From 62ae169dfb878d3cbd06f6926e761928cc9388cf Mon Sep 17 00:00:00 2001 From: Laurent Smet Date: Tue, 21 Jan 2020 10:47:04 +0000 Subject: [PATCH] [FIX] account, sale: Fix account.move (invoices) access rights Without any access rights on the 'account' module, a salesperson should be able to create a new invoice from a sale order. Since the merge of account.invoice with account.move, we need to manage carefully the access rights when dealing with invoices. A salesperson must not be able to manage the journal entries except the one being an invoice created for a sale order. To make such restriction on the journal entry's type, we need additional record rules - in sale: to restrict the access to invoices. - in account: to exit such restrictions when having billing access rights. closes odoo/odoo#44023 Signed-off-by: Laurent Smet --- addons/account/security/account_security.xml | 16 ++++++++++++++++ addons/sale/models/sale.py | 9 +++++++-- addons/sale/security/ir.model.access.csv | 8 ++++---- addons/sale/security/sale_security.xml | 8 ++++---- 4 files changed, 31 insertions(+), 10 deletions(-) diff --git a/addons/account/security/account_security.xml b/addons/account/security/account_security.xml index 3fbc524f785..93424570274 100644 --- a/addons/account/security/account_security.xml +++ b/addons/account/security/account_security.xml @@ -203,6 +203,22 @@ ['|',('company_id','=',False),('company_id', 'in', company_ids)] + + + + All Journal Entries + + [(1, '=', 1)] + + + + + All Journal Items + + [(1, '=', 1)] + + + Portal Personal Account Invoices diff --git a/addons/sale/models/sale.py b/addons/sale/models/sale.py index b1a1820d844..81c2dfa7995 100644 --- a/addons/sale/models/sale.py +++ b/addons/sale/models/sale.py @@ -579,6 +579,9 @@ class SaleOrder(models.Model): :param final: if True, refunds will be generated if necessary :returns: list of created invoices """ + if not self.env.user.has_group('sales_team.group_sale_salesman'): + return [] + precision = self.env['decimal.precision'].precision_get('Product Unit of Measure') # 1) Create invoices. @@ -636,12 +639,14 @@ class SaleOrder(models.Model): invoice_vals_list = new_invoice_vals_list # 3) Create invoices. - moves = self.env['account.move'].with_context(default_type='out_invoice').create(invoice_vals_list) + # Manage the creation of invoices in sudo because a salesperson must be able to generate an invoice from a + # sale order without "billing" access rights. However, he should not be able to create an invoice from scratch. + moves = self.env['account.move'].sudo().with_context(default_type='out_invoice').create(invoice_vals_list) # 4) Some moves might actually be refunds: convert them if the total amount is negative # We do this after the moves have been created since we need taxes, etc. to know if the total # is actually negative or not if final: - moves.filtered(lambda m: m.amount_total < 0).action_switch_invoice_into_refund_credit_note() + moves.sudo().filtered(lambda m: m.amount_total < 0).action_switch_invoice_into_refund_credit_note() for move in moves: move.message_post_with_view('mail.message_origin_link', values={'self': move, 'origin': move.line_ids.mapped('sale_line_ids.order_id')}, diff --git a/addons/sale/security/ir.model.access.csv b/addons/sale/security/ir.model.access.csv index 553ed2647ff..3dec3d9c007 100644 --- a/addons/sale/security/ir.model.access.csv +++ b/addons/sale/security/ir.model.access.csv @@ -5,10 +5,10 @@ access_sale_order_line_readonly,sale.order.line accountant,model_sale_order_line access_sale_order_line_accountant,sale.order.line accountant,model_sale_order_line,account.group_account_user,1,1,0,0 access_sale_order_portal,sale.order.portal,sale.model_sale_order,base.group_portal,1,0,0,0 access_sale_order_line_portal,sale.order.line.portal,sale.model_sale_order_line,base.group_portal,1,0,0,0 -access_account_move_salesman,account_move salesman,account.model_account_move,sales_team.group_sale_salesman,1,1,1,0 -access_account_move_manager,account_move manager,account.model_account_move,sales_team.group_sale_manager,1,1,1,1 -access_account_move_line_salesman,account_move_line salesman,account.model_account_move_line,sales_team.group_sale_salesman,1,1,1,0 -access_account_move__linemanager,account_move_line manager,account.model_account_move_line,sales_team.group_sale_manager,1,1,1,1 +access_account_move_manager,account_move manager,account.model_account_move,sales_team.group_sale_manager,1,0,0,0 +access_account_move_salesman,account_move salesman,account.model_account_move,sales_team.group_sale_salesman,1,0,0,0 +access_account_move_line_salesman,account_move_line salesman,account.model_account_move_line,sales_team.group_sale_salesman,1,0,0,0 +access_account_partial_reconcile_salesman,account_partial_reconcile salesman,account.model_account_partial_reconcile,sales_team.group_sale_salesman,1,0,0,0 access_account_payment_term_salesman,account_payment_term salesman,account.model_account_payment_term,sales_team.group_sale_salesman,1,0,0,0 access_account_account_tag_sale_salesman,account.account.tag.sale.salesman,account.model_account_account_tag,sales_team.group_sale_salesman,1,0,0,0 access_account_account_type_sale_salesman,account.account.type.sale.salesman,account.model_account_account_type,sales_team.group_sale_salesman,1,0,0,0 diff --git a/addons/sale/security/sale_security.xml b/addons/sale/security/sale_security.xml index edf762aca51..bd0508e1ef7 100644 --- a/addons/sale/security/sale_security.xml +++ b/addons/sale/security/sale_security.xml @@ -163,28 +163,28 @@ Personal Invoices - [('invoice_user_id', '=', user.id), ('type', '!=', 'entry')] + [('type', 'in', ('out_invoice', 'out_refund', 'in_invoice', 'in_refund')), '|', ('invoice_user_id', '=', user.id), ('invoice_user_id', '=', False)] All Invoices - [('type', '!=', 'entry')] + [('type', 'in', ('out_invoice', 'out_refund', 'in_invoice', 'in_refund'))] Personal Invoice Lines - [('invoice_user_id', '=', user.id), ('type', '!=', 'entry')] + [('move_id.type', 'in', ('out_invoice', 'out_refund', 'in_invoice', 'in_refund')), '|', ('move_id.invoice_user_id', '=', user.id), ('move_id.invoice_user_id', '=', False)] All Invoice Lines - [('type', '!=', 'entry')] + [('move_id.type', 'in', ('out_invoice', 'out_refund', 'in_invoice', 'in_refund'))]