From 5cff4dad990ee57f3f7bfffd4f09677ce6de1042 Mon Sep 17 00:00:00 2001
From: Denis Ledoux <dle@odoo.com>
Date: Fri, 6 Nov 2015 15:28:07 +0100
Subject: [PATCH] [FIX] portal_sale: quotations access rights for portal users

Several fields are not supposed to be seen by portal users
on the quotation form.

This revision removes the fields that portal users are
not supposed to see on their quotations, or the one
for which they do not have the right access for.

opw-654007
---
 addons/portal_sale/portal_sale_view.xml | 41 +++++++++++++++++++++++++
 1 file changed, 41 insertions(+)

diff --git a/addons/portal_sale/portal_sale_view.xml b/addons/portal_sale/portal_sale_view.xml
index 81c7432888b..8600d9e4062 100644
--- a/addons/portal_sale/portal_sale_view.xml
+++ b/addons/portal_sale/portal_sale_view.xml
@@ -13,6 +13,47 @@
             </field>
         </record>
 
+        <record id="view_order_form_portal_sale" model="ir.ui.view">
+            <field name="name">sale.order.form.portal_sale</field>
+            <field name="model">sale.order</field>
+            <field name="inherit_id" ref="sale.view_order_form"/>
+            <field name="groups_id" eval="[(4, ref('base.group_portal'))]"/>
+            <field name="arch" type="xml">
+                <data>
+                    <xpath expr='//field[@name="order_line"]/form//field[@name="procurement_ids"]' position="replace"/>
+                    <xpath expr='//field[@name="order_line"]/form//field[@name="product_id"]' position="replace"/>
+                    <xpath expr='//field[@name="order_line"]/form//field[@name="qty_delivered_updateable"]' position="replace"/>
+                    <xpath expr='//field[@name="order_line"]/form//label[@for="qty_delivered"]' position="replace"/>
+                    <xpath expr='//field[@name="order_line"]/form//field[@name="qty_delivered"]' position="replace"/>
+                    <xpath expr='//field[@name="order_line"]/form//label[@for="qty_invoiced"]' position="replace"/>
+                    <xpath expr='//field[@name="order_line"]/form//field[@name="qty_invoiced"]' position="replace"/>
+                    <xpath expr='//field[@name="order_line"]/form//field[@name="price_unit"]' position="attributes">
+                        <attribute name="attrs">{}</attribute>
+                    </xpath>
+                    <xpath expr='//field[@name="order_line"]/form//field[@name="tax_id"]' position="attributes">
+                        <attribute name="attrs">{}</attribute>
+                    </xpath>
+                    <xpath expr='//field[@name="order_line"]/tree//field[@name="procurement_ids"]' position="replace"/>
+                    <xpath expr='//field[@name="order_line"]/tree//field[@name="product_id"]' position="replace"/>
+                    <xpath expr='//field[@name="order_line"]/tree//field[@name="qty_delivered_updateable"]' position="replace"/>
+                    <xpath expr='//field[@name="order_line"]/tree//field[@name="qty_delivered"]' position="replace"/>
+                    <xpath expr='//field[@name="order_line"]/tree//field[@name="qty_invoiced"]' position="replace"/>
+                    <xpath expr='//field[@name="order_line"]/tree//field[@name="price_unit"]' position="attributes">
+                        <attribute name="attrs">{}</attribute>
+                    </xpath>
+                    <xpath expr='//field[@name="order_line"]/tree//field[@name="tax_id"]' position="attributes">
+                        <attribute name="attrs">{}</attribute>
+                    </xpath>
+                    <xpath expr='//field[@name="order_line"]/kanban//field[@name="product_id"]' position="replace">
+                        <field name="name"/>
+                    </xpath>
+                    <xpath expr='//field[@name="order_line"]/kanban/templates/t/div//span/t' position="replace">
+                        <t t-esc="record.name.value"/>
+                    </xpath>
+                </data>
+            </field>
+        </record>
+
         <!--
             Override the original action to set another help field and/or
             another context field, more suited for portal members