From 1fc0b08e146d3c256b05780fa71f26bd1c57fd3f Mon Sep 17 00:00:00 2001 From: Nicolas Martinelli Date: Fri, 29 Mar 2019 10:46:59 +0000 Subject: [PATCH] [FIX] account: partners not shared - Activate multi-company, but do not share contact book. - Create 2 companies A & B - Create a partner named 'PartnerA' in company A - Switch to company B - Import a bank statement with partner name set as 'PartnerA' (use the bank statement template if necessary) - Reconcile the entries An `AccessError` is raised. The partner suggestion doesn't take into account the record rules, therefore it might happen that the user doesn't have access to it. opw-1958711 closes odoo/odoo#32239 Signed-off-by: Nicolas Martinelli (nim) --- addons/account/models/reconciliation_widget.py | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/addons/account/models/reconciliation_widget.py b/addons/account/models/reconciliation_widget.py index 564ac75bda3..0c5f8a108b3 100644 --- a/addons/account/models/reconciliation_widget.py +++ b/addons/account/models/reconciliation_widget.py @@ -91,6 +91,17 @@ class AccountReconciliation(models.AbstractModel): WHERE st_line.id IN %s ''' params = [tuple(st_lines.ids)] + + # Add the res.partner's IR rules to the WHERE clause. In case partners are not shared + # between companies, identical partners may exist in a company we don't have access to. + ir_rules_query = self.env['res.partner']._where_calc([]) + self.env['res.partner']._apply_ir_rules(ir_rules_query, 'read') + from_clause, where_clause, where_clause_params = ir_rules_query.get_sql() + where_p3 = (" AND %s" % where_clause).replace('res_partner', 'p3') if where_clause else '' + if where_p3: + query += where_p3 + params += where_clause_params + self._cr.execute(query, params) result = {}