From 56d8b2a770dfa691976e8df8e81d1cea365a95f1 Mon Sep 17 00:00:00 2001 From: Rob Coekaerts Date: Fri, 23 Jun 2023 15:11:23 +0200 Subject: [PATCH] [IMP] hr_holidays: add company access rule to hr_leave Before this commit, a company access rule existed for hr_leave but it checked the company of the associated leave type, instead of the company associated with the specific employee (or company in case of a company leave) the leave applied to. This is especially problematic as leave type are often reused across companies. This was partially worked around by forcing the company domain using employee_company_id on the specific actions that showed overviews of leaves. With this commit, this is rectified. task-3383478 Part-of: odoo/odoo#119317 --- addons/hr_holidays/models/hr_leave.py | 11 ++++++++++- addons/hr_holidays/security/hr_holidays_security.xml | 2 +- addons/hr_holidays/tests/test_access_rights.py | 6 +++++- addons/hr_holidays/views/hr_leave_views.xml | 3 +-- 4 files changed, 17 insertions(+), 5 deletions(-) diff --git a/addons/hr_holidays/models/hr_leave.py b/addons/hr_holidays/models/hr_leave.py index c16f72916d7..e1f0ff5e1d6 100644 --- a/addons/hr_holidays/models/hr_leave.py +++ b/addons/hr_holidays/models/hr_leave.py @@ -163,7 +163,8 @@ class HolidaysRequest(models.Model): employee_id = fields.Many2one( 'hr.employee', compute='_compute_from_employee_ids', store=True, string='Employee', index=True, readonly=False, ondelete="restrict", tracking=True, compute_sudo=False) - employee_company_id = fields.Many2one(related='employee_id.company_id', readonly=True, store=True) + employee_company_id = fields.Many2one(related='employee_id.company_id', string="Employee Company", readonly=True, store=True) + company_id = fields.Many2one('res.company', compute='_compute_company_id', readonly=True, store=True) active_employee = fields.Boolean(related='employee_id.active', string='Employee Active', readonly=True) tz_mismatch = fields.Boolean(compute='_compute_tz_mismatch') tz = fields.Selection(_tz_get, compute='_compute_tz') @@ -496,6 +497,14 @@ class HolidaysRequest(models.Model): else: holiday.number_of_days = 0 + @api.depends('employee_company_id', 'mode_company_id') + def _compute_company_id(self): + for holiday in self: + holiday.company_id = holiday.employee_company_id \ + or holiday.mode_company_id \ + or holiday.department_id.company_id \ + or self.env.company + @api.depends('tz') @api.depends_context('uid') def _compute_tz_mismatch(self): diff --git a/addons/hr_holidays/security/hr_holidays_security.xml b/addons/hr_holidays/security/hr_holidays_security.xml index d9628c3fc8d..43a24e45e01 100644 --- a/addons/hr_holidays/security/hr_holidays_security.xml +++ b/addons/hr_holidays/security/hr_holidays_security.xml @@ -135,7 +135,7 @@ Time Off: multi company global rule - ['|', ('holiday_status_id.company_id', '=', False), ('holiday_status_id.company_id', 'in', company_ids)] + [('company_id', 'in', company_ids)] diff --git a/addons/hr_holidays/tests/test_access_rights.py b/addons/hr_holidays/tests/test_access_rights.py index d3a43b59f13..f5e3217f393 100644 --- a/addons/hr_holidays/tests/test_access_rights.py +++ b/addons/hr_holidays/tests/test_access_rights.py @@ -466,7 +466,7 @@ class TestAccessRightsCreate(TestHrHolidaysAccessRightsCommon): 'name': 'Hol10', 'holiday_status_id': self.leave_type.id, 'holiday_type': 'company', - 'mode_company_id': 1, + 'mode_company_id': self.company.id, } self.request_leave(self.user_hrmanager_id, datetime.today() + relativedelta(days=5), 1, values) @@ -782,6 +782,7 @@ class TestMultiCompany(TestHrHolidaysCommon): 'leave_validation_type': 'hr', 'requires_allocation': 'no', }) + cls.employee_emp.company_id = cls.new_company cls.rd_dept.manager_id = False cls.hr_dept.manager_id = False @@ -827,6 +828,7 @@ class TestMultiCompany(TestHrHolidaysCommon): @mute_logger('odoo.models.unlink', 'odoo.addons.mail.models.mail_mail') def test_leave_access_no_company_user(self): + self.employee_emp.company_id = self.user_employee.company_id self.leave_type.write({'company_id': False}) employee_leave = self.employee_leave.with_user(self.user_employee) @@ -837,6 +839,7 @@ class TestMultiCompany(TestHrHolidaysCommon): @mute_logger('odoo.models.unlink', 'odoo.addons.mail.models.mail_mail') def test_leave_access_no_company_officer(self): + self.employee_emp.company_id = self.user_employee.company_id self.leave_type.write({'company_id': False}) employee_leave_hruser = self.employee_leave.with_user(self.user_hruser) @@ -846,6 +849,7 @@ class TestMultiCompany(TestHrHolidaysCommon): @mute_logger('odoo.models.unlink', 'odoo.addons.mail.models.mail_mail') def test_leave_access_no_company_manager(self): + self.employee_emp.company_id = self.user_employee.company_id self.leave_type.write({'company_id': False}) employee_leave_hrmanager = self.employee_leave.with_user(self.user_hrmanager) diff --git a/addons/hr_holidays/views/hr_leave_views.xml b/addons/hr_holidays/views/hr_leave_views.xml index 03781f50282..e6c039a7386 100644 --- a/addons/hr_holidays/views/hr_leave_views.xml +++ b/addons/hr_holidays/views/hr_leave_views.xml @@ -467,7 +467,6 @@ - @@ -630,7 +629,7 @@ - [('user_id', '=', uid), ('employee_company_id', 'in', allowed_company_ids)] + [('user_id', '=', uid)]

Keep track of your PTOs.