summaryrefslogtreecommitdiff
path: root/odoo/addons/test_new_api/security
AgeCommit message (Collapse)Author
2021-05-19[FIX] core: computed editable one2many field with a domainRaphael Collet
Manually adding a line should not trigger the computation of the field, just like modifying the line fields that occur in the field's domain. In other words, the dependencies of the field should be limited to the ones declared on field or its compute method. closes odoo/odoo#71027 X-original-commit: 9000a50582db827ff12acdecf8ef91749122452d Signed-off-by: Raphael Collet (rco) <rco@openerp.com>
2021-03-10[FIX] base: properly execute Selection field ondelete actionsAdrian Torres
With this commit, 2 changes are made to the way that the fields.Selection.ondelete cleanup action works: 1) We manually delete ir.model.fields.selection **before** the deletion of ir.model.fields purposefully to **avoid** SQL CASCADE deletes, as we do not know which selections are deleted in cascade and thus we cannot perform the corresponding ondelete cleanup action (which is implemented within the ORM). 2) In some actions, namely 'set default' and 'set null', we write a "safe" value to the records containing the Selection being deleted, before this commit this would go through the ORM (records.write()) but this is problematic if there's a write override for the record's model that raises an error for the field being written to. With this commit, we first try to go through the ORM but if there's a failure (because of the raise in a write override) then we will bypass the ORM and set it with SQL. opw-2451126 closes odoo/odoo#67253 Signed-off-by: Adrian Torres (adt) <adt@odoo.com>
2021-01-05[FIX] core: marking of stored computed recursive fields during creationGuewen Baconnier
Fixes 3a6ac95 that ignores computation of recursive stored fields during creation of records. The problem happens when we have: * a recursive stored computed field * an `api.depends` of this field which is a relation to another record When this "another record" is created and should recompute the recursive field, it is ignored. closes odoo/odoo#64031 X-original-commit: 79634eefb225a7aaa6c3c26af126fb69078c22ac Signed-off-by: Raphael Collet (rco) <rco@openerp.com> Co-authored-by: Raphael Collet (rco) <rco@openerp.com>
2020-12-18[FIX] core: marking and traversing computed fields before modificationRaphael Collet
This fixes an issue that occurs when marking fields to compute in the following situation: - it occurs before the actual modification, - a relational field is marked to compute, - the same field is traversed to inverse some dependency. When the marking occurs after the modification, the traversal of the field should actually recompute the field. However, if the marking occurs before the modification, the inversion of dependencies must be based on the current value of the field. This is the case with method unlink(): we call method modified() to mark the fields that currently depend on the records to be deleted, and the fields must be computed only after the deletion! X-original-commit: 3a6ac95ddf6a8719aa714a83fc339ba838c3811d
2020-12-02[FIX] core: invalidation of computed editable field in one2manyLaurent Smet
This fixes the issue introduced by revision fd50ba9fb838067fab0b920470cf79b9c94d785c The way computed fields are invalidated depends on the order of the dict passed as a parameter to method onchange(). This causes some unexpected behavior when dealing with computed editable fields: the user loses the value in that field because of the onchange. Explanation: during the onchange, the modified field is cached by record._update_cache(changed_values, validate=True) If the field is a one2many, 'value' contains an update command for each modified line. Because of 'validate=True', the assignment triggers field computations on the lines, which are already handled by another call to onchange(). In case anything on the parent model modifies some line, the whole one2many values are returned to the user, and accidentally recomputed fields show up in the interface. closes odoo/odoo#62060 Signed-off-by: Raphael Collet (rco) <rco@openerp.com>
2020-10-02[FIX] core: cache consistency of one2many field with computed inverseXavier-Do
Consider a one2many field with a corresponding many2one field that is computed. After modifying the many2one field's dependencies, the cached value of the one2many field is inconsistent until the many2one field has been recomputed. Therefore, one has to force the computation of the many2one field before accessing the cached value of the one2many field. closes odoo/odoo#59031 X-original-commit: b9201ebdd65eaabab9257cf97c58410681783fa6 Signed-off-by: Xavier Dollé (xdo) <xdo@odoo.com> Signed-off-by: Raphael Collet (rco) <rco@openerp.com>
2020-09-21[FIX] core: always evaluate field.depends upon setupRaphael Collet
This is necessary when a field's dependencies are given by a callable. This functionality was broken with the support for an explicit parameter `depends` in the fields' definition, because the implementation could not distinguish between the field parameter `depends` and the `depends` evaluated from compute functions. The fix consists in storing the field parameter `depends` into `field._depends`, and the result of the setup into `field.depends`. closes odoo/odoo#58127 X-original-commit: d4d7925d69c9a37f099ddd3a8929004f17e162eb Signed-off-by: Raphael Collet (rco) <rco@openerp.com>
