From 1160d80da489e5f26774478dc03b166d7ce3f25c Mon Sep 17 00:00:00 2001 From: "lase@odoo.com" Date: Tue, 26 Mar 2024 16:17:38 +0100 Subject: [PATCH] [FIX] website_sale: hide unpublished product to portal subcontractor Steps to reproduce: - Activate Subcontracting in the settings. - Create a storable product - Create a BOM of type "subcontracting" where the subcontractor is a Portal user (e.g. Joel Willis) for that product. - Log out and connect as your portal user. - Go to the website shop and search your product. Expected behavior: The portal user should only be able to see the published products. Current behavior: The portal user sees unpublished products for which he is subcontractor. Cause of the issue: The commit 99b56ec has introduced a subcontracting portal. In order for portal users to be able to interact with product templates, the following rule was added to the "base.group_portal": https://github.com/odoo/odoo/blame/f0a0d596ab716c96de38a5c0f837da2924338d7b/addons/mrp_subcontracting/security/mrp_subcontracting_security.xml#L120-L131 When you go to the website shop, the records displayed in the shop will be computed here: https://github.com/odoo/odoo/blob/1c321cd1fe0aabd9cd92c13cd1eae604e5817ae0/addons/website_sale/controllers/main.py#L348 https://github.com/odoo/odoo/blob/f0a0d596ab716c96de38a5c0f837da2924338d7b/addons/website/models/mixins.py#L353-L357 However, during this call, the "ir.rule" added for portal users will be added to the SQL query here: https://github.com/odoo/odoo/blob/1c321cd1fe0aabd9cd92c13cd1eae604e5817ae0/odoo/models.py#L4682 As such, products (enven if unpublished) for which the portal user is a subcontractor will be fetched and displayed in the shop. Fix: Since the "ir.rule" can not be changed only for flows involving the `website_sale` application, we propose to make a change similar to commit b1f6171 whose purpose is to hide unpublished products for non internal users: https://github.com/odoo/odoo/blob/1c321cd1fe0aabd9cd92c13cd1eae604e5817ae0/addons/website_sale/models/product_template.py#L105-L108 opw-3768845 closes odoo/odoo#160703 X-original-commit: d57db5b6a7ca4579145723139223cab3d8a7dd24 Signed-off-by: Valentin Chevalier Signed-off-by: Lancelot Semal (lase) --- addons/website_sale/models/website.py | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/addons/website_sale/models/website.py b/addons/website_sale/models/website.py index dd250bad9f1..ceb402d369a 100644 --- a/addons/website_sale/models/website.py +++ b/addons/website_sale/models/website.py @@ -294,7 +294,10 @@ class Website(models.Model): return pricelist def sale_product_domain(self): - return expression.AND([self._product_domain(), self.get_current_website().website_domain()]) + website_domain = self.get_current_website().website_domain() + if not self.env.user._is_internal(): + website_domain = expression.AND([website_domain, [('is_published', '=', True)]]) + return expression.AND([self._product_domain(), website_domain]) def _product_domain(self): return [('sale_ok', '=', True)]