From 7eca402b11c6032a671993d587ea52772ee4e3bb Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thibault=20Delavall=C3=A9e?= Date: Wed, 24 May 2017 10:59:21 +0200 Subject: [PATCH] [FIX] website_portal_sale: fix access rights issues when viewing quotes Portal users do not have access on invoices or invoice lines. However when viewing an online quotation in website_portal_sale some computation is performed based on invoices and invoice lines. We therefore iterate on invoice and invoice lines as superuser as we do not want to grant any additional access on those models for portal users. --- addons/website_portal_sale/controllers/main.py | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/addons/website_portal_sale/controllers/main.py b/addons/website_portal_sale/controllers/main.py index 86a56b0509b..0edaffb85de 100644 --- a/addons/website_portal_sale/controllers/main.py +++ b/addons/website_portal_sale/controllers/main.py @@ -150,11 +150,12 @@ class website_account(website_account): order.check_access_rule('read') except AccessError: return request.render("website.403") - order_invoice_lines = {il.product_id.id: il.invoice_id for il in order.invoice_ids.mapped('invoice_line_ids')} + order_sudo = order.sudo() + order_invoice_lines = {il.product_id.id: il.invoice_id for il in order_sudo.invoice_ids.mapped('invoice_line_ids')} history = request.session.get('my_orders_history', []) values = { - 'order': order.sudo(), + 'order': order_sudo, 'order_invoice_lines': order_invoice_lines, } values.update(get_records_pager(history, order))