From bc2d796dbcb31f7e2a46fd5093af190f9c109cc3 Mon Sep 17 00:00:00 2001 From: "Thomas Lefebvre (thle)" Date: Wed, 3 May 2023 09:35:29 +0000 Subject: [PATCH] [FIX] hr_attendance: prevent the edition of `employee_id` Issue: A user has write access rights to modify his own attendances. However, he can modify the `employee_id` field. This can cause attendances to be moved to other employees. opw-3280850 closes odoo/odoo#120632 X-original-commit: 1c25a9b964e9e2acf9d431897e83cf72ecdca1cb Signed-off-by: Kevin Baptiste Signed-off-by: Lefebvre Thomas (thle) --- addons/hr_attendance/i18n/hr_attendance.pot | 8 ++++++++ addons/hr_attendance/models/hr_attendance.py | 5 +++++ 2 files changed, 13 insertions(+) diff --git a/addons/hr_attendance/i18n/hr_attendance.pot b/addons/hr_attendance/i18n/hr_attendance.pot index 48ed222a495..0b9ebafdcfc 100644 --- a/addons/hr_attendance/i18n/hr_attendance.pot +++ b/addons/hr_attendance/i18n/hr_attendance.pot @@ -453,6 +453,14 @@ msgstr "" msgid "Display Name" msgstr "" +#. module: hr_attendance +#. odoo-python +#: code:addons/hr_attendance/models/hr_attendance.py:0 +#, python-format +msgid "" +"Do not have access, user cannot edit the attendances that are not his own." +msgstr "" + #. module: hr_attendance #: model_terms:ir.ui.view,arch_db:hr_attendance.res_config_settings_view_form msgid "Display Time" diff --git a/addons/hr_attendance/models/hr_attendance.py b/addons/hr_attendance/models/hr_attendance.py index 5cd254095e1..5163ec512be 100644 --- a/addons/hr_attendance/models/hr_attendance.py +++ b/addons/hr_attendance/models/hr_attendance.py @@ -13,6 +13,7 @@ from odoo.addons.resource.models.utils import Intervals from odoo.tools import format_datetime from odoo.osv.expression import AND, OR from odoo.tools.float_utils import float_is_zero +from odoo.exceptions import AccessError class HrAttendance(models.Model): @@ -300,6 +301,10 @@ class HrAttendance(models.Model): return res def write(self, vals): + if vals.get('employee_id') and \ + vals['employee_id'] not in self.env.user.employee_ids.ids and \ + not self.env.user.has_group('hr_attendance.group_hr_attendance_user'): + raise AccessError(_("Do not have access, user cannot edit the attendances that are not his own.")) attendances_dates = self._get_attendances_dates() result = super(HrAttendance, self).write(vals) if any(field in vals for field in ['employee_id', 'check_in', 'check_out']):