From 40a2f48b450a4411796335502bf422b699e52378 Mon Sep 17 00:00:00 2001 From: "qdp-launchpad@tinyerp.com" <> Date: Fri, 8 Oct 2010 23:32:05 +0200 Subject: [PATCH] [IMP] sale: security enhancements bzr revid: qdp-launchpad@tinyerp.com-20101008213205-37h0e6q3i1h0bq5o --- addons/sale/sale.py | 3 +-- addons/sale/security/ir.model.access.csv | 4 ++-- 2 files changed, 3 insertions(+), 4 deletions(-) diff --git a/addons/sale/sale.py b/addons/sale/sale.py index 6c8bf247b23..c3e0a29af9d 100644 --- a/addons/sale/sale.py +++ b/addons/sale/sale.py @@ -279,10 +279,9 @@ class sale_order(osv.osv): 'invoice_quantity': fields.selection([('order', 'Ordered Quantities'), ('procurement', 'Shipped Quantities')], 'Invoice on', help="The sale order will automatically create the invoice proposition (draft invoice). Ordered and delivered quantities may not be the same. You have to choose if you want your invoice based on ordered or shipped quantities. If the product is a service, shipped quantities means hours spent on the associated tasks.", required=True), 'payment_term': fields.many2one('account.payment.term', 'Payment Term'), 'fiscal_position': fields.many2one('account.fiscal.position', 'Fiscal Position'), - 'company_id': fields.many2one('res.company','Company') + 'company_id': fields.related('shop_id','company_id',type='many2one',relation='res.company',string='Company',store=True) } _defaults = { - 'company_id': lambda s, cr, uid, c: s.pool.get('res.company')._company_default_get(cr, uid, 'sale.order', context=c), 'picking_policy': 'direct', 'date_order': time.strftime('%Y-%m-%d'), 'order_policy': 'manual', diff --git a/addons/sale/security/ir.model.access.csv b/addons/sale/security/ir.model.access.csv index 0d523202a10..3675ccf32ae 100644 --- a/addons/sale/security/ir.model.access.csv +++ b/addons/sale/security/ir.model.access.csv @@ -1,11 +1,11 @@ "id","name","model_id:id","group_id:id","perm_read","perm_write","perm_create","perm_unlink" -"access_sale_shop","sale.shop","model_sale_shop","base.group_sale_salesman",1,1,1,0 +"access_sale_shop","sale.shop","model_sale_shop","base.group_sale_salesman",1,0,0,0 "access_sale_order","sale.order","model_sale_order","base.group_sale_salesman",1,1,1,0 "access_sale_order_line","sale.order.line","model_sale_order_line","base.group_sale_salesman",1,1,1,1 "access_sale_shop_admin","sale.shop","model_sale_shop","base.group_system",1,1,1,1 "access_account_invoice_salesman","account_invoice salesman","account.model_account_invoice","base.group_sale_salesman",1,1,1,0 "access_account_invoice_manager","account_invoice manager","account.model_account_invoice","base.group_sale_manager",1,1,1,1 -"access_account_invoice_line_salesman","account_invoice.line salesman","account.model_account_invoice_line","base.group_sale_salesman",1,1,1,1 +"access_account_invoice_line_salesman","account_invoice.line salesman","account.model_account_invoice_line","base.group_sale_salesman",1,1,1,0 "access_account_payment_term_salesman","account_payment_term salesman","account.model_account_payment_term","base.group_sale_salesman",1,0,0,0 "access_account_analytic_account_salesman","account_analytic_account salesman","analytic.model_account_analytic_account","base.group_sale_salesman",1,1,1,0 "access_stock_picking_salesman","stock_picking salesman","stock.model_stock_picking","base.group_sale_salesman",1,1,1,0