From 3eaca8ba169e5913eb466b6d15b6852138abcce5 Mon Sep 17 00:00:00 2001 From: Jeremy Kersten Date: Mon, 27 Feb 2023 12:54:27 +0000 Subject: [PATCH] [FIX] hr_rexpense: expense_sheet_id is not readable for portal user MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Missing sudo for portal user on Invoice list. When portal user go to his portal, to display the list of the invoices we compute the url via get_portal_url that will call this method `is_purchase_document` and got a traceback due to missing permission. Now we call it with sudo to bypass the Access Right error without leaking any extra information since it is casted as boolean later. `get_portal_url` -> `record.access_url `-> `_compute_access_url` account:account.move `def _compute_access_url` -> `filter(is_invoice)` account:account.move `def is_invoice` -> `is_sale_document or is_purchase_document` hr_expense:account.move `def is_purchase_document` -> `return bool(self.expense_sheet_id) or super()` closes odoo/odoo#114424 X-original-commit: 01a91419f906bd8d9248e6376a0246b667218ca2 Signed-off-by: Jérémy Kersten --- addons/hr_expense/models/account_move.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/addons/hr_expense/models/account_move.py b/addons/hr_expense/models/account_move.py index 7f54774da95..b7bb1562d17 100644 --- a/addons/hr_expense/models/account_move.py +++ b/addons/hr_expense/models/account_move.py @@ -26,7 +26,7 @@ class AccountMove(models.Model): # Behave exactly like a receipt for everything except the display # This enables the synchronisation of payment terms, and sets the taxes and accounts based on the product def is_purchase_document(self, include_receipts=False): - return bool(self.expense_sheet_id and include_receipts) or super().is_purchase_document(include_receipts) + return bool(include_receipts and self.sudo().expense_sheet_id) or super().is_purchase_document(include_receipts) def is_entry(self): if self.expense_sheet_id: