From 679ede2c327a98fa113d2367fc3c31a94e368022 Mon Sep 17 00:00:00 2001 From: Benoit Socias Date: Wed, 30 Aug 2023 08:55:59 +0200 Subject: [PATCH] [FIX] website: get the name of the visitor through the related field Since [1] if the partner related to a visitor belongs to a company that cannot be accessed by the current user, an error is raised when trying to display the list of visitors. This commit makes the name obtained through an additional sudo on the `partner_id` record which might not be accessible to the current user. This is equivalent to using the `name` field of visitor, except that accessing the `partner_id` field will fail if `website.visitor` itself cannot be accessed. Steps to reproduce: - Go to Settings / Companies - Create a second company - Go to Website / Reporting / Visitors - Select "Edwin Hansen" - Navigate to its linked partner in the contact field "Gemini Furniture, Edwin Hansen" - Navigate to its company "Gemini Furniture" - In the "Sales & Purchase" tab, assign the second company as the Company - Save (this creates an error - but it is saved) - Go to Website / Reporting / Visitors => The page was not displayed and an access error message was displayed. [1]: https://github.com/odoo/odoo/commit/d348bed1ad9d3d16b295f013f015706be6c07820 opw-3462104 closes odoo/odoo#134190 X-original-commit: a75673217aef2ffaaa93585526dc1e647a270495 Signed-off-by: Romain Derie (rde) --- addons/website/models/website_visitor.py | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/addons/website/models/website_visitor.py b/addons/website/models/website_visitor.py index 81fdcfee277..2be9bec6283 100644 --- a/addons/website/models/website_visitor.py +++ b/addons/website/models/website_visitor.py @@ -86,7 +86,9 @@ class WebsiteVisitor(models.Model): @api.depends('partner_id') def _compute_display_name(self): for record in self: - record.display_name = record.partner_id.name or _('Website Visitor #%s', record.id) + # Accessing name of partner through sudo to avoid infringing + # record rule if partner belongs to another company. + record.display_name = record.partner_id.sudo().name or _('Website Visitor #%s', record.id) @api.depends('access_token') def _compute_partner_id(self):