[FIX] account_edi_ubl_cii: allow none-admin to create xml

Process has been refactor on 16.2:
955091e707

Steps to reproduce on fresh SaaS~16.2:
Connected as Admin:

1. Install localization module LUX `l10n_lu`,
Switch to the `LU company`

2. Modify a `res.partner`, on the tab "Invoicing":
Handle his electronic invoicing to use the format `ubl_bis3`
described as `Peppol BIS Billing 3.0`
Select any value in the field `Peppol e-address (EAS)`
And put any value in the field `Peppol Endpoint`(I used `1234567890`)

3. On the tab "Sales&Purchaes", inner group "MISC",
Add anything in the `reference` field (required for Peppol)

4. Create an invoice, selection the partner modified,
add a product and a recipient bank

5. Confirm & Send&Print button, save the document layout.
On the Send Wizard: uncheck all except "Peppol BIS Billing 3.0",
hit Save&Print button.

If you create a new Invoice for the same customer as Marc Demo,
You should also see that the icon on the attached xml is of
mimetype "application/xml". Which is displayed on the icon
as "</>".

Prior to this fix:
If you do the same steps with a user that does not have
the write access right to the model ir_ui_view
(see _check_contents in base), the attachment will be
of type text/plain.

The issue that this trigger, is that the email going out
will have the wrong Content-Type for the attachments.
Which will lead to incorrect management on other provider.

We can bypass the security here as the XML is generated
by Odoo.

opw-3263542
X-original-commit: 04c2bb022b0f9263e2682bf8cc75fed19fd443a8
Forward-port of https://github.com/odoo/odoo/pull/124507 (15.0)

closes odoo/odoo#125258

X-original-commit: 9dc60e69110dac949e04ff8288b25fb0d0f65178
Signed-off-by: William André (wan) <wan@odoo.com>
This commit is contained in:
bve-odoo
2023-06-16 20:36:41 +02:00
parent 1dc8d10310
commit 78b63340cb
@@ -6,7 +6,7 @@ import io
from lxml import etree
from xml.sax.saxutils import escape, quoteattr
from odoo import _, api, fields, models, tools
from odoo import _, api, fields, models, tools, SUPERUSER_ID
from odoo.tools import cleanup_xml_node
from odoo.tools.pdf import OdooPdfFileReader, OdooPdfFileWriter
@@ -225,5 +225,5 @@ class AccountMoveSend(models.Model):
attachment_vals = invoice_data.get('ubl_cii_xml_attachment_values')
if attachment_vals:
self.env['ir.attachment'].create(attachment_vals)
self.env['ir.attachment'].with_user(SUPERUSER_ID).create(attachment_vals)
invoice.invalidate_recordset(fnames=['ubl_cii_xml_id', 'ubl_cii_xml_file'])