pengyuthon/odoo_source
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[FIX] mass_mailing_sale: check access on SO & invoice report

Browse Source 
- When computing the count of quotations count and the invoiced amount
  on a mass mailing, we do not check if the current user has access to
  the models `sale.order` and `account.invoice.report`.

  This fix first check the access rights on the models, if the current
  user doesn't have read access, then we set the computed value to 0.

closes odoo/odoo#28717
This commit is contained in:
Toufik Ben Jaa
2018-11-15 11:39:05 +00:00
parent 7077f18e3a
commit 4dae545bf9
1 changed files with 10 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
addons/mass_mailing_sale/models/mass_mailing.py
+10 -4
View File
@@ -14,15 +14,21 @@ class MassMailing(models.Model):
@api.depends('mailing_domain')
def _compute_sale_quotation_count(self):
has_so_access = self.env['sale.order'].check_access_rights('read', raise_exception=False)
for mass_mailing in self:
mass_mailing.sale_quotation_count = self.env['sale.order'].search_count(self._get_sale_utm_domain())
mass_mailing.sale_quotation_count = self.env['sale.order'].search_count(self._get_sale_utm_domain()) if has_so_access else 0
@api.depends('mailing_domain')
def _compute_sale_invoiced_amount(self):
has_so_access = self.env['sale.order'].check_access_rights('read', raise_exception=False)
has_invoice_report_access = self.env['account.invoice.report'].check_access_rights('read', raise_exception=False)
for mass_mailing in self:
invoices = self.env['sale.order'].search(self._get_sale_utm_domain()).mapped('invoice_ids')
res = self.env['account.invoice.report'].search_read([('invoice_id', 'in', invoices.ids)], ['user_currency_price_total'])
mass_mailing.sale_invoiced_amount = sum(r['user_currency_price_total'] for r in res)
if has_so_access and has_invoice_report_access:
invoices = self.env['sale.order'].search(self._get_sale_utm_domain()).mapped('invoice_ids')
res = self.env['account.invoice.report'].search_read([('invoice_id', 'in', invoices.ids)], ['user_currency_price_total'])
mass_mailing.sale_invoiced_amount = sum(r['user_currency_price_total'] for r in res)
else:
mass_mailing.sale_invoiced_amount = 0
@api.multi
def action_redirect_to_quotations(self):