2020-08-21[IMP] core: error message for computed field left unassignedRaphael Collet
Non-stored readonly computed fields must be assigned by compute method. Make the error message more explicit. closes odoo/odoo#56269 Signed-off-by: Raphael Collet (rco) <rco@openerp.com>
2020-08-04[FIX] test_new_api: Fix bad shared cache usage for stored computed fieldsYannick Tivisse
Purpose ======= Since the 13.0, a regression has been introduced in hr_timesheet. Considering: - The account.analytic.line model, representing a timesheet entry - The project.task model, representing a task, on which we have the fields: - timesheet_ids: One2many - planned_hours: Computed (sudo), stored, representing the sum of the timesheet amounts - An ir.rule restricting the timesheets CRUD to his own only. A user can only see its own timesheets on a task, but the field "Planned Hours", which is stored-compute_sudo, should take all the timesheet lines into account However, when adding a new line and then recomputing the value, no existing line from another user is binded on self, then the value is erased and saved on the database. Specification ============= This commit introduces a test that illustrates that bad usage of a shared cache. A correct way to fix this could be to avoid using the cache if an ir.rule is pointing to the related model. That would force the recomputation in a real sudoed environment. closes odoo/odoo#55408 Taskid: 2285924 X-original-commit: 50e229fe66b2a82717d4260287e18a875bbd26f5 Signed-off-by: Yannick Tivisse (yti) <yti@odoo.com>
2020-07-08[ADD] test_new_api: tests on queries made by create with computed fieldsRaphael Collet
closes odoo/odoo#54209 Related: odoo/upgrade#1464 Signed-off-by: Raphael Collet (rco) <rco@openerp.com>
2020-05-06[FIX] core: unexpected cache invalidation when updating one2manyRaphael Collet
When setting a many2one field, the corresponding one2many fields are updated in cache. When such a one2many field has a domain, the evaluation of the domain may require to fetch some fields from the database. If the `towrite` cache has not been updated yet, the many2one field is overridden by the database value. Fix by setting the `towrite` cache before updating inverse fields. closes odoo/odoo#50788 X-original-commit: c1ebfe05a66cfebc7ced36e25db5f6ff4bfb2d46 Signed-off-by: Raphael Collet (rco) <rco@openerp.com>
2020-04-18[FIX] fields: screwing up cache when rounding monetary valueRaphael Collet
Consider a sales order with a single line. Edit the sales order: remove the line, and add another line with the same subtotal. When saving, the total of the sales order is 0.0. Here is the explanation: the form view performs a `write` on the sales order, and modifies the lines with a command `2` (remove line) and a command `0` (create line). After deleting the first order line, the cache is emptied, and a call to `flush()` forces the recomputation of the total. The value is computed to be 0, and assigned to the field. The assignment converts the value for the cache, without prefetching the currency field (optimization), and puts 0.0 in cache. The assignment then converts the value for the database, which prefetches most fields on the sales order: the cache is now inconsistent and contains the old value V, while the database is then updated with 0.0. After creating the new order line, the total is once again recomputed. Its value is V, and because the cache also contains that value, no update is performed to the database, which remains at 0.0! The fix consists in avoiding the prefetching of fields when accessing the currency field to round a monetary value. opw-2223134 closes odoo/odoo#49741 X-original-commit: 048ea2f20a0a2fa6d629cbe262cbbe765248d36f Signed-off-by: Raphael Collet (rco) <rco@openerp.com>
2020-03-30[IMP] core: introduce mechanism for selection_add cleanupAdrian Torres
- Let A and B be two different modules. - A defines a required Selection field F of model M and B extends it through the `selection_add` argument. - Create records of model M and have some of them have any of the options introduced by module B selected for field F. - Uninstall module B. The result will be records of Model M with an option for field F that no longer exists, this makes the registry inconsistent and prone to crashing (it is sufficient to access the form view of such a record to trigger a crash). This commit introduces a mechanism similar to the `ondelete` argument found in Many2one fields, the argument name is the same but it's different both in behaviour and in implementation. The `ondelete` mechanism for Selection fields is enforced for **any** Selection field with required set to `True`, this means that the developer is required to set a cleanup behaviour for when their module is uninstalled. For possible cleanup options, see fields.Selection's docstring. As far as implementation goes, everything is implemented in Python unlike with Many2one fields where the behaviour is delegated to PostgreSQL. The `ondelete` setting will be processed during `ir.model.fields.selection.unlink()` to ensure that the registry is left in an appropriate state after module uninstall.
