From dc3fbb17fa8c80509d002903c5debc7e1cd7a277 Mon Sep 17 00:00:00 2001
From: Ravi Gadhia <rga@openerp.com>
Date: Thu, 29 May 2014 16:18:53 +0530
Subject: [IMP] ir_ui_view, view_form: add information about the user being
 able to create and write on many2one and many2many records in a form view.

Indeed before this commit users had always the possibility to create or edit records
leading to a crash if no access rights were granted. Now the option is
not displayed if the user has no rights to do it.

Tests have been added for this feature.
---
 addons/web/static/src/js/view_form.js | 21 ++++++++++++---------
 1 file changed, 12 insertions(+), 9 deletions(-)

(limited to 'addons/web/static/src/js/view_form.js')

diff --git a/addons/web/static/src/js/view_form.js b/addons/web/static/src/js/view_form.js
index 7284553a422..bdd1ecb6225 100644
--- a/addons/web/static/src/js/view_form.js
+++ b/addons/web/static/src/js/view_form.js
@@ -3336,6 +3336,8 @@ instance.web.form.CompletionFieldMixin = {
     init: function() {
         this.limit = 7;
         this.orderer = new instance.web.DropMisordered();
+        this.can_create = this.node.attrs.can_create || true;
+        this.can_write = this.node.attrs.can_write || true;
     },
     /**
      * Call this method to search using a string.
@@ -3382,7 +3384,7 @@ instance.web.form.CompletionFieldMixin = {
             var raw_result = _(data.result).map(function(x) {return x[1];});
             if (search_val.length > 0 && !_.include(raw_result, search_val) &&
                 ! (self.options && (self.options.no_create || self.options.no_quick_create))) {
-                values.push({
+                self.can_create && values.push({
                     label: _.str.sprintf(_t('Create "<strong>%s</strong>"'),
                         $('<span />').text(search_val).html()),
                     action: function() {
@@ -3392,7 +3394,7 @@ instance.web.form.CompletionFieldMixin = {
                 });
             }
             // create...
-            if (!(self.options && (self.options.no_create || self.options.no_create_edit))){
+            if (!(self.options && (self.options.no_create || self.options.no_create_edit)) && self.can_create){
                 values.push({
                     label: _t("Create and Edit..."),
                     action: function() {
@@ -3402,11 +3404,11 @@ instance.web.form.CompletionFieldMixin = {
                 });
             }
             else if (values.length == 0)
-            	values.push({
-            		label: _t("No results to show..."),
-            		action: function() {},
-            		classname: 'oe_m2o_dropdown_option'
-            	});
+                values.push({
+                    label: _t("No results to show..."),
+                    action: function() {},
+                    classname: 'oe_m2o_dropdown_option'
+                });
 
             return values;
         });
@@ -3600,7 +3602,8 @@ instance.web.form.FieldMany2One = instance.web.form.AbstractField.extend(instanc
                     self.build_context(),
                     {
                         title: _t("Open: ") + self.string,
-                        view_id: view_id
+                        view_id: view_id,
+                        readonly: !self.can_write
                     }
                 );
                 pop.on('write_completed', self, function(){
@@ -3677,7 +3680,7 @@ instance.web.form.FieldMany2One = instance.web.form.AbstractField.extend(instanc
                 self.uned_def.reject();
                 self.ed_def = $.Deferred();
                 self.ed_def.done(function() {
-                    self.show_error_displayer();
+                    self.can_create && self.show_error_displayer();
                     ignore_blur = false;
                     self.trigger('focused');
                 });
-- 
cgit v1.2.3