From ad4b334789321dd0905ae9fb230ec95b4b2f2a6d Mon Sep 17 00:00:00 2001
From: "Xavier BOL (xbo)" <xbo@odoo.com>
Date: Wed, 6 Apr 2022 11:12:23 +0000
Subject: [PATCH] [IMP] sale_project: check if the user can access SO to see
 SOLs

Before this commit, when the user clicks on the Material row shown in
the project profitability section, he can see the SOLs from another
saleman even if he has just the "See own documents" access rights on
Sales app. Moreover, the check to allow the user to click on a SOL name
in Sales section to get either the timesheets and the stock moves
related is done in sudo and so we do not take into account the rules
defined for the current user.

This commit filters the Sales Order Items to show for the user if
he can see the Sales Order(s) related. it removes the sudo to
correctly filter the SOLs and get only the ones accessible by the
current user.

task-2814466

Part-of: odoo/odoo#88219
---
 addons/sale_project/models/project.py | 26 +++++++++++++++++---------
 1 file changed, 17 insertions(+), 9 deletions(-)

diff --git a/addons/sale_project/models/project.py b/addons/sale_project/models/project.py
index f6fea590504..6ec8142f33d 100644
--- a/addons/sale_project/models/project.py
+++ b/addons/sale_project/models/project.py
@@ -111,7 +111,7 @@ class Project(models.Model):
                 'name': _('Sales Order Items'),
                 'type': 'ir.actions.act_window',
                 'res_model': 'sale.order.line',
-                'context': {'no_create': True},
+                'context': {'create': False, 'edit': False},
             }
             if res_id:
                 action['res_id'] = res_id
@@ -262,7 +262,7 @@ class Project(models.Model):
             limit=limit,
         )
         # filter to only get the action for the SOLs that the user can read
-        action_per_sol = sols._filter_access_rules_python('read')._get_action_per_item() if with_action else {}
+        action_per_sol = sols.sudo(False)._filter_access_rules_python('read')._get_action_per_item() if with_action else {}
 
         def get_action(sol_id):
             """ Return the action vals to call it in frontend if the user can access to the SO related """
@@ -296,7 +296,7 @@ class Project(models.Model):
         return {
             **super()._get_profitability_labels(),
             'service_revenues': _lt('Other Services'),
-            'other_revenues': _lt('Material'),
+            'other_revenues': _lt('Materials'),
         }
 
     def _get_profitability_sequence_per_invoice_type(self):
@@ -373,12 +373,20 @@ class Project(models.Model):
             if display_sol_action:
                 section_name = 'other_revenues'
                 other_revenues = revenues_dict.get(section_name, {})
-                sol_ids = other_revenues.pop('record_ids', [])
-                if sol_ids:
-                    action_params = {'name': 'action_profitability_items', 'type': 'object', 'section': section_name, 'domain': json.dumps(domain)}
-                    if len(sol_ids) == 1:
-                        action_params['res_id'] = sol_ids[0]
-                    other_revenues['action'] = action_params
+                sale_order_items = self.env['sale.order.line'] \
+                    .browse(other_revenues.pop('record_ids', [])) \
+                    ._filter_access_rules_python('read')
+                if sale_order_items:
+                    if sale_order_items:
+                        action_params = {
+                            'name': 'action_profitability_items',
+                            'type': 'object',
+                            'section': section_name,
+                            'domain': json.dumps([('id', 'in', sale_order_items.ids)]),
+                        }
+                        if len(sale_order_items) == 1:
+                            action_params['res_id'] = sale_order_items.id
+                        other_revenues['action'] = action_params
         sequence_per_invoice_type = self._get_profitability_sequence_per_invoice_type()
         return {
             'data': [{'id': invoice_type, 'sequence': sequence_per_invoice_type[invoice_type], **vals} for invoice_type, vals in revenues_dict.items()],