From 1d2559ce64085eb9fbd8422f8d88e18bc3dce344 Mon Sep 17 00:00:00 2001
From: Hiral Bhavsar <hbh@odoo.com>
Date: Fri, 23 Aug 2019 10:23:29 +0000
Subject: [IMP] sale_expense, web: hide 'search more..' from m2o dropdown
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Purpose
========
In expense, we now allow any simple employee (no sales access rights) to
select sales order. Technically, the name_search is done in sudo mode,
to allow simply fetching the name_get of record.

The problem is that the m2o field widget displays the "search more"
option and click on that will open a modal executing a "search_read"
which is causing access error as the user doesn't have read access on
SO.
As we want to restrict the visible information from the SO(only name_get)
to all user, we can't hack the search_read too.

Specification
=============
To prevent user frustration, we need to remove the "search more" option.
Thus, make a private function which one have 'search more..' option
related stuff and create a new widget for sale_expense, override that
function which one is returing values as it is without any modification.

task-2057714

closes odoo/odoo#36152

Signed-off-by: Jérome Maes (jem) <jem@openerp.com>
---
 .../web/static/src/js/fields/relational_fields.js  | 81 +++++++++++++---------
 1 file changed, 47 insertions(+), 34 deletions(-)

(limited to 'addons/web/static/src/js/fields/relational_fields.js')

diff --git a/addons/web/static/src/js/fields/relational_fields.js b/addons/web/static/src/js/fields/relational_fields.js
index 93863c2f619..f4337d0c8f9 100644
--- a/addons/web/static/src/js/fields/relational_fields.js
+++ b/addons/web/static/src/js/fields/relational_fields.js
@@ -401,6 +401,52 @@ var FieldMany2One = AbstractField.extend({
             }
         };
     },
+    /**
+     * @private
+     * @param {Object} values
+     * @param {string} search_val
+     * @param {Object} domain
+     * @param {Object} context
+     * @returns {Object}
+     */
+    _manageSearchMore: function (values, search_val, domain, context) {
+        var self = this;
+        values = values.slice(0, this.limit);
+        values.push({
+            label: _t("Search More..."),
+            action: function () {
+                var prom;
+                if (search_val !== '') {
+                    prom = self._rpc({
+                        model: self.field.relation,
+                        method: 'name_search',
+                        kwargs: {
+                            name: search_val,
+                            args: domain,
+                            operator: "ilike",
+                            limit: self.SEARCH_MORE_LIMIT,
+                            context: context,
+                        },
+                    });
+                }
+                Promise.resolve(prom).then(function (results) {
+                    var dynamicFilters;
+                    if (results) {
+                        var ids = _.map(results, function (x) {
+                            return x[0];
+                        });
+                        dynamicFilters = [{
+                            description: _.str.sprintf(_t('Quick search: %s'), search_val),
+                            domain: [['id', 'in', ids]],
+                        }];
+                    }
+                    self._searchCreatePopup("search", false, {}, dynamicFilters);
+                });
+            },
+            classname: 'o_m2o_dropdown_option',
+        });
+        return values;
+    },
     /**
      * Listens to events 'field_changed' to keep track of the last event that
      * has been trigerred. This allows to detect that all changes have been
@@ -552,40 +598,7 @@ var FieldMany2One = AbstractField.extend({
 
                 // search more... if more results than limit
                 if (values.length > self.limit) {
-                    values = values.slice(0, self.limit);
-                    values.push({
-                        label: _t("Search More..."),
-                        action: function () {
-                            var prom;
-                            if (search_val !== '') {
-                                prom = self._rpc({
-                                    model: self.field.relation,
-                                    method: 'name_search',
-                                    kwargs: {
-                                        name: search_val,
-                                        args: domain,
-                                        operator: "ilike",
-                                        limit: self.SEARCH_MORE_LIMIT,
-                                        context: context,
-                                    },
-                                });
-                            }
-                            Promise.resolve(prom).then(function (results) {
-                                var dynamicFilters;
-                                if (results) {
-                                    var ids = _.map(results, function (x) {
-                                        return x[0];
-                                    });
-                                    dynamicFilters = [{
-                                        description: _.str.sprintf(_t('Quick search: %s'), search_val),
-                                        domain: [['id', 'in', ids]],
-                                    }];
-                                }
-                                self._searchCreatePopup("search", false, {}, dynamicFilters);
-                            });
-                        },
-                        classname: 'o_m2o_dropdown_option',
-                    });
+                    values = self._manageSearchMore(values, search_val, domain, context);
                 }
                 var create_enabled = self.can_create && !self.nodeOptions.no_create;
                 // quick create
-- 
cgit v1.2.3