From 8bfdd36dc9480f35ca82dccc53c5dd0428ef4977 Mon Sep 17 00:00:00 2001 From: "Anh Thao Pham (pta)" Date: Mon, 15 Mar 2021 09:48:05 +0000 Subject: [PATCH] [FIX] point_of_sale: fix session closing with purchase rights - Create an internal user with ONLY the following rights: * Point Of Sale: User|Administrator * Purchase: User|Administrator - Connect with created user - Open a POS session and validate an order - Close session - Validate closing & post entries The access is denied when trying to create account move due to following rule: "Purchase User Account Move". When validating session and creating account move, sudo is applied if user has no "create" right on "account.move". In the particular case where user is a purchase user or admin, he also has "create" right on "account.move" and sudo is not applied when validating session (as it would have been if he has no purchase rights). However, as defined by "Purchase User Account Move" rule, he is limited to account moves where type is in ('in_invoice', 'in_refund', 'in_receipt'). But the account move created when closing and validating session is of type "entry", and therefore user cannot validate session. A POS user should be able to close and validate a session, either he is a purchase user or not. opw-2456783 closes odoo/odoo#68060 X-original-commit: 4779ff2369f1f632429f5305bc4a84db730c3dfe Signed-off-by: Anh Thao PHAM --- addons/point_of_sale/models/pos_session.py | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/addons/point_of_sale/models/pos_session.py b/addons/point_of_sale/models/pos_session.py index 8d2f6c64aa0..dae2f72aea7 100644 --- a/addons/point_of_sale/models/pos_session.py +++ b/addons/point_of_sale/models/pos_session.py @@ -5,7 +5,7 @@ from collections import defaultdict from datetime import timedelta from odoo import api, fields, models, _ -from odoo.exceptions import UserError, ValidationError +from odoo.exceptions import AccessError, UserError, ValidationError from odoo.tools import float_is_zero, float_compare class PosSession(models.Model): @@ -304,13 +304,13 @@ class PosSession(models.Model): self._check_if_no_draft_orders() if self.update_stock_at_closing: self._create_picking_at_end_of_session() - if ( - not self.env['account.move'].check_access_rights('create', raise_exception=False) - and self.user_has_groups('point_of_sale.group_pos_user') - ): - data = self.sudo().with_company(self.company_id)._create_account_move(balancing_account, amount_to_balance) - else: + try: data = self.with_company(self.company_id)._create_account_move(balancing_account, amount_to_balance) + except AccessError as e: + if self.user_has_groups('point_of_sale.group_pos_user'): + data = self.sudo().with_company(self.company_id)._create_account_move(balancing_account, amount_to_balance) + else: + raise e try: balance = sum(self.move_id.line_ids.mapped('balance'))