pengyuthon/odoo_source
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[FIX] website_quote: tokenized link in portal

Browse Source 
When a user has access to a quote (because he is follower) but he is not
in the same company than the customer, an access error can occur on the
the rendering of the partner field.

We use the tokenized link instead, which will read the SO as a superuser
to avoid this situation.

opw-691740
This commit is contained in:
Nicolas Martinelli
2016-11-02 08:43:02 +01:00
parent a699504536
commit a4c67f2b9e
1 changed files with 6 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
addons/website_quote/views/website_quotation.xml
+6 -1
View File
@@ -692,7 +692,12 @@
<t t-foreach="quotations" t-as="quotation">
<tr>
<td>
<a t-attf-href="/quote/#{quotation.id}?#{keep_query()}"><t t-esc="quotation.name"/></a>
<t t-if="quotation.sudo().partner_id.commercial_partner_id != request.env.user.partner_id.commercial_partner_id and request.env.user.share">
<a t-attf-href="/quote/#{quotation.id}/#{quotation.access_token}?#{keep_query()}"><t t-esc="quotation.name"/></a>
</t>
<t t-if="not (quotation.sudo().partner_id.commercial_partner_id != request.env.user.partner_id.commercial_partner_id and request.env.user.share)">
<a t-attf-href="/quote/#{quotation.id}?#{keep_query()}"><t t-esc="quotation.name"/></a>
</t>
</td>
<td><span t-field="quotation.validity_date"/></td>
<td>