From ccc3bc066e4b57c96cdd61fa28187dbc10cfa6c1 Mon Sep 17 00:00:00 2001 From: Adrien Widart Date: Tue, 22 Dec 2020 14:06:06 +0000 Subject: [FIX] account: read invoice of archived partner If a user has the portal access, when going to his documents, if one of them belongs to an archived partner, it will raise a 403 error. To reproduce the error: 1. Go to Settings > Invoicing > Customer Payments 2. Enable "Invoice Online Payment" 3. Create a customer C - Set a name - In Contacts & Addresses, add two contacts C_01 and C_02 - Both are "Invoice Address" - Add a valid email for C_01 4. Go to Customers > C_01, Action, Grand portal acess - Check "In Portal", Apply 5. Go to Settings > Users & Companies > Users 6. Remove the search filter, Select C_01, Add a password 7. Create an invoice INV - Customer: C_02 8. Connect to C_01's account 9. Click on "Invoices & Bills" - The invoice INV is listed 10. Connect to admin's account 11. Go to Customers, Archive C_02 12. Repeat steps 8-9 => A 403-Forbidden page is displayed with a traceback. For a user to have access to the "Invoices & Bills", one of the followers of each invoice must be part of the same commercial partner: `('message_partner_ids','child_of',[user.commercial_partner_id.id])`. Here is the issue: if archived, the partner will not be in the `message_partner_ids` list. This is the reason why, in our case, C_01 can no longer access the documents. This commit allows the archived partners to be listed when getting the portal transactions. OPW-2417275 closes odoo/odoo#63788 X-original-commit: ad36feae0a1ee6fe0bdfbb622685a6b143ea4f2a Signed-off-by: Adrien Widart --- addons/payment/models/account_invoice.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'addons/payment') diff --git a/addons/payment/models/account_invoice.py b/addons/payment/models/account_invoice.py index 5fbd21c55be..89fdcfd4ce5 100644 --- a/addons/payment/models/account_invoice.py +++ b/addons/payment/models/account_invoice.py @@ -20,7 +20,7 @@ class AccountMove(models.Model): def get_portal_last_transaction(self): self.ensure_one() - return self.transaction_ids.get_last_transaction() + return self.with_context(active_test=False).transaction_ids.get_last_transaction() def _create_payment_transaction(self, vals): '''Similar to self.env['payment.transaction'].create(vals) but the values are filled with the -- cgit v1.2.3