pengyuthon/odoo_source
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[FIX] web: prevent access error in calendar

Browse Source 
Prior to this commit:

- If the color attribute is set on a field on which the user might
  not have access to the model / record, a traceback is returned. However,
  in the case of a M2O, the name_get would be returned, so its is
  a pity that the color raise an access error.

After this commit:

- A search_read is made instead of a read, which returns nothing if
  the user does not have access to the model / record and does not raise
  a traceback.

closes odoo/odoo#91147

X-original-commit: 3e8744418d629a62e9eacd16dfa4721921e02453
Related: odoo/enterprise#27318
Signed-off-by: Géry Debongnie <ged@odoo.com>
Signed-off-by: Laurent Stukkens (ltu) <ltu@odoo.com>
This commit is contained in:
Laurent Stukkens (LTU)
2022-05-16 10:09:28 +02:00
parent 42a637202b
commit 1a8389858a
2 changed files with 18 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
addons/web/static/src/legacy/js/views/calendar/calendar_model.js
+2 -2
View File
@@ -707,8 +707,8 @@ return AbstractModel.extend({
if (ids.length) {
defs.push(self._rpc({
model: filter.color_model,
method: 'read',
args: [_.uniq(ids), [filter.field_color]],
method: 'search_read',
args: [[['id', 'in', _.uniq(ids)]], [filter.field_color]],
})
.then(function (res) {
_.each(res, function (c) {
addons/web/static/tests/legacy/views/calendar_tests.js
+16 -3
View File
@@ -2244,11 +2244,16 @@ QUnit.module('Views', {
});
QUnit.test('Add filters and specific color', async function (assert) {
assert.expect(6);
assert.expect(10);
this.data.event_type.records.push(
{id: 4, display_name: "Event Type no color", color: 0},
);
this.data.event.records.push(
{id: 8, user_id: 4, partner_id: 1, name: "event 8", start: "2016-12-11 09:00:00", stop: "2016-12-11 10:00:00", allday: false, partner_ids: [1,2,3], event_type_id: 3, color: 4},
{id: 9, user_id: 4, partner_id: 1, name: "event 9", start: "2016-12-11 19:00:00", stop: "2016-12-11 20:00:00", allday: false, partner_ids: [1,2,3], event_type_id: 1, color: 1},
{id: 10, user_id: 4, partner_id: 1, name: "event 10", start: "2016-12-11 12:00:00", stop: "2016-12-11 13:00:00", allday: false, partner_ids: [1,2,3], event_type_id: 4, color: 0},
);
var calendar = await createCalendarView({
@@ -2269,6 +2274,13 @@ QUnit.module('Views', {
viewOptions: {
initialDate: initialDate,
},
mockRPC: function (route, args) {
var result = this._super(route, args);
if (args.method === "search_read" && args.model === "event_type" && args.args[1][0] === "color") {
assert.step('color_search_read');
}
return result;
},
});
// By default no filter is selected. We check before continuing.
await testUtils.dom.click(calendar.$('.o_calendar_filter_item[data-value=1] input'));
@@ -2279,12 +2291,13 @@ QUnit.module('Views', {
var $typeFilter = calendar.$('.o_calendar_filter:has(span:contains(Event Type))');
assert.ok($typeFilter.length, "should display 'Event Type' filter");
assert.containsOnce($typeFilter, '#o_cw_filter_collapse_EventType', "Id should be equals to o_cw_filter_collapse_EventType for 'Event Type'");
assert.containsN($typeFilter, '.o_calendar_filter_item', 3, "should display 3 filter items for 'Event Type'");
assert.containsN($typeFilter, '.o_calendar_filter_item', 4, "should display 4 filter items for 'Event Type'");
assert.containsOnce($typeFilter, '.o_calendar_filter_item[data-value=3].o_cw_filter_color_4', "Filter for event type 3 must have the color 4");
assert.containsOnce(calendar, '.fc-event[data-event-id=8].o_calendar_color_4', "Event of event type 3 must have the color 4");
assert.containsOnce(calendar, '.fc-event[data-event-id=10].o_calendar_color_1', "The first color is used when none is provided (default int field value being 0)")
assert.verifySteps(['color_search_read', 'color_search_read'], "The color attribute on a field should trigger a search_read")
calendar.destroy();
});