From 21e3b1c5dba2d1fd59cc2c6fe44fbee68d1e6ddc Mon Sep 17 00:00:00 2001 From: Olivier Dony Date: Wed, 23 Nov 2011 14:31:32 +0100 Subject: [PATCH] [IMP] crm,project,hr: fix group_by_full implementation to respect access_right_uid This helps avoid access right issues in restricted contexts, such as embedded web client, or shared access (via portal or share wizard). bzr revid: odo@openerp.com-20111123133132-22g2mqzupuysbyqq --- addons/crm/crm_lead.py | 8 +++++--- addons/hr_recruitment/hr_recruitment.py | 8 +++++--- addons/project/project.py | 16 +++++++++------- 3 files changed, 19 insertions(+), 13 deletions(-) diff --git a/addons/crm/crm_lead.py b/addons/crm/crm_lead.py index e72358a79a5..e74ce00d728 100644 --- a/addons/crm/crm_lead.py +++ b/addons/crm/crm_lead.py @@ -42,14 +42,16 @@ class crm_lead(crm_case, osv.osv): _order = "priority,date_action,id desc" _inherit = ['mail.thread','res.partner.address'] - def _read_group_stage_ids(self, cr, uid, ids, domain, read_group_order=None, context=None): + def _read_group_stage_ids(self, cr, uid, ids, domain, read_group_order=None, access_rights_uid=None, context=None): + access_rights_uid = access_rights_uid or uid stage_obj = self.pool.get('crm.case.stage') order = stage_obj._order if read_group_order == 'stage_id desc': # lame hack to allow reverting search, should just work in the trivial case order = "%s desc" % order - stage_ids = stage_obj.search(cr, uid, ['|', ('id','in',ids),('case_default','=',1)], order=order, context=context) - result = stage_obj.name_get(cr, uid, stage_ids, context=context) + stage_ids = stage_obj._search(cr, uid, ['|', ('id','in',ids),('case_default','=',1)], order=order, + access_rights_uid=access_rights_uid, context=context) + result = stage_obj.name_get(cr, access_rights_uid, stage_ids, context=context) # restore order of the search result.sort(lambda x,y: cmp(stage_ids.index(x[0]), stage_ids.index(y[0]))) return result diff --git a/addons/hr_recruitment/hr_recruitment.py b/addons/hr_recruitment/hr_recruitment.py index d9438e9beee..8acb95e7088 100644 --- a/addons/hr_recruitment/hr_recruitment.py +++ b/addons/hr_recruitment/hr_recruitment.py @@ -197,14 +197,16 @@ class hr_applicant(crm.crm_case, osv.osv): 'color': 0, } - def _read_group_stage_ids(self, cr, uid, ids, domain, read_group_order=None, context=None): + def _read_group_stage_ids(self, cr, uid, ids, domain, read_group_order=None, access_rights_uid=None, context=None): + access_rights_uid = access_rights_uid or uid stage_obj = self.pool.get('hr.recruitment.stage') order = stage_obj._order if read_group_order == 'stage_id desc': # lame hack to allow reverting search, should just work in the trivial case order = "%s desc" % order - stage_ids = stage_obj.search(cr, uid, ['|',('id','in',ids),('department_id','=',False)], order=order, context=context) - result = stage_obj.name_get(cr, uid, stage_ids, context=context) + stage_ids = stage_obj._search(cr, uid, ['|',('id','in',ids),('department_id','=',False)], order=order, + access_rights_uid=access_rights_uid, context=context) + result = stage_obj.name_get(cr, access_rights_uid, stage_ids, context=context) # restore order of the search result.sort(lambda x,y: cmp(stage_ids.index(x[0]), stage_ids.index(y[0]))) return result diff --git a/addons/project/project.py b/addons/project/project.py index 589d3ebde97..abebd2d35ff 100644 --- a/addons/project/project.py +++ b/addons/project/project.py @@ -439,10 +439,11 @@ class task(osv.osv): if len(project_ids) == 1: return project_ids[0][0] - def _read_group_type_id(self, cr, uid, ids, domain, read_group_order=None, context=None): + def _read_group_type_id(self, cr, uid, ids, domain, read_group_order=None, access_rights_uid=None, context=None): stage_obj = self.pool.get('project.task.type') project_id = self._resolve_project_id_from_context(cr, uid, context=context) order = stage_obj._order + access_rights_uid = access_rights_uid or uid if read_group_order == 'type_id desc': # lame way to allow reverting search, should just work in the trivial case order = '%s desc' % order @@ -450,24 +451,25 @@ class task(osv.osv): domain = ['|', ('id','in',ids), ('project_ids','in',project_id)] else: domain = ['|', ('id','in',ids), ('project_default','=',1)] - stage_ids = stage_obj.search(cr, uid, domain, order=order, context=context) - result = stage_obj.name_get(cr, uid, stage_ids, context=context) + stage_ids = stage_obj._search(cr, uid, domain, order=order, access_rights_uid=access_rights_uid, context=context) + result = stage_obj.name_get(cr, access_rights_uid, stage_ids, context=context) # restore order of the search result.sort(lambda x,y: cmp(stage_ids.index(x[0]), stage_ids.index(y[0]))) return result - def _read_group_user_id(self, cr, uid, ids, domain, read_group_order=None, context=None): + def _read_group_user_id(self, cr, uid, ids, domain, read_group_order=None, access_rights_uid=None, context=None): res_users = self.pool.get('res.users') project_id = self._resolve_project_id_from_context(cr, uid, context=context) + access_rights_uid = access_rights_uid or uid if project_id: - ids += self.pool.get('project.project').read(cr, uid, project_id, ['members'], context=context)['members'] + ids += self.pool.get('project.project').read(cr, access_rights_uid, project_id, ['members'], context=context)['members'] order = res_users._order # lame way to allow reverting search, should just work in the trivial case if read_group_order == 'user_id desc': order = '%s desc' % order # de-duplicate and apply search order - ids = res_users.search(cr, uid, [('id','in',ids)], order=order, context=context) - result = res_users.name_get(cr, uid, ids, context=context) + ids = res_users._search(cr, uid, [('id','in',ids)], order=order, access_rights_uid=access_rights_uid, context=context) + result = res_users.name_get(cr, access_rights_uid, ids, context=context) # restore order of the search result.sort(lambda x,y: cmp(ids.index(x[0]), ids.index(y[0]))) return result