From 38e02bcb7fdc75235dad0d02f5efd05906783e0e Mon Sep 17 00:00:00 2001 From: Victor Feyens Date: Fri, 29 Apr 2022 10:45:10 +0000 Subject: [PATCH] [FIX] sale_management: do not allow modification of non optional SOlines The route used by the sale portal to update an option qty didn't check that the modified SOline was effectively an option. On the portal, only the optional lines were editable through the interface, but through xmlrpc, a portal user could be able to remove/update the qty of non optional lines from a quotation. This is not a true security failure since only the quantity could be modified through this route, but it makes sense to add a check to ensure this kind of modification cannot happen. closes odoo/odoo#88366 Signed-off-by: Victor Feyens (vfe) --- addons/sale_management/controllers/portal.py | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/addons/sale_management/controllers/portal.py b/addons/sale_management/controllers/portal.py index 63f54229fb6..a892c151493 100644 --- a/addons/sale_management/controllers/portal.py +++ b/addons/sale_management/controllers/portal.py @@ -50,6 +50,10 @@ class CustomerPortal(portal.CustomerPortal): if not order_line or order_line.order_id != order_sudo: return False + if not order_line.sale_order_option_ids: + # Do not allow updating non optional lines from a quotation + return False + if input_quantity is not False: quantity = input_quantity else: