From adf3aca403a39e49e79b5c2a0275aef6e3bf8273 Mon Sep 17 00:00:00 2001 From: "Xavier BOL (xbo)" Date: Thu, 23 Sep 2021 16:05:56 +0200 Subject: [PATCH] [FIX] project: use task in sudo for classic portal task view Before this commit, when the portal user has access to a project and a task has a customer who is not in the same company than the portal user, the portal user has a AccessError when he wants to consult this task. This commit uses the task in sudo to have the same information shown in /my/task/. Steps to reproduce: ------------------ 1. Share in readonly mode a project to the portal user (with visibility set to 'portal') 2. Create a task in this project and set a Customer A (a customer who has not the same company than the portal user). 3. Log in as portal user (Joel Willis). 4. Go to '/my/projects' and select the project shared. 5. Select the task created. Actual Behaviour: ---------------- AccessError exception is displayed because the portal user has no access to partner in other company than his yours. Expected Behaviour: ------------------ Display the task portal form view like the one shown in /my/task/. task-2633229 closes #77156 X-original-commit: 3b0d6d0cef73baa5b5f235c3518c8bd698c81e21 --- addons/project/controllers/portal.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/addons/project/controllers/portal.py b/addons/project/controllers/portal.py index 7ff3097d604..63cd3bd2a22 100644 --- a/addons/project/controllers/portal.py +++ b/addons/project/controllers/portal.py @@ -210,9 +210,9 @@ class ProjectCustomerPortal(CustomerPortal): Task = request.env['project.task'] if access_token: Task = Task.sudo() - task = Task.search([('project_id', '=', project_id), ('id', '=', task_id)], limit=1) - task.sudo().attachment_ids.generate_access_token() - values = self._task_get_page_view_values(task, access_token, project=project_sudo, **kw) + task_sudo = Task.search([('project_id', '=', project_id), ('id', '=', task_id)], limit=1).sudo() + task_sudo.attachment_ids.generate_access_token() + values = self._task_get_page_view_values(task_sudo, access_token, project=project_sudo, **kw) values['project'] = project_sudo return request.render("project.portal_my_task", values)