pengyuthon/odoo_source
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[FIX] account_edi: avoid data from other companies in the invoice

Browse Source 
When creating a bill from a bill mail alias, we can end up with a tax or a product from another company
inside the bill. This can cause access issues afterward.

Here is a use case:
- Setup with 2 companies -> A and B
- Both companies have a 21% tax for purchase but the tax from company A has a lower sequence number
- Create an invoice in company A with a 21% tax and print the PDF
- Send the PDF by mail to company B
- The bill generated from facturx will have the purchase tax from company A
=> access error when it's opened

We use 'with_company' function with 'self.env.company' to imply a company to search into but this lead to
two issues when the generation comes from a mail alias.

1. 'self.env.company' may not be the company of the invoice
2. 'self.env.su' is set to True -> company constraints from the environment are not applied

This commit aims to change those two problems.

opw-2752673

closes odoo/odoo#96026

X-original-commit: b706eb6333913fb6c39cfa941f00c4bf499dfa3d
Signed-off-by: Josse Colpaert <jco@odoo.com>
Signed-off-by: Beckers Thomas (tbs) <tbs@odoo.com>
This commit is contained in:
Thomas Beckers
2022-07-15 12:24:44 +02:00
parent c2293ca70c
commit 23f15a07bb
1 changed files with 8 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
addons/account_edi/models/account_edi_format.py
+8 -4
View File
@@ -438,9 +438,9 @@ class AccountEdiFormat(models.Model):
res = False
try:
if file_data['type'] == 'xml':
res = edi_format.with_company(self.env.company)._update_invoice_from_xml_tree(file_data['filename'], file_data['xml_tree'], invoice)
res = edi_format.with_company(invoice.company_id)._update_invoice_from_xml_tree(file_data['filename'], file_data['xml_tree'], invoice)
elif file_data['type'] == 'pdf':
res = edi_format.with_company(self.env.company)._update_invoice_from_pdf_reader(file_data['filename'], file_data['pdf_reader'], invoice)
res = edi_format.with_company(invoice.company_id)._update_invoice_from_pdf_reader(file_data['filename'], file_data['pdf_reader'], invoice)
file_data['pdf_reader'].stream.close()
else: # file_data['type'] == 'binary'
res = edi_format._update_invoice_from_binary(file_data['filename'], file_data['content'], file_data['extension'], invoice)
@@ -587,7 +587,10 @@ class AccountEdiFormat(models.Model):
if value is not None:
domains.append([domain])
domain = expression.OR(domains)
domain = expression.AND([
expression.OR(domains),
[('company_id', 'in', [False, self.env.company.id])],
])
return self.env['product.product'].search(domain, limit=1)
def _retrieve_tax(self, amount, type_tax_use):
@@ -599,7 +602,8 @@ class AccountEdiFormat(models.Model):
'''
domains = [
[('amount', '=', float(amount))],
[('type_tax_use', '=', type_tax_use)]
[('type_tax_use', '=', type_tax_use)],
[('company_id', '=', self.env.company.id)]
]
return self.env['account.tax'].search(expression.AND(domains), order='sequence ASC', limit=1)