diff --git a/addons/account/models/res_partner_bank.py b/addons/account/models/res_partner_bank.py index 5081e530f4b..40786305541 100644 --- a/addons/account/models/res_partner_bank.py +++ b/addons/account/models/res_partner_bank.py @@ -47,6 +47,7 @@ class ResPartnerBank(models.Model): 'usually happens when their emails are compromised. Once verified, you can activate the ability to send money.' ) currency_id = fields.Many2one(tracking=True) + lock_trust_fields = fields.Boolean(compute='_compute_lock_trust_fields') @api.constrains('journal_id') def _check_journal_id(self): @@ -97,6 +98,14 @@ class ResPartnerBank(models.Model): for bank in self: bank.user_has_group_validate_bank_account = user_has_group_validate_bank_account + @api.depends('allow_out_payment') + def _compute_lock_trust_fields(self): + for bank in self: + if not bank._origin or not bank.allow_out_payment: + bank.lock_trust_fields = False + elif bank._origin and bank.allow_out_payment: + bank.lock_trust_fields = True + def _build_qr_code_vals(self, amount, free_communication, structured_communication, currency, debtor_partner, qr_method=None, silent_errors=True): """ Returns the QR-code vals needed to generate the QR-code report link to pay this account with the given parameters, or None if no QR-code could be generated. @@ -264,6 +273,15 @@ class ResPartnerBank(models.Model): # Group initial values by partner_id account_initial_values[account][field] = account[field] + # Some fields should not be editable based on conditions. It is enforced in the view, but not in python which + # leaves them vulnerable to edits via the shell/... So we need to ensure that the user has the rights to edit + # these fields when writing too. + if ('acc_number' in vals or 'partner_id' in vals) and any(account.lock_trust_fields for account in self): + raise UserError(_("You cannot modify the account number or partner of an account that has been trusted.")) + + if 'allow_out_payment' in vals and not self.user_has_groups('account.group_validate_bank_account'): + raise UserError(_("You do not have the rights to trust or un-trust accounts.")) + res = super().write(vals) # Log changes to move lines on each move diff --git a/addons/account/security/account_security.xml b/addons/account/security/account_security.xml index ece4c8a66b9..c68d17e7780 100644 --- a/addons/account/security/account_security.xml +++ b/addons/account/security/account_security.xml @@ -82,9 +82,16 @@ + + + Bank + + 50 + + Validate bank account - + diff --git a/addons/account/views/res_partner_bank_views.xml b/addons/account/views/res_partner_bank_views.xml index 0a73979d239..73f8a07add2 100644 --- a/addons/account/views/res_partner_bank_views.xml +++ b/addons/account/views/res_partner_bank_views.xml @@ -17,15 +17,16 @@ - {'readonly': [('allow_out_payment', '=', True)]} + {'readonly': [('lock_trust_fields', '=', True)]} - {'readonly': [('allow_out_payment', '=', True)]} + {'readonly': [('lock_trust_fields', '=', True)]} +