f3..1f75ea51fae 100644 --- a/addons/hr_holidays/report/holidays_summary_report.py +++ b/addons/hr_holidays/report/holidays_summary_report.py @@ -107,7 +107,7 @@ class HrHolidaySummaryReport(models.AbstractModel): return res @api.model - def get_report_values(self, docids, data=None): + def _get_report_values(self, docids, data=None): if not data.get('form'): raise UserError(_("Form content is missing, this report cannot be printed.")) diff --git a/addons/hr_payroll/report/report_contribution_register.py b/addons/hr_payroll/report/report_contribution_register.py index 16de7b5e948..f9e44981d00 100644 --- a/addons/hr_payroll/report/report_contribution_register.py +++ b/addons/hr_payroll/report/report_contribution_register.py @@ -29,7 +29,7 @@ class ContributionRegisterReport(models.AbstractModel): return result @api.model - def get_report_values(self, docids, data=None): + def _get_report_values(self, docids, data=None): if not data.get('form'): raise UserError(_("Form content is missing, this report cannot be printed.")) diff --git a/addons/hr_payroll/report/report_payslip_details.py b/addons/hr_payroll/report/report_payslip_details.py index ffd5b9d913d..3c44ca838a1 100644 --- a/addons/hr_payroll/report/report_payslip_details.py +++ b/addons/hr_payroll/report/report_payslip_details.py @@ -86,7 +86,7 @@ class PayslipDetailsReport(models.AbstractModel): return res @api.model - def get_report_values(self, docids, data=None): + def _get_report_values(self, docids, data=None): payslips = self.env['hr.payslip'].browse(docids) return { 'doc_ids': docids, diff --git a/addons/l10n_fr_hr_payroll/report/fiche_paye.py b/addons/l10n_fr_hr_payroll/report/fiche_paye.py index a4e24cb43ea..95874f8ee4b 100644 --- a/addons/l10n_fr_hr_payroll/report/fiche_paye.py +++ b/addons/l10n_fr_hr_payroll/report/fiche_paye.py @@ -30,7 +30,7 @@ class FichePayeParser(models.AbstractModel): return self.env['hr.payslip.line'].search([('slip_id', '=', obj.id), ('salary_rule_id.parent_rule_id.id', '=', parent_line.salary_rule_id.id)], limit=1) @api.model - def get_report_values(self, docids, data=None): + def _get_report_values(self, docids, data=None): payslip = self.env['hr.payslip'].browse(docids) return { 'doc_ids': docids, diff --git a/addons/l10n_in_hr_payroll/report/report_hr_salary_employee_bymonth.py b/addons/l10n_in_hr_payroll/report/report_hr_salary_employee_bymonth.py index f81c7f7b996..1b64302203c 100644 --- a/addons/l10n_in_hr_payroll/report/report_hr_salary_employee_bymonth.py +++ b/addons/l10n_in_hr_payroll/report/report_hr_salary_employee_bymonth.py @@ -93,7 +93,7 @@ class ReportHrSalaryEmployeeBymonth(models.AbstractModel): return self.total @api.model - def get_report_values(self, docids, data=None): + def _get_report_values(self, docids, data=None): if not data.get('form') or not self.env.context.get('active_model') or not self.env.context.get('active_id'): raise UserError(_("Form content is missing, this report cannot be printed.")) diff --git a/addons/l10n_in_hr_payroll/report/report_hr_yearly_salary_detail.py b/addons/l10n_in_hr_payroll/report/report_hr_yearly_salary_detail.py index 0d26efe9bf5..de948a03fee 100644 --- a/addons/l10n_in_hr_payroll/report/report_hr_yearly_salary_detail.py +++ b/addons/l10n_in_hr_payroll/report/report_hr_yearly_salary_detail.py @@ -126,7 +126,7 @@ class EmployeesYearlySalaryReport(models.AbstractModel): return self.total @api.model - def get_report_values(self, docids, data=None): + def _get_report_values(self, docids, data=None): if not self.env.context.get('active_model') or not self.env.context.get('active_id'): raise UserError(_("Form content is missing, this report cannot be printed.")) diff --git a/addons/l10n_in_hr_payroll/report/report_payroll_advice.py b/addons/l10n_in_hr_payroll/report/report_payroll_advice.py index e72e95f0683..0a294694404 100644 --- a/addons/l10n_in_hr_payroll/report/report_payroll_advice.py +++ b/addons/l10n_in_hr_payroll/report/report_payroll_advice.py @@ -42,7 +42,7 @@ class payroll_advice_report(models.AbstractModel): return result @api.model - def get_report_values(self, docids, data=None): + def _get_report_values(self, docids, data=None): advice = self.env['hr.payroll.advice'].browse(docids) return { 'doc_ids': docids, diff --git a/addons/l10n_in_hr_payroll/report/report_payslip_details.py b/addons/l10n_in_hr_payroll/report/report_payslip_details.py index 02e4af7b0a2..373ddd89ebb 100644 --- a/addons/l10n_in_hr_payroll/report/report_payslip_details.py +++ b/addons/l10n_in_hr_payroll/report/report_payslip_details.py @@ -9,7 +9,7 @@ class PayslipDetailsReportIN(models.AbstractModel): _inherit = 'report.hr_payroll.report_payslipdetails' @api.model - def get_report_values(self, docids, data=None): + def _get_report_values(self, docids, data=None): payslips = self.env['hr.payslip'].browse(docids) return { 'doc_ids': docids, diff --git a/addons/mrp/report/mrp_report_bom_structure.py b/addons/mrp/report/mrp_report_bom_structure.py index c9a461815a1..7af40fcb785 100644 --- a/addons/mrp/report/mrp_report_bom_structure.py +++ b/addons/mrp/report/mrp_report_bom_structure.py @@ -9,7 +9,7 @@ class ReportBomStructure(models.AbstractModel): _name = 'report.mrp.report_bom_structure' @api.model - def get_report_values(self, docids, data=None): + def _get_report_values(self, docids, data=None): docs = [] for bom_id in docids: bom = self.env['mrp.bom'].browse(bom_id) diff --git a/addons/point_of_sale/models/pos_order.py b/addons/point_of_sale/models/pos_order.py index 2972e9f7e2c..93a6a4a5e3a 100644 --- a/addons/point_of_sale/models/pos_order.py +++ b/addons/point_of_sale/models/pos_order.py @@ -1124,7 +1124,7 @@ class ReportSaleDetails(models.AbstractModel): } @api.multi - def get_report_values(self, docids, data=None): + def _get_report_values(self, docids, data=None): data = dict(data or {}) configs = self.env['pos.config'].browse(data['config_ids']) data.update(self.get_sale_details(data['date_start'], data['date_stop'], configs)) diff --git a/addons/point_of_sale/report/pos_invoice.py b/addons/point_of_sale/report/pos_invoice.py index 7e25d2c6a80..6f51e30a3e4 100644 --- a/addons/point_of_sale/report/pos_invoice.py +++ b/addons/point_of_sale/report/pos_invoice.py @@ -9,7 +9,7 @@ class PosInvoiceReport(models.AbstractModel): _name = 'report.point_of_sale.report_invoice' @api.model - def get_report_values(self, docids, data=None): + def _get_report_values(self, docids, data=None): PosOrder = self.env['pos.order'] ids_to_print = [] invoiced_posorders_ids = [] diff --git a/addons/product/report/product_pricelist.py b/addons/product/report/product_pricelist.py index 91f72d6cadd..1b5c56003cf 100644 --- a/addons/product/report/product_pricelist.py +++ b/addons/product/report/product_pricelist.py @@ -9,7 +9,7 @@ class report_product_pricelist(models.AbstractModel): _name = 'report.product.report_pricelist' @api.model - def get_report_values(self, docids, data=None): + def _get_report_values(self, docids, data=None): data = data if data is not None else {} pricelist = self.env['product.pricelist'].browse(data.get('form', {}).get('price_list', False)) products = self.env['product.product'].browse(data.get('ids', data.get('active_ids'))) diff --git a/addons/sale/report/sale_report.py b/addons/sale/report/sale_report.py index 25ea9aa316c..23bcb4bd13b 100644 --- a/addons/sale/report/sale_report.py +++ b/addons/sale/report/sale_report.py @@ -135,7 +135,7 @@ class SaleOrderReportProforma(models.AbstractModel): _name = 'report.sale.report_saleproforma' @api.multi - def get_report_values(self, docids, data=None): + def _get_report_values(self, docids, data=None): docs = self.env['sale.order'].browse(docids) return { 'doc_ids': docs.ids, diff --git a/odoo/addons/base/models/ir_actions_report.py b/odoo/addons/base/models/ir_actions_report.py index fa600211795..0658f5250a9 100644 --- a/odoo/addons/base/models/ir_actions_report.py +++ b/odoo/addons/base/models/ir_actions_report.py @@ -658,7 +658,7 @@ class IrActionsReport(models.Model): report_model = self.env.get(report_model_name) if report_model is not None: - data = report_model.get_report_values(docids, data=data) + data = report_model._get_report_values(docids, data=data) else: docs = self.env[self.model].browse(docids) data = { diff --git a/odoo/addons/base/report/report_base_report_irmodulereference.py b/odoo/addons/base/report/report_base_report_irmodulereference.py index 03632644159..58d55206202 100644 --- a/odoo/addons/base/report/report_base_report_irmodulereference.py +++ b/odoo/addons/base/report/report_base_report_irmodulereference.py @@ -26,7 +26,7 @@ class IrModelReferenceReport(models.AbstractModel): return [] @api.model - def get_report_values(self, docids, data=None): + def _get_report_values(self, docids, data=None): report = self.env['ir.actions.report']._get_report_from_name('base.report_irmodulereference') selected_modules = self.env['ir.module.module'].browse(docids) return { |