[FIX] mail: multi-company access to TZ
- Create 2 Companies A & B
- Set User B in Company B
- Record some `mail.activity` for User B on a lead belonging to Company
B.
- With a manager user in Company A, go to Kanban view of leads and
remove filters => all leads, including leads in Company B, are
displayed
An access error occurs.
`read_progress_bar` method, tries to access the field `activity_state`
which is: `states = record.activity_ids.mapped('state')`. The state of
a `mail.activity` is using the tz of the partner. To read the
`activity_state` of a lead, one needs to access
`record.activity_ids.user_id.partner_id.tz`
=> multi-company security rules raised
opw: 1850984, 1859470
This commit is contained in:
committed by
Goffin Simon
parent
7764db7a34
commit
a978a3647a
@@ -113,9 +113,10 @@ class MailActivity(models.Model):
|
||||
|
||||
for record in self.filtered(lambda activity: activity.date_deadline):
|
||||
today = today_default
|
||||
if record.user_id.tz:
|
||||
tz = record.user_id.sudo().tz
|
||||
if tz:
|
||||
today_utc = pytz.UTC.localize(datetime.utcnow())
|
||||
today_tz = today_utc.astimezone(pytz.timezone(record.user_id.tz))
|
||||
today_tz = today_utc.astimezone(pytz.timezone(tz))
|
||||
today = date(year=today_tz.year, month=today_tz.month, day=today_tz.day)
|
||||
|
||||
date_deadline = fields.Date.from_string(record.date_deadline)
|
||||
|
||||
Reference in New Issue
Block a user