From 1285726ff9ca237fd5abd7f3a04ef9b069c222c7 Mon Sep 17 00:00:00 2001 From: William Braeckman Date: Thu, 19 Aug 2021 10:32:38 +0000 Subject: [PATCH] [FIX] project_timesheet_holidays: prevent multi-company issue in time off. When validating a time off with a company-less time off type, if the time off type is configured to create timesheet entries in a project, a multi-company security rule could be triggered by accessing the project. We now check that the company of the task is valid in the current context (it would make no sense to have an employee work on a task from another company anyway) before creating the timesheets. Closes odoo/odoo#75308 Task ID: 2628148 closes odoo/odoo#75579 X-original-commit: 29662626f7d67480926fbb12986ca644d213151c Signed-off-by: Yannick Tivisse (yti) Signed-off-by: William Braeckman (wbr) --- addons/project_timesheet_holidays/models/hr_holidays.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/addons/project_timesheet_holidays/models/hr_holidays.py b/addons/project_timesheet_holidays/models/hr_holidays.py index a1f8878a3ad..ef37e44d871 100644 --- a/addons/project_timesheet_holidays/models/hr_holidays.py +++ b/addons/project_timesheet_holidays/models/hr_holidays.py @@ -66,7 +66,8 @@ class Holidays(models.Model): for holiday in self.filtered( lambda request: request.holiday_type == 'employee' and request.holiday_status_id.timesheet_project_id and - request.holiday_status_id.timesheet_task_id): + request.holiday_status_id.timesheet_task_id and + request.holiday_status_id.timesheet_project_id.sudo().company_id == (request.holiday_status_id.company_id or self.env.company)): holiday._timesheet_create_lines() return super(Holidays, self)._validate_leave_request()