[FIX] base: query company dependant as superuser

When retrieving company dependant values, the computed domain called
search_multi method of ir.property as normal user.
Since odoo/odoo@8f57863707 ir.property records are no longer
readable by a normal classical user.

To reproduce:
Add a domain using a company_dependant field
e.g. on res.partner, with purchase installed, modify the parent_id
field in form view to

  <field name="parent_id" ... domain="[('property_purchase_currency_id','=',property_purchase_currency_id)]" />

When clicking on the parent_id with a low priviledge user, an
access-right error is raised, as the user doesn't have access to
ir.property records

Fixes odoo/odoo#65450

closes odoo/odoo#65643

X-original-commit: 33868b4e14124800035ea99df111b35b4199ae60
Signed-off-by: Martin Trigaux (mat) <mat@odoo.com>
This commit is contained in:
Martin Trigaux
2021-02-05 16:20:49 +00:00
parent ea747950a9
commit 76f305a556
2 changed files with 7 additions and 1 deletions
@@ -1377,6 +1377,12 @@ class TestFields(TransactionCaseWithUserDemo):
self.assertEqual(attribute_record.company.foo, 'DEF')
self.assertEqual(attribute_record.bar, 'DEFDEF')
# a low priviledge user should be able to search on company_dependent fields
company_record.env.user.groups_id -= self.env.ref('base.group_system')
self.assertFalse(company_record.env.user.has_group('base.group_system'))
company_records = self.env['test_new_api.company'].search([('foo', '=', 'DEF')])
self.assertEqual(len(company_records), 1)
def test_30_read(self):
""" test computed fields as returned by read(). """
discussion = self.env.ref('test_new_api.discussion_0')
+1 -1
View File
@@ -612,7 +612,7 @@ class Field(MetaField('DummyField', (object,), {})):
Property._set_multi(self.name, self.model_name, values)
def _search_company_dependent(self, records, operator, value):
Property = records.env['ir.property']
Property = records.env['ir.property'].sudo()
return Property.search_multi(self.name, self.model_name, operator, value)
#