2020-03-25[FIX] core: computed fields can be copied if editableThibault Delavallée
Purpose of this commit is to let computed stored editable fields being copied if their field class allows it. Indeed the value of those fields is computed based on some triggers but can also be updated manually by users. When copying a record, it makes sense to consider that this value is what the user expects and allow its copy, if the original field allows it. Either it was computed, and copied value will be correct without having to call computation again (well, provided all dependencies have been copied, too), or it was updated and the copied value will be the one the user entered. Without this fix, an edited field is not copied, and will be recomputed, which may look like an inconsistent value. Task ID 2209163 closes odoo/odoo#48383 X-original-commit: 4b274d3b4101fbae154a572cdf40d23838899773 Signed-off-by: Olivier Dony (odo) <odo@openerp.com> Signed-off-by: Raphael Collet (rco) <rco@openerp.com> Co-authored-by: Raphael Collet <rco@odoo.com>
2020-02-26[FIX] core: fix _flush_search() when _order depends on m2oSébastien Theys
closes odoo/odoo#46365 X-original-commit: 604b6a22db8eddfb37f9be31d3826394e25bd86c Signed-off-by: Raphael Collet (rco) <rco@openerp.com> Co-authored-by: Raphael Collet <rco@odoo.com> Co-authored-by: Sébastien Theys <seb@odoo.com>
2020-02-04[ADD] *: add ir.model.access on all transient modelsMartin Trigaux
Following changes needing ir.model.access on transient models too. Remove groups declaration on the action to move it to ir.model.access when possible. Rules are strict by default with no unlink access by default and high priviledge asked. Adaptations may be needed later. Write access is given as a wizard may need to be modified in case the action triggers an error and the user has to correct a value account*: use account.group_account_user for all transient by default remove account.print.journal relic stock*: use stock.group_stock_user by default survey: survey user can send invitations mail: allow any employee to execute wizards additional verifications are made to ensure they are executed only on the documents the user has access to you give portal access to mail.compose.message as portal still does some actions like posting messages on the forum add ir.rule to avoid reading somebody else messages increase the query count because of undeterminist count crm: saleman for lead2opp, manager for massmailing partner manager for actions linked to partners avoid a write in test_lead_lost sms: any employee can send sms mrp: mrp user can execute wizards give unlink access as making write during do_produce operation base_import: employees can import files delivery: stock user can deliver event_sale: sale user can configure the wizards event user inherit from sale rights gamification: employee can give badge google_service: resolve FIXME hr: add specific rights manager can set a plan according to group on button anyone who can write on an employee can register a departure hr_expense: set rights based on buttons hr_holidays: an approver can make a summary report hr_recruitment: recruiter can refuse a candidate hr_timesheet: can use the wizard if can create a timesheet l10n_eu_service: managers can create fiscal positions mass_mailing: same group as on mass.mailing.list membership: accountant can create invoice from membership payment: accountant can create a link as the source is an account.move keep the payment.acquirer.onboarding.wizard to system user only as it is called during company configuration point_of_sale: PoS manager only can use wizards never create closing_balance_confirm_wizard records product_expiry: stock user has rights on stock.picking product_margin: access from accounting menus repair: same rules as for above models sale: set ir.rule for self wizard only add rule from model introduced in payment to add salesman group sale_crm: saleman can create a quotation from a lead sale_coupon: any saleman can generate coupon add self ir.rule sale_product_configurator: salesman can select product variants snailmail: employee can send letters website: designers can write on website website_crm_partner_assign: same rule as group on action website_sale: sale ACL as for payment.acquirer.onboarding.wizard website_slides: anyone can send invitation base: base.language.*: allow employee (cf lang_install) change.password.user: can not read change password wizard of other users test.*: no access is needed Courtesy of Damien Bouvy, William Andre and Antoine Prieëls for review of acl
2020-01-14[FIX] models.py: Fix check_company mechanismYannick Tivisse
Purpose ======= If check company is set on a field and if the user has no access right to the field value (example: address_id on an expense sheet could be set to a private res.partner, on an onchange method when setting the employee), then the check_company mechanism will raise an AccessError when trying the validate the companies on the different records. Specification ============= As we only wish to validate the new record values and not the access rights, the validation could be done as a superuser to avoid unecessary errors. closes odoo/odoo#43240 Taskid: 2170006 X-original-commit: 37a9b6c63dcbc268013fbe1a890cf9390eb8e223 Signed-off-by: Yannick Tivisse (yti) <yti@odoo.com>
2019-11-14[FIX] fields: check if the inverse must changeJorge Pinna Puissant
Before this commit, when modifying a Many2one in a form view to add a new record, it will create the new record, and calculate the inverse and write it in all the records of the list. This will call the write method in all records even if they weren't changed. Now, the inverse is set to be modified only if it's different from the current value. opw-2091842 closes odoo/odoo#40258 X-original-commit: 417cee7f0fdb7ed7eb424178efb656b967fa0a5e Signed-off-by: Jorge Pinna Puissant (jpp) <jpp@odoo.com> Co-authored-by: Raphaël Collet <rco@odoo.com>
2019-11-05[IMP] base/test_*: Adapt tests to work with/without demo dataYannick Tivisse