From 2479da0176280d723a5c6f5de1f3be2b77dfb51f Mon Sep 17 00:00:00 2001
From: Xavier ALT <xal@odoo.com>
Date: Tue, 30 Jun 2020 11:31:15 +0000
Subject: [PATCH] [FIX] web: do no try to render filters referencing access
 restricted fields

In case a field is limited to specific groups on the model, those fields
are discarded from `fields_view_get()` but can still be referenced by some
filters on the search view causing a traceback (see #53797)

Model:

```python

class MyModel(models.Model):

  my_field = fields.Char(groups='base.group_system')
```

Search views:

```xml
<search string="My Model">
    <filter name="group_myfield" context="{'group_by': 'my_field'}"/>
</search>
```

This commit ensure those filter are correctly discarded.

OPW-2284621

closes odoo/odoo#54112

X-original-commit: b3452a1863c36290b13e16161e2703d9a3737f0e
Signed-off-by: Aaron Bohy (aab) <aab@odoo.com>
---
 .../js/control_panel/control_panel_model.js   | 19 ++++++--
 .../control_panel/control_panel_tests.js      | 43 +++++++++++++++++++
 2 files changed, 59 insertions(+), 3 deletions(-)

diff --git a/addons/web/static/src/js/control_panel/control_panel_model.js b/addons/web/static/src/js/control_panel/control_panel_model.js
index d09c6eeaa58..438ff98cd3a 100644
--- a/addons/web/static/src/js/control_panel/control_panel_model.js
+++ b/addons/web/static/src/js/control_panel/control_panel_model.js
@@ -778,6 +778,22 @@ odoo.define('web.ControlPanelModel', function (require) {
                         // and others are passive (require input(s) to become determined)
                         // What is the right place to process the attrs?
                     };
+                    if (preFilter.attrs && JSON.parse(preFilter.attrs.modifiers || '{}').invisible) {
+                        filter.invisible = true;
+
+                        var preFilterFieldName = null;
+                        if (preFilter.tag == 'filter' && preFilter.attrs.date) {
+                            preFilterFieldName = preFilter.attrs.date;
+                        } else if (preFilter.tag == 'groupBy') {
+                            preFilterFieldName = preFilter.attrs.fieldName;
+                        }
+                        if (preFilterFieldName && !this.fields[preFilterFieldName]) {
+                            // In some case when a field is limited to specific groups
+                            // on the model, we need to ensure to discard related filter
+                            // as it may still be present in the view (in 'invisible' state)
+                            return;
+                        }
+                    }
                     if (filter.type === 'filter' || filter.type === 'groupBy') {
                         filter.groupNumber = groupNumber;
                     }
@@ -908,9 +924,6 @@ odoo.define('web.ControlPanelModel', function (require) {
                 filter.isDefault = attrs.isDefault;
             }
             filter.description = attrs.string || attrs.help || attrs.name || attrs.domain || 'Ω';
-            if (JSON.parse(attrs.modifiers || '{}').invisible) {
-                filter.invisible = true;
-            }
             switch (filter.type) {
                 case 'filter':
                     if (attrs.context) {
diff --git a/addons/web/static/tests/control_panel/control_panel_tests.js b/addons/web/static/tests/control_panel/control_panel_tests.js
index 84000e7c616..c2dce2eb16f 100644
--- a/addons/web/static/tests/control_panel/control_panel_tests.js
+++ b/addons/web/static/tests/control_panel/control_panel_tests.js
@@ -130,6 +130,49 @@ odoo.define('web.control_panel_tests', function (require) {
             controlPanel.destroy();
         });
 
+        QUnit.test('invisible fields and filters with unknown related fields should not be rendered', async function (assert) {
+            assert.expect(2);
+
+            // This test case considers that the current user is not a member of
+            // the "base.group_system" group and both "bar" and "date_field" fields
+            // have field-level access control that limit access to them only from
+            // that group.
+            //
+            // As MockServer currently does not support "groups" access control, we:
+            //
+            // - emulate field-level access control of fields_get() by removing
+            //   "bar" and "date_field" from the model fields
+            // - set filters with groups="base.group_system" as `invisible=1` in
+            //   view to emulate the behavior of fields_view_get()
+            //   [see ir.ui.view `_apply_group()`]
+
+            delete this.fields['bar'];
+            delete this.fields['date_field'];
+
+            const arch = `
+                <search>
+                    <field name="foo"/>
+                    <filter name="filterDate" string="Date" date="date_field" default_period="last_365_days" invisible="1" groups="base.group_system"/>
+                    <filter name="groupByBar" string="Bar" context="{'group_by': 'bar'}" invisible="1" groups="base.group_system"/>
+                </search>`;
+            const searchMenuTypes = [];
+            const params = {
+                cpStoreConfig: {
+                    viewInfo: { arch, fields: this.fields },
+                    searchMenuTypes
+                },
+                cpProps: { fields: this.fields, searchMenuTypes },
+            };
+            const controlPanel = await createControlPanel(params);
+
+            assert.containsNone(controlPanel.el, 'div.o_search_options div.o_filter_menu',
+                "there should not be filter dropdown");
+            assert.containsNone(controlPanel.el, 'div.o_search_options div.o_group_by_menu',
+                "there should not be groupby dropdown");
+
+            controlPanel.destroy();
+        });
+
         QUnit.test('groupby menu is not rendered if searchMenuTypes does not have groupBy', async function (assert) {
             assert.expect(2);