From 1ecd0b216032ca86ba554b2699566264202bd6d4 Mon Sep 17 00:00:00 2001 From: "lase@odoo.com" Date: Thu, 14 Mar 2024 09:59:26 +0100 Subject: [PATCH] [FIX] project_sms: Allow transition of task to state with SMS template Steps to reproduce: Be sure to have the `sale_sms` module installed. - Connect as Marc Demo. Note: Marc has the administrator access rights in every service application including projects,... - Go to the field service app create a new task and change its state to `planned`. > Access error: you are not allowed to access 'SMS Templates' Expected behavior: Since the newly created user has the rights to modify the state of the task and since he does not try to access the content of any sms.template he should not raise this access error. Cause of the issue: The stage `planned` is associated with an SMS template. As such, when a task is moved to this stage, an sms will be sent using the template. This action is done during the `write` override of the `project_sms` module: https://github.com/odoo/odoo/blob/5f1a3bdcaa63492cf169f6f5f3eb2e2281ad5ab5/addons/project_sms/models/project_task.py#L24-L32 However, this `_send_sms` method will need to 'read' the sms.template to generate the sms: https://github.com/odoo/odoo/blob/e6be732450d9ef662a48ba074e1ca1ad32e35c04/addons/sms/models/mail_thread.py#L191-L192 Since the user does not have the acess rights to 'read' this template because of the `ir_rule_sms_template_so_sale_manager` access rule defined in the `sale_sms` module, the access error will be raised. Fix: Since the `_send_sms` method will only read records in order to generate the sms that will be send, we should bypass access rigths checks during the call of this method. Note: this was already the solution used for portal users. opw-3789197 closes odoo/odoo#163525 X-original-commit: b5b63509a6bc4467cf84cd15ebdf3b4b0601aeb0 Signed-off-by: Lancelot Semal (lase) Signed-off-by: Xavier Bol (xbo) --- addons/project_sms/models/project_task.py | 7 +--- .../project_sms/tests/test_project_sharing.py | 40 +++++++++++++++++++ 2 files changed, 42 insertions(+), 5 deletions(-) diff --git a/addons/project_sms/models/project_task.py b/addons/project_sms/models/project_task.py index a40e69ba4e0..11163e3fdcc 100644 --- a/addons/project_sms/models/project_task.py +++ b/addons/project_sms/models/project_task.py @@ -25,9 +25,6 @@ class ProjectTask(models.Model): res = super().write(vals) if 'stage_id' in vals: - if self.env.user.has_group('base.group_portal') and not self.env.su: - # sudo as sms template model is protected - self.sudo()._send_sms() - else: - self._send_sms() + # sudo as sms template model is protected + self.sudo()._send_sms() return res diff --git a/addons/project_sms/tests/test_project_sharing.py b/addons/project_sms/tests/test_project_sharing.py index c53f125f524..fa0734b6575 100644 --- a/addons/project_sms/tests/test_project_sharing.py +++ b/addons/project_sms/tests/test_project_sharing.py @@ -4,6 +4,7 @@ from odoo import Command from odoo.addons.project.tests.test_project_sharing import TestProjectSharingCommon from odoo.addons.sms.tests.common import SMSCommon +from odoo.tests import tagged class TestProjectSharingWithSms(TestProjectSharingCommon, SMSCommon): @@ -63,3 +64,42 @@ class TestProjectSharingWithSms(TestProjectSharingCommon, SMSCommon): }) self.assertEqual(self.project_portal.stage_id, self.project_stage_with_sms) self.assertSMSIapSent([self.project_portal.partner_id.mobile]) + + +@tagged('post_install', '-at_install') +class TestPostInstallProjectSharingWithSms(TestProjectSharingWithSms): + + def test_project_user_can_change_stage_with_sms_template(self): + """ Test that users with the rights to change the stage of a task can perform this action + when the stage has an sms template. + + The sms template should be sent and the stage should be changed on the task. + """ + project_user_group = self.env.ref('project.group_project_user') + sale_manager_group = self.env.ref('sales_team.group_sale_manager', False) + if not sale_manager_group: + self.skipTest('`sale_sms` not installed') + self.user_projectuser.write({ + 'groups_id': [ + Command.link(project_user_group.id), + Command.link(sale_manager_group.id), + ] + }) + self.assertTrue(self.task_cow.with_user(self.user_projectuser).check_access_rights('write')) + with self.mockSMSGateway(): + self.task_cow.with_user(self.user_projectuser).write({ + 'stage_id': self.task_stage_with_sms.id, + }) + self.assertEqual(self.task_cow.stage_id, self.task_stage_with_sms) + self.assertSMSIapSent([]) # no sms sent since the author is the recipient + + self.task_cow.write({ + 'partner_id': self.user_portal.partner_id.id, + 'stage_id': self.project_cows.type_ids[0].id, + }) + with self.mockSMSGateway(): + self.task_cow.with_user(self.user_projectuser).write({ + 'stage_id': self.task_stage_with_sms.id, + }) + self.assertEqual(self.task_cow.stage_id, self.task_stage_with_sms) + self.assertSMSIapSent([self.user_portal.partner_id.mobile])