From a978a3647a8ed8a08311f56dcf2f3e04056052b8 Mon Sep 17 00:00:00 2001 From: Martin Trigaux Date: Tue, 5 Jun 2018 14:23:29 +0200 Subject: [PATCH] [FIX] mail: multi-company access to TZ - Create 2 Companies A & B - Set User B in Company B - Record some `mail.activity` for User B on a lead belonging to Company B. - With a manager user in Company A, go to Kanban view of leads and remove filters => all leads, including leads in Company B, are displayed An access error occurs. `read_progress_bar` method, tries to access the field `activity_state` which is: `states = record.activity_ids.mapped('state')`. The state of a `mail.activity` is using the tz of the partner. To read the `activity_state` of a lead, one needs to access `record.activity_ids.user_id.partner_id.tz` => multi-company security rules raised opw: 1850984, 1859470 --- addons/mail/models/mail_activity.py | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/addons/mail/models/mail_activity.py b/addons/mail/models/mail_activity.py index 921e06f7d47..19ca810f1fe 100644 --- a/addons/mail/models/mail_activity.py +++ b/addons/mail/models/mail_activity.py @@ -113,9 +113,10 @@ class MailActivity(models.Model): for record in self.filtered(lambda activity: activity.date_deadline): today = today_default - if record.user_id.tz: + tz = record.user_id.sudo().tz + if tz: today_utc = pytz.UTC.localize(datetime.utcnow()) - today_tz = today_utc.astimezone(pytz.timezone(record.user_id.tz)) + today_tz = today_utc.astimezone(pytz.timezone(tz)) today = date(year=today_tz.year, month=today_tz.month, day=today_tz.day) date_deadline = fields.Date.from_string(record.date_deadline)