From 1a8389858ac1349faea4d18dbfbbff2b1ce70980 Mon Sep 17 00:00:00 2001
From: "Laurent Stukkens (LTU)" <ltu@odoo.com>
Date: Tue, 10 May 2022 13:08:54 +0000
Subject: [PATCH] [FIX] web: prevent access error in calendar
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Prior to this commit:

- If the color attribute is set on a field on which the user might
  not have access to the model / record, a traceback is returned. However,
  in the case of a M2O, the name_get would be returned, so its is
  a pity that the color raise an access error.

After this commit:

- A search_read is made instead of a read, which returns nothing if
  the user does not have access to the model / record and does not raise
  a traceback.

closes odoo/odoo#91147

X-original-commit: 3e8744418d629a62e9eacd16dfa4721921e02453
Related: odoo/enterprise#27318
Signed-off-by: Géry Debongnie <ged@odoo.com>
Signed-off-by: Laurent Stukkens (ltu) <ltu@odoo.com>
---
 .../js/views/calendar/calendar_model.js       |  4 ++--
 .../tests/legacy/views/calendar_tests.js      | 19 ++++++++++++++++---
 2 files changed, 18 insertions(+), 5 deletions(-)

diff --git a/addons/web/static/src/legacy/js/views/calendar/calendar_model.js b/addons/web/static/src/legacy/js/views/calendar/calendar_model.js
index 8078f2c275b..63877603cb4 100644
--- a/addons/web/static/src/legacy/js/views/calendar/calendar_model.js
+++ b/addons/web/static/src/legacy/js/views/calendar/calendar_model.js
@@ -707,8 +707,8 @@ return AbstractModel.extend({
                 if (ids.length) {
                     defs.push(self._rpc({
                         model: filter.color_model,
-                        method: 'read',
-                        args: [_.uniq(ids), [filter.field_color]],
+                        method: 'search_read',
+                        args: [[['id', 'in', _.uniq(ids)]], [filter.field_color]],
                     })
                     .then(function (res) {
                         _.each(res, function (c) {
diff --git a/addons/web/static/tests/legacy/views/calendar_tests.js b/addons/web/static/tests/legacy/views/calendar_tests.js
index 8775881af10..7520867cd1e 100644
--- a/addons/web/static/tests/legacy/views/calendar_tests.js
+++ b/addons/web/static/tests/legacy/views/calendar_tests.js
@@ -2244,11 +2244,16 @@ QUnit.module('Views', {
     });
 
     QUnit.test('Add filters and specific color', async function (assert) {
-        assert.expect(6);
+        assert.expect(10);
+
+        this.data.event_type.records.push(
+            {id: 4, display_name: "Event Type no color", color: 0},
+        );
 
         this.data.event.records.push(
             {id: 8, user_id: 4, partner_id: 1, name: "event 8", start: "2016-12-11 09:00:00", stop: "2016-12-11 10:00:00", allday: false, partner_ids: [1,2,3], event_type_id: 3, color: 4},
             {id: 9, user_id: 4, partner_id: 1, name: "event 9", start: "2016-12-11 19:00:00", stop: "2016-12-11 20:00:00", allday: false, partner_ids: [1,2,3], event_type_id: 1, color: 1},
+            {id: 10, user_id: 4, partner_id: 1, name: "event 10", start: "2016-12-11 12:00:00", stop: "2016-12-11 13:00:00", allday: false, partner_ids: [1,2,3], event_type_id: 4, color: 0},
         );
 
         var calendar = await createCalendarView({
@@ -2269,6 +2274,13 @@ QUnit.module('Views', {
             viewOptions: {
                 initialDate: initialDate,
             },
+            mockRPC: function (route, args) {
+                var result = this._super(route, args);
+                if (args.method === "search_read" && args.model === "event_type" && args.args[1][0] === "color") {
+                    assert.step('color_search_read');
+                }
+                return result;
+            },
         });
         // By default no filter is selected. We check before continuing.
         await testUtils.dom.click(calendar.$('.o_calendar_filter_item[data-value=1] input'));
@@ -2279,12 +2291,13 @@ QUnit.module('Views', {
         var $typeFilter =  calendar.$('.o_calendar_filter:has(span:contains(Event Type))');
         assert.ok($typeFilter.length, "should display 'Event Type' filter");
         assert.containsOnce($typeFilter, '#o_cw_filter_collapse_EventType', "Id should be equals to o_cw_filter_collapse_EventType for 'Event Type'");
-        assert.containsN($typeFilter, '.o_calendar_filter_item', 3, "should display 3 filter items for 'Event Type'");
+        assert.containsN($typeFilter, '.o_calendar_filter_item', 4, "should display 4 filter items for 'Event Type'");
 
         assert.containsOnce($typeFilter, '.o_calendar_filter_item[data-value=3].o_cw_filter_color_4', "Filter for event type 3 must have the color 4");
 
         assert.containsOnce(calendar, '.fc-event[data-event-id=8].o_calendar_color_4', "Event of event type 3 must have the color 4");
-
+        assert.containsOnce(calendar, '.fc-event[data-event-id=10].o_calendar_color_1', "The first color is used when none is provided (default int field value being 0)")
+        assert.verifySteps(['color_search_read', 'color_search_read'], "The color attribute on a field should trigger a search_read")
         calendar.destroy();
     });