pengyuthon/odoo_source
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[FIX] hr_rexpense: expense_sheet_id is not readable for portal user

Browse Source 
Missing sudo for portal user on Invoice list.

When portal user go to his portal, to display the list of the invoices
we compute the url via get_portal_url that will call this method
`is_purchase_document` and got a traceback due to missing permission.

Now we call it with sudo to bypass the Access Right error without leaking
any extra information since it is casted as boolean later.

`get_portal_url` -> `record.access_url `-> `_compute_access_url`

account:account.move `def _compute_access_url` -> `filter(is_invoice)`

account:account.move `def is_invoice` -> `is_sale_document or is_purchase_document`

hr_expense:account.move `def is_purchase_document` -> `return bool(self.expense_sheet_id) or super()`

closes odoo/odoo#114424

X-original-commit: 01a91419f906bd8d9248e6376a0246b667218ca2
Signed-off-by: Jérémy Kersten <jke@odoo.com>
This commit is contained in:
Jeremy Kersten
2023-03-07 02:00:17 +01:00
parent 415a8b11a1
commit 3eaca8ba16
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
addons/hr_expense/models/account_move.py
+1 -1
View File
@@ -26,7 +26,7 @@ class AccountMove(models.Model):
# Behave exactly like a receipt for everything except the display
# This enables the synchronisation of payment terms, and sets the taxes and accounts based on the product
def is_purchase_document(self, include_receipts=False):
return bool(self.expense_sheet_id and include_receipts) or super().is_purchase_document(include_receipts)
return bool(include_receipts and self.sudo().expense_sheet_id) or super().is_purchase_document(include_receipts)
def is_entry(self):
if self.expense_sheet_id: