From 5dd6c1f1d34b3926d2cb413793b12e14b06fb7e1 Mon Sep 17 00:00:00 2001 From: std-odoo Date: Thu, 17 Feb 2022 09:32:50 +0000 Subject: [PATCH] [FIX] *_mail_plugin: hide modules if the user doesn't have access Bug === If the user doesn't have access to the project / CRM module, those menus were visible on the addin side. Now, the sections are not visible if the user doesn't have access to. Task-2765323 closes odoo/odoo#89260 X-original-commit: 7b7aa72ecdc7e69e425ae08c28e1e7827e423548 Related: odoo/enterprise#26446 Signed-off-by: Thibault Delavallee (tde) --- .../controllers/mail_plugin.py | 19 ++++++- addons/crm_mail_plugin/tests/__init__.py | 4 ++ .../tests/test_crm_mail_plugin.py | 56 +++++++++++++++++++ .../controllers/mail_plugin.py | 18 +++++- 4 files changed, 93 insertions(+), 4 deletions(-) create mode 100644 addons/crm_mail_plugin/tests/__init__.py create mode 100644 addons/crm_mail_plugin/tests/test_crm_mail_plugin.py diff --git a/addons/crm_mail_plugin/controllers/mail_plugin.py b/addons/crm_mail_plugin/controllers/mail_plugin.py index 64685c3c69f..2926e55da3c 100644 --- a/addons/crm_mail_plugin/controllers/mail_plugin.py +++ b/addons/crm_mail_plugin/controllers/mail_plugin.py @@ -52,7 +52,16 @@ class MailPluginController(mail_plugin.MailPluginController): return leads def _get_contact_data(self, partner): + """ + Return the leads key only if the current user can create leads. So, if he can not + create leads, the section won't be visible on the addin side (like if the CRM + module was not installed on the database). + """ contact_values = super(MailPluginController, self)._get_contact_data(partner) + + if not request.env['crm.lead'].check_access_rights('create', raise_exception=False): + return contact_values + if not partner: contact_values['leads'] = [] else: @@ -60,7 +69,13 @@ class MailPluginController(mail_plugin.MailPluginController): return contact_values def _mail_content_logging_models_whitelist(self): - return super(MailPluginController, self)._mail_content_logging_models_whitelist() + ['crm.lead'] + models_whitelist = super(MailPluginController, self)._mail_content_logging_models_whitelist() + if not request.env['crm.lead'].check_access_rights('create', raise_exception=False): + return models_whitelist + return models_whitelist + ['crm.lead'] def _translation_modules_whitelist(self): - return super(MailPluginController, self)._translation_modules_whitelist() + ['crm_mail_plugin'] + modules_whitelist = super(MailPluginController, self)._translation_modules_whitelist() + if not request.env['crm.lead'].check_access_rights('create', raise_exception=False): + return modules_whitelist + return modules_whitelist + ['crm_mail_plugin'] diff --git a/addons/crm_mail_plugin/tests/__init__.py b/addons/crm_mail_plugin/tests/__init__.py new file mode 100644 index 00000000000..e54957c2171 --- /dev/null +++ b/addons/crm_mail_plugin/tests/__init__.py @@ -0,0 +1,4 @@ +# -*- coding: utf-8 -*- +# Part of Odoo. See LICENSE file for full copyright and licensing details. + +from . import test_crm_mail_plugin diff --git a/addons/crm_mail_plugin/tests/test_crm_mail_plugin.py b/addons/crm_mail_plugin/tests/test_crm_mail_plugin.py new file mode 100644 index 00000000000..07e692be9f5 --- /dev/null +++ b/addons/crm_mail_plugin/tests/test_crm_mail_plugin.py @@ -0,0 +1,56 @@ +# -*- coding: utf-8 -*- +# Part of Odoo. See LICENSE file for full copyright and licensing details. + +import json + +from odoo.addons.mail_plugin.tests.common import TestMailPluginControllerCommon, mock_auth_method_outlook + + +class TestCrmMailPlugin(TestMailPluginControllerCommon): + @mock_auth_method_outlook('employee') + def test_get_contact_data(self): + """Check that the leads section is not visible if the user has not access to crm.lead.""" + partner, partner_2 = self.env["res.partner"].create([ + {"name": "Partner 1"}, + {"name": "Partner 2"}, + ]) + + data = { + "id": 0, + "jsonrpc": "2.0", + "method": "call", + "params": {"partner_id": partner.id}, + } + + result = self.url_open( + "/mail_plugin/partner/get", + data=json.dumps(data).encode(), + headers={"Content-Type": "application/json"}, + ).json()["result"] + + self.assertNotIn("leads", result, + msg="The user has no access to crm.lead, the leads section should not be visible") + + self.user_test.groups_id |= self.env.ref("sales_team.group_sale_salesman_all_leads") + + lead_1, lead_2 = self.env["crm.lead"].create([ + {"name": "Lead Partner 1", "partner_id": partner.id}, + {"name": "Lead Partner 2", "partner_id": partner_2.id}, + ]) + + result = self.url_open( + "/mail_plugin/partner/get", + data=json.dumps(data).encode(), + headers={"Content-Type": "application/json"}, + ).json()["result"] + + self.assertIn( + "leads", + result, + msg="The user has access to crm.lead, the leads section should be visible", + ) + + self.assertTrue([lead for lead in result["leads"] if lead["lead_id"] == lead_1.id], + msg="The first lead belongs to the first partner, it should be returned") + self.assertFalse([lead for lead in result["leads"] if lead["lead_id"] == lead_2.id], + msg="The second lead does not belong to the first partner, it should not be returned") diff --git a/addons/project_mail_plugin/controllers/mail_plugin.py b/addons/project_mail_plugin/controllers/mail_plugin.py index 0b8f275c146..7236034e9ee 100644 --- a/addons/project_mail_plugin/controllers/mail_plugin.py +++ b/addons/project_mail_plugin/controllers/mail_plugin.py @@ -18,8 +18,16 @@ class MailPluginController(mail_plugin.MailPluginController): information dict loaded when opening an email on Outlook. This is structured this way to enable the "project" feature on the Outlook side only if the Odoo version supports it. + + Return the tasks key only if the current user can create tasks. So, if he can not + create tasks, the section won't be visible on the addin side (like if the project + module was not installed on the database). """ contact_values = super(MailPluginController, self)._get_contact_data(partner) + + if not request.env['project.task'].check_access_rights('create', raise_exception=False): + return contact_values + if not partner: contact_values['tasks'] = [] else: @@ -40,7 +48,13 @@ class MailPluginController(mail_plugin.MailPluginController): return contact_values def _mail_content_logging_models_whitelist(self): - return super(MailPluginController, self)._mail_content_logging_models_whitelist() + ['project.task'] + models_whitelist = super(MailPluginController, self)._mail_content_logging_models_whitelist() + if not request.env['project.task'].check_access_rights('create', raise_exception=False): + return models_whitelist + return models_whitelist + ['project.task'] def _translation_modules_whitelist(self): - return super(MailPluginController, self)._translation_modules_whitelist() + ['project_mail_plugin'] + modules_whitelist = super(MailPluginController, self)._translation_modules_whitelist() + if not request.env['project.task'].check_access_rights('create', raise_exception=False): + return modules_whitelist + return modules_whitelist + ['project_mail_plugin']