From 30b283fe7d43951c73a0565a4288a55a5eb9667c Mon Sep 17 00:00:00 2001 From: flvr-odoo Date: Thu, 27 Apr 2023 14:59:32 +0000 Subject: [PATCH] [FIX] hr_expense: prevent linking of expense with no perm Previously, a user could link his own expenses to a expense sheet of someone else. This would not be allowed upon creation but was allowed when updating the values of the expense. This commit add a simple check at the beginning of the write() closes odoo/odoo#120661 X-original-commit: 884510b1496e0a0eba7171f4ef4bb749856cb1bf Signed-off-by: Vranckx Florian (flvr) --- addons/hr_expense/models/hr_expense.py | 2 ++ 1 file changed, 2 insertions(+) diff --git a/addons/hr_expense/models/hr_expense.py b/addons/hr_expense/models/hr_expense.py index c180ad5fc55..4efbe0a6a8b 100644 --- a/addons/hr_expense/models/hr_expense.py +++ b/addons/hr_expense/models/hr_expense.py @@ -373,6 +373,8 @@ class HrExpense(models.Model): raise UserError(_('You cannot delete a posted or approved expense.')) def write(self, vals): + if 'sheet_id' in vals: + self.env['hr.expense.sheet'].browse(vals['sheet_id']).check_access_rule('write') if 'tax_ids' in vals or 'analytic_distribution' in vals or 'account_id' in vals: if any(not expense.is_editable for expense in self): raise UserError(_('You are not authorized to edit this expense report.'))