From a3e504eff521844d36dd931a3ed22f8d86b95153 Mon Sep 17 00:00:00 2001 From: Nans Lefebvre Date: Tue, 9 Jul 2019 07:15:23 +0000 Subject: [PATCH] [FIX] sale_timesheet: let employees officers/project users access private tasks Have a user U that is Project User, Timesheets User, Employeed Officer. Give him access to a private task T (by adding U as a follower of T) on private project P. Because of Employeed Officer rights, view_task_form2_inherited is rendered. This shows field is_project_map_empty, which computation depends on project_id. If U does not have access to P, then this triggers an access error, so the Task cannot be displayed. It is in general a legitimate configuration to allow U to interact with T without being given full access to P, since it works in all cases but the rights described above. Since the computation of is_project_map_empty is the only blocking point, we put it in sudo. opw 2031124 closes odoo/odoo#34676 Signed-off-by: Nans Lefebvre (len) --- addons/sale_timesheet/models/project.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/addons/sale_timesheet/models/project.py b/addons/sale_timesheet/models/project.py index 4c12a88d3bf..ba1f68a2740 100644 --- a/addons/sale_timesheet/models/project.py +++ b/addons/sale_timesheet/models/project.py @@ -176,7 +176,7 @@ class ProjectTask(models.Model): @api.depends('project_id.sale_line_employee_ids') def _compute_is_project_map_empty(self): for task in self: - task.is_project_map_empty = not bool(task.project_id.sale_line_employee_ids) + task.is_project_map_empty = not bool(task.sudo().project_id.sale_line_employee_ids) @api.onchange('project_id') def _onchange_project(self):