From 2585c3fca013b650927e741d9e75489ac6ed9770 Mon Sep 17 00:00:00 2001
From: Horacio Tellez <hote@odoo.com>
Date: Thu, 9 Mar 2023 14:42:49 +0000
Subject: [PATCH] [FIX] sale: forbid taxes of different company on sol

Before this commit when in a multi-company environment an user
could assign a company to the sale order and use taxes related
to a different company for the sale order lines.
This is a functional error and also provoques that taxes are not
shown for some users when in a multi-company environment.
After this commit a ValidationError will be raised whenever the
company of the taxes in the sol and the so do not match.

opw - 3117352

closes odoo/odoo#115162

X-original-commit: 295c408568bb623f0b0ead3f18493ba339b87161
Signed-off-by: Victor Feyens (vfe) <vfe@odoo.com>
Signed-off-by: Horacio Tellez Perez (hote) <hote@odoo.com>
---
 addons/sale/models/sale_order_line.py       |  3 +-
 addons/sale/tests/test_sale_order.py        | 40 +++++++++++++++++++++
 addons/sale_stock/tests/test_create_perf.py |  2 +-
 3 files changed, 43 insertions(+), 2 deletions(-)

diff --git a/addons/sale/models/sale_order_line.py b/addons/sale/models/sale_order_line.py
index 3ea67719012..a2171ca0b14 100644
--- a/addons/sale/models/sale_order_line.py
+++ b/addons/sale/models/sale_order_line.py
@@ -129,7 +129,8 @@ class SaleOrderLine(models.Model):
         string="Taxes",
         compute='_compute_tax_id',
         store=True, readonly=False, precompute=True,
-        context={'active_test': False})
+        context={'active_test': False},
+        check_company=True)
 
     # Tech field caching pricelist rule used for price & discount computation
     pricelist_item_id = fields.Many2one(
diff --git a/addons/sale/tests/test_sale_order.py b/addons/sale/tests/test_sale_order.py
index 50a0689dc13..1b1ec55c1bb 100644
--- a/addons/sale/tests/test_sale_order.py
+++ b/addons/sale/tests/test_sale_order.py
@@ -521,3 +521,43 @@ class TestSalesTeam(SaleCommon):
         })
         so_no_analytic_account.action_confirm()
         self.assertFalse(sol_no_analytic_account.analytic_distribution, "The compute should not overwrite what the user has set.")
+
+    def test_cannot_assign_tax_of_mismatch_company(self):
+        """ Test that sol cannot have assigned tax belonging to a different company from that of the sale order. """
+        company_a = self.env['res.company'].create({'name': 'A'})
+        company_b = self.env['res.company'].create({'name': 'B'})
+        tax_group_a = self.env['account.tax.group'].create({'name': 'A', 'company_id': company_a.id})
+        tax_group_b = self.env['account.tax.group'].create({'name': 'B', 'company_id': company_b.id})
+        country = self.env['res.country'].search([])[0]
+
+        tax_a = self.env['account.tax'].create({
+            'name': 'A',
+            'amount': 10,
+            'company_id': company_a.id,
+            'tax_group_id': tax_group_a.id,
+            'country_id': country.id,
+        })
+        tax_b = self.env['account.tax'].create({
+            'name': 'B',
+            'amount': 10,
+            'company_id': company_b.id,
+            'tax_group_id': tax_group_b.id,
+            'country_id': country.id,
+        })
+
+        sale_order = self.env['sale.order'].create({
+            'partner_id': self.partner.id,
+            'company_id': company_a.id
+        })
+        product = self.env['product.product'].create({'name': 'Product'})
+
+        # In sudo to simulate an user that have access to both companies.
+        sol = self.env['sale.order.line'].sudo().create({
+            'name': product.name,
+            'product_id': product.id,
+            'order_id': sale_order.id,
+            'tax_id': tax_a,
+        })
+
+        with self.assertRaises(UserError):
+            sol.tax_id = tax_b
diff --git a/addons/sale_stock/tests/test_create_perf.py b/addons/sale_stock/tests/test_create_perf.py
index 463f514c5f9..bea0b7a33c6 100644
--- a/addons/sale_stock/tests/test_create_perf.py
+++ b/addons/sale_stock/tests/test_create_perf.py
@@ -96,7 +96,7 @@ class TestPERF(common.TransactionCase):
         # + 2 SQL insert
         # + 2 queries to get analytic default tags
         # + 9 follower queries ?
-        with self.assertQueryCount(admin=47):
+        with self.assertQueryCount(admin=48):
             self.env['sale.order'].create([{
                 'partner_id': self.partners[0].id,
                 'user_id': self.salesmans[0].id,