From 6354cd0e5c91ac67b5058230bdf3a84ca9792dd6 Mon Sep 17 00:00:00 2001 From: anhe-odoo Date: Fri, 28 Jan 2022 14:36:54 +0000 Subject: [PATCH] [FIX] hr: Hide 'delete' and 'change password' actions on own profile Expected Behaviour When a user goes to his own profile, he has two ways to change his password : 1. through the 'Account security' tab 2. through the 'Actions' > 'Change password' menu in list/form view Both option should let the user change its password, or one of the two should not be present Observed behaviour While the first one works as expected, the second option gives an error as the user doesn't have the admin rights Reproducibility This bug can be reproduced following these steps: 0. Make sure to have the "Employees" app installed 1. Connect as an employee (e.g. demo/demo on runbot) 2. Click on your name at the top right, go to 'My Profile' 3. Click 'Action' then 'Change password' Problem Root Cause There is an override of field_view_get for the res.users model in the hr module which elevates the user with sudo so that the user may modify their own user in some capacity. The problem is that by elevating the ACLs of the user, fields_view_get will also return actions that are not normally available to the user (e.g. deletion of user profile) Related Issues/PR - opw-2735671 closes odoo/odoo#86116 X-original-commit: 6487a9ea7d25d14a86a7476b4b512f3681da7405 Signed-off-by: Yannick Tivisse (yti) --- addons/hr/models/res_users.py | 12 ++++++++++- addons/hr/tests/test_self_user_access.py | 26 ++++++++++++++++++++++++ addons/hr/views/res_users.xml | 1 + 3 files changed, 38 insertions(+), 1 deletion(-) diff --git a/addons/hr/models/res_users.py b/addons/hr/models/res_users.py index 2dc47730b9d..b75d541f4e0 100644 --- a/addons/hr/models/res_users.py +++ b/addons/hr/models/res_users.py @@ -175,9 +175,19 @@ class User(models.Model): # Note: limit the `sudo` to the only action of "editing own profile" action in order to # avoid breaking `groups` mecanism on res.users form view. profile_view = self.env.ref("hr.res_users_view_form_profile") + original_user = self.env.user if profile_view and view_id == profile_view.id: self = self.with_user(SUPERUSER_ID) - return super(User, self).fields_view_get(view_id=view_id, view_type=view_type, toolbar=toolbar, submenu=submenu) + result = super(User, self).fields_view_get(view_id=view_id, view_type=view_type, toolbar=toolbar, submenu=submenu) + # Due to using the SUPERUSER the result will contain action that the user may not have access too + # here we filter out actions that requires special implicit rights to avoid having unusable actions + # in the dropdown menu. + if toolbar and self.env.user != original_user: + self = self.with_user(original_user.id) + if not self.user_has_groups("base.group_erp_manager"): + change_password_action = self.env.ref("base.change_password_wizard_action") + result['toolbar']['action'] = [act for act in result['toolbar']['action'] if act['id'] != change_password_action.id] + return result def write(self, vals): """ diff --git a/addons/hr/tests/test_self_user_access.py b/addons/hr/tests/test_self_user_access.py index 6458deac69e..539476e48b0 100644 --- a/addons/hr/tests/test_self_user_access.py +++ b/addons/hr/tests/test_self_user_access.py @@ -76,6 +76,32 @@ class TestSelfAccessProfile(TestHrCommon): # Compare both self.assertEqual(full_fields.keys(), fields.keys(), "View fields should not depend on user's groups") + def test_access_my_profile_toolbar(self): + """ A simple user shouldn't have the possibilities to see the 'Change Password' action""" + james = new_test_user(self.env, login='jam', groups='base.group_user', name='Simple employee', email='jam@example.com') + james = james.with_user(james) + self.env['hr.employee'].create({ + 'name': 'James', + 'user_id': james.id, + }) + view = self.env.ref('hr.res_users_view_form_profile') + available_actions = james.fields_view_get(view_id=view.id, toolbar=True)['toolbar']['action'] + change_password_action = self.env.ref("base.change_password_wizard_action") + + self.assertFalse(any(x['id'] == change_password_action.id for x in available_actions)) + + # An ERP manager should have the possibilities to see the 'Change Password' + john = new_test_user(self.env, login='joh', groups='base.group_erp_manager', name='ERP Manager', email='joh@example.com') + john = john.with_user(john) + self.env['hr.employee'].create({ + 'name': 'John', + 'user_id': john.id, + }) + view = self.env.ref('hr.res_users_view_form_profile') + available_actions = john.fields_view_get(view_id=view.id, toolbar=True)['toolbar']['action'] + self.assertTrue(any(x['id'] == change_password_action.id for x in available_actions)) + + class TestSelfAccessRights(TestHrCommon): @classmethod diff --git a/addons/hr/views/res_users.xml b/addons/hr/views/res_users.xml index a60024152d3..d61884c35bb 100644 --- a/addons/hr/views/res_users.xml +++ b/addons/hr/views/res_users.xml @@ -47,6 +47,7 @@
false + false hr_employee_profile_form