From 4dae545bf9f886cc41a42150c29e6b0c7efaac5d Mon Sep 17 00:00:00 2001 From: Toufik Ben Jaa Date: Thu, 15 Nov 2018 11:39:05 +0000 Subject: [PATCH] [FIX] mass_mailing_sale: check access on SO & invoice report - When computing the count of quotations count and the invoiced amount on a mass mailing, we do not check if the current user has access to the models `sale.order` and `account.invoice.report`. This fix first check the access rights on the models, if the current user doesn't have read access, then we set the computed value to 0. closes odoo/odoo#28717 --- addons/mass_mailing_sale/models/mass_mailing.py | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/addons/mass_mailing_sale/models/mass_mailing.py b/addons/mass_mailing_sale/models/mass_mailing.py index 8257d14db6f..723bdee7b1a 100644 --- a/addons/mass_mailing_sale/models/mass_mailing.py +++ b/addons/mass_mailing_sale/models/mass_mailing.py @@ -14,15 +14,21 @@ class MassMailing(models.Model): @api.depends('mailing_domain') def _compute_sale_quotation_count(self): + has_so_access = self.env['sale.order'].check_access_rights('read', raise_exception=False) for mass_mailing in self: - mass_mailing.sale_quotation_count = self.env['sale.order'].search_count(self._get_sale_utm_domain()) + mass_mailing.sale_quotation_count = self.env['sale.order'].search_count(self._get_sale_utm_domain()) if has_so_access else 0 @api.depends('mailing_domain') def _compute_sale_invoiced_amount(self): + has_so_access = self.env['sale.order'].check_access_rights('read', raise_exception=False) + has_invoice_report_access = self.env['account.invoice.report'].check_access_rights('read', raise_exception=False) for mass_mailing in self: - invoices = self.env['sale.order'].search(self._get_sale_utm_domain()).mapped('invoice_ids') - res = self.env['account.invoice.report'].search_read([('invoice_id', 'in', invoices.ids)], ['user_currency_price_total']) - mass_mailing.sale_invoiced_amount = sum(r['user_currency_price_total'] for r in res) + if has_so_access and has_invoice_report_access: + invoices = self.env['sale.order'].search(self._get_sale_utm_domain()).mapped('invoice_ids') + res = self.env['account.invoice.report'].search_read([('invoice_id', 'in', invoices.ids)], ['user_currency_price_total']) + mass_mailing.sale_invoiced_amount = sum(r['user_currency_price_total'] for r in res) + else: + mass_mailing.sale_invoiced_amount = 0 @api.multi def action_redirect_to_quotations(self):