From 36f6f2647d615fad9010a673686c6b86bce5bf0a Mon Sep 17 00:00:00 2001 From: Pierre Masereel Date: Mon, 16 Jan 2017 11:18:54 +0100 Subject: [PATCH] [FIX] hr: do not show employee users to portal users When you are connected as a portal user, you can connect to the backend of Odoo and if you go to your discuss app through the '@' icon, you can list the employees of the company by mention a employee This is caused by a SQL request that store in cache the employee list to minimize requests when mention. The problem is that those requests don't take into account the rights of a user to read employees information. To fix this, we are taking the group 'base.group_user' and read the information of its users, the 'read' is respecting, the access rights of the users, and so the employees names, are ont shown anymore to portal users. opw-704127 --- addons/hr/res_partner.py | 17 ++++++++--------- 1 file changed, 8 insertions(+), 9 deletions(-) diff --git a/addons/hr/res_partner.py b/addons/hr/res_partner.py index 962a0989e61..5f85ce66186 100644 --- a/addons/hr/res_partner.py +++ b/addons/hr/res_partner.py @@ -1,6 +1,7 @@ # -*- coding: utf-8 -*- from openerp import api, models +from openerp.exceptions import AccessError class Partner(models.Model): _name = "res.partner" @@ -11,12 +12,10 @@ class Partner(models.Model): """ Extend the mail's static mention suggestions by adding the employees. """ suggestions = super(Partner, self).get_static_mention_suggestions() - employee_group_id = self.env['ir.model.data'].xmlid_to_res_id('base.group_user') - self._cr.execute(""" - SELECT P.id, P.name, P.email - FROM res_users U - INNER JOIN res_groups_users_rel R ON U.id = R.uid - INNER JOIN res_partner P ON P.id = U.partner_id - WHERE R.gid = %s AND U.active = 't'""", (employee_group_id,)) - suggestions.append(self._cr.dictfetchall()) - return suggestions + try: + employee_group = self.env.ref('base.group_user') + for user in employee_group.users: + suggestions.append((user.partner_id.id, user.name, user.email)) + return suggestions + except AccessError: + return suggestions