From 459c02b39c8ede72fcbf9134c2f7d6d6f6060ad4 Mon Sep 17 00:00:00 2001 From: William Henrotin Date: Tue, 24 Mar 2020 11:19:14 +0000 Subject: [PATCH] [IMP] account: check access right before posting invoice This commit ensure the user have to minimum rights to post invoices The 'Post' button was already hidden but the post() method is public Task : 2206969 X-original-commit: 28ae3fb5366d61d3f5f9067cda962b047105199e --- addons/account/models/account_move.py | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/addons/account/models/account_move.py b/addons/account/models/account_move.py index 96064fbb046..5634952cf58 100644 --- a/addons/account/models/account_move.py +++ b/addons/account/models/account_move.py @@ -1,7 +1,7 @@ # -*- coding: utf-8 -*- from odoo import api, fields, models, _ -from odoo.exceptions import RedirectWarning, UserError, ValidationError +from odoo.exceptions import RedirectWarning, UserError, ValidationError, AccessError from odoo.tools import float_is_zero, float_compare, date_utils, email_split, email_escape_char, email_re from odoo.tools.misc import formatLang, format_date, get_lang @@ -2113,6 +2113,9 @@ class AccountMove(models.Model): return move def post(self): + # `user_has_group` won't be bypassed by `sudo()` since it doesn't change the user anymore. + if not self.env.su and not self.env.user.has_group('account.group_account_invoice'): + raise AccessError(_("You don't have the access rights to post an invoice.")) for move in self: if not move.line_ids.filtered(lambda line: not line.display_type): raise UserError(_('You need to add a line before posting.'))