From 23f15a07bb1d1f253f267c416f578eb56d804f6c Mon Sep 17 00:00:00 2001 From: Thomas Beckers Date: Wed, 22 Jun 2022 12:22:54 +0000 Subject: [PATCH] [FIX] account_edi: avoid data from other companies in the invoice When creating a bill from a bill mail alias, we can end up with a tax or a product from another company inside the bill. This can cause access issues afterward. Here is a use case: - Setup with 2 companies -> A and B - Both companies have a 21% tax for purchase but the tax from company A has a lower sequence number - Create an invoice in company A with a 21% tax and print the PDF - Send the PDF by mail to company B - The bill generated from facturx will have the purchase tax from company A => access error when it's opened We use 'with_company' function with 'self.env.company' to imply a company to search into but this lead to two issues when the generation comes from a mail alias. 1. 'self.env.company' may not be the company of the invoice 2. 'self.env.su' is set to True -> company constraints from the environment are not applied This commit aims to change those two problems. opw-2752673 closes odoo/odoo#96026 X-original-commit: b706eb6333913fb6c39cfa941f00c4bf499dfa3d Signed-off-by: Josse Colpaert Signed-off-by: Beckers Thomas (tbs) --- addons/account_edi/models/account_edi_format.py | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/addons/account_edi/models/account_edi_format.py b/addons/account_edi/models/account_edi_format.py index 7ca7d8ad915..54526651226 100644 --- a/addons/account_edi/models/account_edi_format.py +++ b/addons/account_edi/models/account_edi_format.py @@ -438,9 +438,9 @@ class AccountEdiFormat(models.Model): res = False try: if file_data['type'] == 'xml': - res = edi_format.with_company(self.env.company)._update_invoice_from_xml_tree(file_data['filename'], file_data['xml_tree'], invoice) + res = edi_format.with_company(invoice.company_id)._update_invoice_from_xml_tree(file_data['filename'], file_data['xml_tree'], invoice) elif file_data['type'] == 'pdf': - res = edi_format.with_company(self.env.company)._update_invoice_from_pdf_reader(file_data['filename'], file_data['pdf_reader'], invoice) + res = edi_format.with_company(invoice.company_id)._update_invoice_from_pdf_reader(file_data['filename'], file_data['pdf_reader'], invoice) file_data['pdf_reader'].stream.close() else: # file_data['type'] == 'binary' res = edi_format._update_invoice_from_binary(file_data['filename'], file_data['content'], file_data['extension'], invoice) @@ -587,7 +587,10 @@ class AccountEdiFormat(models.Model): if value is not None: domains.append([domain]) - domain = expression.OR(domains) + domain = expression.AND([ + expression.OR(domains), + [('company_id', 'in', [False, self.env.company.id])], + ]) return self.env['product.product'].search(domain, limit=1) def _retrieve_tax(self, amount, type_tax_use): @@ -599,7 +602,8 @@ class AccountEdiFormat(models.Model): ''' domains = [ [('amount', '=', float(amount))], - [('type_tax_use', '=', type_tax_use)] + [('type_tax_use', '=', type_tax_use)], + [('company_id', '=', self.env.company.id)] ] return self.env['account.tax'].search(expression.AND(domains), order='sequence ASC', limit=1)