From 15215d650a06967f0bd3e8f8965b6ee19fc2db32 Mon Sep 17 00:00:00 2001 From: Raphael Collet Date: Mon, 28 Feb 2022 14:27:24 +0000 Subject: [PATCH] [FIX] core: check rules before flush() in unlink() Just before deleting records, we mark fields on dependent records as "to compute", and their actual computation should happen after the records have been deleted. The problem is that checking security rules may trigger the computations that have been prepared. So we should check security rules before marking dependent records. closes odoo/odoo#85574 X-original-commit: 79908bc757a239c97bd2b4cda505b7b8df769325 Signed-off-by: Raphael Collet --- .../test_new_api/tests/test_new_fields.py | 18 ++++++++++++++++++ odoo/models.py | 3 +-- 2 files changed, 19 insertions(+), 2 deletions(-) diff --git a/odoo/addons/test_new_api/tests/test_new_fields.py b/odoo/addons/test_new_api/tests/test_new_fields.py index b26f66d9a51..d7176e350d9 100644 --- a/odoo/addons/test_new_api/tests/test_new_fields.py +++ b/odoo/addons/test_new_api/tests/test_new_fields.py @@ -2536,6 +2536,24 @@ class TestFields(TransactionCaseWithUserDemo): self.assertFalse(Model.rare_description.prefetch) self.assertFalse(Model.rare_html_description.prefetch) + def test_98_unlink_recompute(self): + move = self.env['test_new_api.move'].create({ + 'line_ids': [(0, 0, {'quantity': 42})], + }) + line = move.line_ids + self.assertEqual(move.quantity, 42) + + # create an ir.rule for lines that uses move.quantity + self.env['ir.rule'].create({ + 'model_id': self.env['ir.model']._get(line._name).id, + 'domain_force': "[('move_id.quantity', '>=', 0)]", + }) + + # unlink the line, and check the recomputation of move.quantity + user = self.env.ref('base.user_demo') + line.with_user(user).unlink() + self.assertEqual(move.quantity, 0) + class TestX2many(common.TransactionCase): def test_definition_many2many(self): diff --git a/odoo/models.py b/odoo/models.py index 8b4196b960d..221fecc9913 100644 --- a/odoo/models.py +++ b/odoo/models.py @@ -3635,6 +3635,7 @@ Fields: return True self.check_access_rights('unlink') + self.check_access_rule('unlink') self._check_concurrency() from odoo.addons.base.models.ir_model import MODULE_UNINSTALL_FLAG @@ -3649,8 +3650,6 @@ Fields: self.modified(self._fields, before=True) with self.env.norecompute(): - self.check_access_rule('unlink') - cr = self._cr Data = self.env['ir.model.data'].sudo().with_context({}) Defaults = self.env['ir.default'].sudo()