From 8184bb3dff06bb90560519aec312f58d92135ae7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thibault=20Delavall=C3=A9e?= Date: Wed, 24 May 2017 10:59:21 +0200 Subject: [PATCH] [FIX] website_portal_sale: fix access rights issues when viewing quotes Portal users do not have access on invoices or invoice lines. However when viewing an online quotation in website_portal_sale some computation is performed based on invoices and invoice lines. We therefore iterate on invoice and invoice lines as superuser as we do not want to grant any additional access on those models for portal users. --- addons/website_portal_sale/controllers/main.py | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/addons/website_portal_sale/controllers/main.py b/addons/website_portal_sale/controllers/main.py index 1b03ba6620d..33eb43a3c72 100644 --- a/addons/website_portal_sale/controllers/main.py +++ b/addons/website_portal_sale/controllers/main.py @@ -125,9 +125,12 @@ class website_account(website_account): order.check_access_rule('read') except AccessError: return request.render("website.403") - order_invoice_lines = {il.product_id.id: il.invoice_id for il in order.invoice_ids.mapped('invoice_line_ids')} + + order_sudo = order.sudo() + order_invoice_lines = {il.product_id.id: il.invoice_id for il in order_sudo.invoice_ids.mapped('invoice_line_ids')} + return request.render("website_portal_sale.orders_followup", { - 'order': order.sudo(), + 'order': order_sudo, 'order_invoice_lines': order_invoice_lines, })