From 20f3290eab2bb8044fcddc4111f7206e57f05c24 Mon Sep 17 00:00:00 2001
From: jem-odoo <jem@openerp.com>
Date: Tue, 21 May 2019 07:00:48 +0000
Subject: [PATCH] [FIX] sale_timesheet: billable task access error for project
 user

When a project user (without any sales acces rights) want to create a task in
a billable project (linked to a sales order / sales order line), he will face
some access right issues :
1/ the system want to set the default customer on the task, by taking the one
from the sale order line linked to the project in which the task is created. This
raises an error as the task creator has no right to read the project'sale line.
2/ after that, the "sales order" field is computed on the task. This raises the
same error as we need acces through sale line to determine the sales order of the
task.

This commit fixes thoses problem by adding a `sudo` and by adding the "sales order"
field only for sales person.

opw-1999673
---
 addons/sale_timesheet/models/project.py       |  6 ++---
 .../views/project_task_views.xml              | 23 +++++++++++++------
 2 files changed, 19 insertions(+), 10 deletions(-)

diff --git a/addons/sale_timesheet/models/project.py b/addons/sale_timesheet/models/project.py
index 38a9111f74c..4c12a88d3bf 100644
--- a/addons/sale_timesheet/models/project.py
+++ b/addons/sale_timesheet/models/project.py
@@ -124,8 +124,8 @@ class ProjectTask(models.Model):
     def _get_default_partner(self):
         partner = False
         if 'default_project_id' in self.env.context:  # partner from SO line is prior on one from project
-            project = self.env['project.project'].browse(self.env.context['default_project_id'])
-            partner = project.sale_line_id.order_partner_id
+            project_sudo = self.env['project.project'].browse(self.env.context['default_project_id']).sudo()
+            partner = project_sudo.sale_line_id.order_partner_id
         if not partner:
             partner = super(ProjectTask, self)._get_default_partner()
         return partner
@@ -205,7 +205,7 @@ class ProjectTask(models.Model):
     @api.multi
     @api.constrains('sale_line_id')
     def _check_sale_line_type(self):
-        for task in self:
+        for task in self.sudo():
             if task.sale_line_id:
                 if not task.sale_line_id.is_service or task.sale_line_id.is_expense:
                     raise ValidationError(_('You cannot link the order item %s - %s to this task because it is a re-invoiced expense.' % (task.sale_line_id.order_id.id, task.sale_line_id.product_id.name)))
diff --git a/addons/sale_timesheet/views/project_task_views.xml b/addons/sale_timesheet/views/project_task_views.xml
index 34ca4eb5a8c..af077f03b1e 100644
--- a/addons/sale_timesheet/views/project_task_views.xml
+++ b/addons/sale_timesheet/views/project_task_views.xml
@@ -61,13 +61,6 @@
             <field name="groups_id" eval="[(4, ref('base.group_user'))]"/>
             <field name="inherit_id" ref="project.view_task_form2"/>
             <field name="arch" type="xml">
-                <xpath expr="//button[@name='toggle_active']" position="before">
-                    <button type="object" name="action_view_so"
-                            class="oe_stat_button" icon="fa-dollar"
-                            attrs="{'invisible': [('sale_order_id', '=', False)]}"
-                            string="Sales Order"/>
-                    <field name="sale_order_id" invisible="1"/>
-                </xpath>
                 <field name="user_id" position="after">
                     <field name="sale_line_id" string="Sales Order Item" attrs="{'invisible': ['|', ('partner_id', '=', False)]}" options='{"no_create": True}' context="{'create': False, 'edit': False, 'delete': False}"/>
                     <field name="billable_type" invisible="1"/>
@@ -75,6 +68,22 @@
             </field>
         </record>
 
+    <record id="project_task_view_form_sale_order" model="ir.ui.view">
+        <field name="name">project.task.form.inherit.sale.order</field>
+        <field name="model">project.task</field>
+        <field name="inherit_id" ref="project.view_task_form2"/>
+        <field name="arch" type="xml">
+            <xpath expr="//button[@name='toggle_active']" position="before">
+                <button type="object" name="action_view_so"
+                        class="oe_stat_button" icon="fa-dollar"
+                        attrs="{'invisible': [('sale_order_id', '=', False)]}"
+                        string="Sales Order"/>
+                <field name="sale_order_id" invisible="1"/>
+            </xpath>
+        </field>
+        <field name="groups_id" eval="[(4, ref('sales_team.group_sale_salesman'))]"/>
+    </record>
+
     <record id="project_task_view_search" model="ir.ui.view">
         <field name="name">project.task.search.inherit</field>
         <field name="model">project.task</field>