From 3378ca8252d3ac0e22a8aa1632ffc436864b26b7 Mon Sep 17 00:00:00 2001 From: "Xavier BOL (xbo)" Date: Tue, 5 Jan 2021 10:19:30 +0100 Subject: [PATCH] [IMP] hr_timesheet: use access rights if user is internal Before this commit, when the user can only see his own timesheets, this user can see more than his own timesheets in timesheets portal (/my/timesheets). It is because we use the domain defined for portal and we don't use the access rights defined for this intenal user. This commit uses the access right if the user has the lowest group for Timesheet App. Otherwise, we use the domain for portal as before. Co-authored-by: Laurent Stukkens (LTU) task-2424382 --- addons/hr_timesheet/controllers/portal.py | 11 +++++++---- addons/hr_timesheet/models/hr_timesheet.py | 3 +++ 2 files changed, 10 insertions(+), 4 deletions(-) diff --git a/addons/hr_timesheet/controllers/portal.py b/addons/hr_timesheet/controllers/portal.py index b244ee3e656..a9dcb714ba5 100644 --- a/addons/hr_timesheet/controllers/portal.py +++ b/addons/hr_timesheet/controllers/portal.py @@ -19,8 +19,9 @@ class TimesheetCustomerPortal(CustomerPortal): def _prepare_home_portal_values(self, counters): values = super()._prepare_home_portal_values(counters) if 'timesheet_count' in counters: - domain = request.env['account.analytic.line']._timesheet_get_portal_domain() - values['timesheet_count'] = request.env['account.analytic.line'].sudo().search_count(domain) + Timesheet = request.env['account.analytic.line'] + domain = Timesheet._timesheet_get_portal_domain() + values['timesheet_count'] = Timesheet.sudo().search_count(domain) return values def _get_searchbar_inputs(self): @@ -63,9 +64,11 @@ class TimesheetCustomerPortal(CustomerPortal): @http.route(['/my/timesheets', '/my/timesheets/page/'], type='http', auth="user", website=True) def portal_my_timesheets(self, page=1, sortby=None, filterby=None, search=None, search_in='all', groupby='none', **kw): - Timesheet_sudo = request.env['account.analytic.line'].sudo() + Timesheet = request.env['account.analytic.line'] + domain = Timesheet._timesheet_get_portal_domain() + Timesheet_sudo = Timesheet.sudo() + values = self._prepare_portal_layout_values() - domain = request.env['account.analytic.line']._timesheet_get_portal_domain() _items_per_page = 100 searchbar_sortings = { diff --git a/addons/hr_timesheet/models/hr_timesheet.py b/addons/hr_timesheet/models/hr_timesheet.py index 17d4a613371..74a16b03a31 100644 --- a/addons/hr_timesheet/models/hr_timesheet.py +++ b/addons/hr_timesheet/models/hr_timesheet.py @@ -135,6 +135,9 @@ class AccountAnalyticLine(models.Model): return etree.tostring(doc, encoding='unicode') def _timesheet_get_portal_domain(self): + if self.env.user.has_group('hr_timesheet.group_hr_timesheet_user'): + # Then, he is internal user, and we take the domain for this current user + return self.env['ir.rule']._compute_domain(self._name) return ['&', '|', '|', '|', ('task_id.project_id.message_partner_ids', 'child_of', [self.env.user.partner_id.commercial_partner_id.id]),