From 4902075e3dcc766fee4415040c7035ea5477c792 Mon Sep 17 00:00:00 2001 From: William Braeckman Date: Wed, 15 Dec 2021 14:08:26 +0000 Subject: [PATCH] [IMP] hr: allow users to edit their settings in multi-company contexts Before this commit users were not able to edit their settings if they had a linked employee for a company that was not currently active for them. This is due to the fact that since the employee_ids field is considered `safe` to read/write by your own user the fields were loaded in sudo and thus bypassed the security rules that were meant to prevent that issue. The security rule is now enforced as a domain on the `employee_ids`. TaskId-2715341 closes odoo/odoo#81612 X-original-commit: b5b105eabd90419a5856e8279e277743c5915fc9 Signed-off-by: Kevin Baptiste Signed-off-by: William Braeckman (wbr) --- addons/hr/models/res_users.py | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/addons/hr/models/res_users.py b/addons/hr/models/res_users.py index 036e4af6345..6853f059748 100644 --- a/addons/hr/models/res_users.py +++ b/addons/hr/models/res_users.py @@ -73,8 +73,13 @@ HR_WRITABLE_FIELDS = [ class User(models.Model): _inherit = ['res.users'] + def _employee_ids_domain(self): + # employee_ids is considered a safe field and as such will be fetched as sudo. + # So try to enforce the security rules on the field to make sure we do not load employees outside of active companies + return [('company_id', 'in', self.env.company.ids + self.env.context.get('allowed_company_ids', []))] + # note: a user can only be linked to one employee per company (see sql constraint in ´hr.employee´) - employee_ids = fields.One2many('hr.employee', 'user_id', string='Related employee') + employee_ids = fields.One2many('hr.employee', 'user_id', string='Related employee', domain=_employee_ids_domain) employee_id = fields.Many2one('hr.employee', string="Company employee", compute='_compute_company_employee', search='_search_company_employee', store=False)