From 561775fda90ea988d7bb6a1bcd001ab937f460ed Mon Sep 17 00:00:00 2001 From: "Hugo Carlier (Huca)" Date: Wed, 4 Oct 2023 09:20:17 +0000 Subject: [PATCH] [FIX] hr_timesheet: avoid access error in project sharing Steps ===== - Install hr_timesheet - Create a project shared (in edition) with a portal user - Creata a task with a subtask and log timesheets for the subtask - As a portal user open the parent task form - Go in the timesheet tab - Click on the button "Sub-tasks Hours/Days Spent" at the bottom of the page Issue ===== An access error appears for an uom.uom record. Cause ===== Portal users have no access to uom.uom records. The method _apply_timesheet_label uses this model to determine if the time spent needs to be displayed with an 'hours' or a 'days' label. This raises a traceback when it is called by a portal user. Fix === The method _apply_timesheet_label is called as sudo, following the fix that was already done in project sharing (see odoo/odoo#73341). task-3527521 closes odoo/odoo#139125 X-original-commit: 01b1cf07bc1fb618d34065271cdc07fce561337f Signed-off-by: Xavier Bol (xbo) --- addons/hr_timesheet/models/hr_timesheet.py | 3 ++- addons/hr_timesheet/tests/__init__.py | 1 + .../tests/test_portal_timesheet.py | 25 +++++++++++++++++++ 3 files changed, 28 insertions(+), 1 deletion(-) create mode 100644 addons/hr_timesheet/tests/test_portal_timesheet.py diff --git a/addons/hr_timesheet/models/hr_timesheet.py b/addons/hr_timesheet/models/hr_timesheet.py index 695bf1f70cd..6801c31ddd7 100644 --- a/addons/hr_timesheet/models/hr_timesheet.py +++ b/addons/hr_timesheet/models/hr_timesheet.py @@ -251,7 +251,8 @@ class AccountAnalyticLine(models.Model): def _get_view(self, view_id=None, view_type='form', **options): """ Set the correct label for `unit_amount`, depending on company UoM """ arch, view = super()._get_view(view_id, view_type, **options) - arch = self._apply_timesheet_label(arch, view_type=view_type) + # Use of sudo as the portal user doesn't have access to uom + arch = self.sudo()._apply_timesheet_label(arch, view_type=view_type) arch = self._apply_time_label(arch, related_model=self._name) return arch, view diff --git a/addons/hr_timesheet/tests/__init__.py b/addons/hr_timesheet/tests/__init__.py index 0d998f7cee1..eaf5a5b7ee1 100644 --- a/addons/hr_timesheet/tests/__init__.py +++ b/addons/hr_timesheet/tests/__init__.py @@ -4,3 +4,4 @@ from . import test_timesheet from . import test_performance from . import test_project_task_quick_create +from . import test_portal_timesheet diff --git a/addons/hr_timesheet/tests/test_portal_timesheet.py b/addons/hr_timesheet/tests/test_portal_timesheet.py new file mode 100644 index 00000000000..33132f8f0ac --- /dev/null +++ b/addons/hr_timesheet/tests/test_portal_timesheet.py @@ -0,0 +1,25 @@ +# -*- coding: utf-8 -*- + +from odoo import Command +from odoo.tests import tagged + +from odoo.addons.project.tests.test_project_sharing import TestProjectSharingCommon + +@tagged('post_install', '-at_install') +class TestPortalTimesheet(TestProjectSharingCommon): + + def test_ensure_fields_view_get_access(self): + """ Ensure that the method _fields_view_get is accessible without + raising an error for all portal users + """ + # A portal collaborator is added to a project to enable the rule analytic.account.analytic.line.timesheet.portal.user + self.project_portal.write({ + 'collaborator_ids': [ + Command.create({'partner_id': self.user_portal.partner_id.id}), + ], + }) + for view in ['form', 'tree']: + # Ensure that uom.uom records are not present in cache + self.env.invalidate_all() + # Should not raise any access error + self.env['account.analytic.line'].with_user(self.user_portal).get_view(view_type=view)