From 99fb65fa58a46ee7dcf6e91d617930005cccd154 Mon Sep 17 00:00:00 2001 From: Nicolas Martinelli Date: Tue, 6 Oct 2020 08:18:38 +0000 Subject: [FIX] web: report controller in multi-company - Create 2 companies A & B - Set a website on company A - Switch to company B - Open a done MO - Open the cost analysis An AccessError is displayed. The error arises in: https://github.com/odoo/enterprise/blob/923cbffe4e60572a5c17ee962d571c037e9cff44/mrp_account_enterprise/reports/mrp_cost_structure.py#L90 The root cause is coming from the call to `/report/html/`, which is called without any `data`. In this situation, the following adds an incorrect `allowed_company_ids` in the context: https://github.com/odoo/odoo/blob/d1413a2f06bcb44b1fbb6dba8658e698c8da4018/addons/website/models/ir_http.py#L196-L205 Indeed, the `allowed_company_ids` is the one from the website, in this case company A. The issue doesn't occur when downloading a PDF from the interface since in this case the `data` dictionary contains the appropriate context which is set in: https://github.com/odoo/odoo/blob/d1413a2f06bcb44b1fbb6dba8658e698c8da4018/addons/web/controllers/main.py#L1958 As a solution, we add the `user_context` in the `/report/html` route. opw-2341747 closes odoo/odoo#59654 X-original-commit: 932e347a90bfd4bf025e4e8e54ef9c66cc49c5d0 Signed-off-by: Nicolas Martinelli (nim) --- .../static/src/js/chrome/action_manager_report.js | 1 + .../static/tests/chrome/action_manager_tests.js | 71 ++++++++++++++++++++-- 2 files changed, 68 insertions(+), 4 deletions(-) diff --git a/addons/web/static/src/js/chrome/action_manager_report.js b/addons/web/static/src/js/chrome/action_manager_report.js index 61dbdbbcc96..b3c057969bd 100644 --- a/addons/web/static/src/js/chrome/action_manager_report.js +++ b/addons/web/static/src/js/chrome/action_manager_report.js @@ -189,6 +189,7 @@ ActionManager.include({ return value += activeIDsPath; }); } + reportUrls.html += '?context=' + encodeURIComponent(JSON.stringify(session.user_context)); } else { var serializedOptionsPath = '?options=' + encodeURIComponent(JSON.stringify(action.data)); serializedOptionsPath += '&context=' + encodeURIComponent(JSON.stringify(action.context)); diff --git a/addons/web/static/tests/chrome/action_manager_tests.js b/addons/web/static/tests/chrome/action_manager_tests.js index d2c1e45e791..3bc111ac1ba 100644 --- a/addons/web/static/tests/chrome/action_manager_tests.js +++ b/addons/web/static/tests/chrome/action_manager_tests.js @@ -113,6 +113,12 @@ QUnit.module('ActionManager', { report_type: 'qweb-pdf', type: 'ir.actions.report', close_on_report_download: true, + }, { + id: 12, + name: "Some HTML Report", + report_name: 'some_report', + report_type: 'qweb-html', + type: 'ir.actions.report', }]; this.archs = { @@ -2262,7 +2268,7 @@ QUnit.module('ActionManager', { if (route === '/report/check_wkhtmltopdf') { return Promise.resolve('broken'); } - if (route === '/report/html/some_report') { + if (route.includes('/report/html/some_report')) { return Promise.resolve(); } return this._super.apply(this, arguments); @@ -2284,7 +2290,64 @@ QUnit.module('ActionManager', { '/web/action/load', '/report/check_wkhtmltopdf', 'warning', - '/report/html/some_report', // report client action's iframe + '/report/html/some_report?context=%7B%7D', // report client action's iframe + ]); + + actionManager.destroy(); + testUtils.mock.unpatch(ReportClientAction); + }); + + QUnit.test('send context in case of html report', async function (assert) { + assert.expect(4); + + // patch the report client action to override its iframe's url so that + // it doesn't trigger an RPC when it is appended to the DOM (for this + // usecase, using removeSRCAttribute doesn't work as the RPC is + // triggered as soon as the iframe is in the DOM, even if its src + // attribute is removed right after) + testUtils.mock.patch(ReportClientAction, { + start: function () { + var self = this; + return this._super.apply(this, arguments).then(function () { + self._rpc({route: self.iframe.getAttribute('src')}); + self.iframe.setAttribute('src', 'about:blank'); + }); + } + }); + + var actionManager = await createActionManager({ + actions: this.actions, + archs: this.archs, + data: this.data, + services: { + report: ReportService, + notification: NotificationService.extend({ + notify: function (params) { + assert.step(params.type || 'notification'); + } + }) + }, + mockRPC: function (route, args) { + assert.step(args.method || route); + if (route.includes('/report/html/some_report')) { + return Promise.resolve(); + } + return this._super.apply(this, arguments); + }, + session: { + user_context: { + some_key: 2, + } + }, + }); + await actionManager.doAction(12); + + assert.containsOnce(actionManager, '.o_report_iframe', + "should have opened the report client action"); + + assert.verifySteps([ + '/web/action/load', + '/report/html/some_report?context=%7B%22some_key%22%3A2%7D', // report client action's iframe ]); actionManager.destroy(); @@ -3492,7 +3555,7 @@ QUnit.module('ActionManager', { this.archs['partner,1,list'] = ''; this.actions.push({ - id: 12, + id: 100, name: 'Partners', res_model: 'partner', type: 'ir.actions.act_window', @@ -3512,7 +3575,7 @@ QUnit.module('ActionManager', { domain: '[("bar", "=", 1)]' }], }); - await actionManager.doAction(12); + await actionManager.doAction(100); assert.strictEqual(actionManager.$('.o_list_view tr.o_data_row .o_data_cell').text(), 'zoupyopplopgnapblip', 'record should be in descending order as default_order applies'); -- cgit v1.2.3