From bf2f6f9264e6fc056c45865b5f79c17a163c0a85 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thibault=20Delavall=C3=A9e?= Date: Wed, 29 Mar 2017 15:51:24 +0200 Subject: [PATCH] [IMP] models: sudo get_formview_action but add access rights uid get_formview_action is now called as sudo to avoid access rights issues when browsing it and trying to determine the ID of the form view to display. However in some cases it can be interesting to know the real user trying to access the form view. The original uid is therefore added as parameter of the method to have the best of two worlds. --- addons/account/models/account_invoice.py | 2 +- addons/crm/models/crm_lead.py | 2 +- odoo/models.py | 7 +++++-- 3 files changed, 7 insertions(+), 4 deletions(-) diff --git a/addons/account/models/account_invoice.py b/addons/account/models/account_invoice.py index 8a39428c162..2558eb79a85 100644 --- a/addons/account/models/account_invoice.py +++ b/addons/account/models/account_invoice.py @@ -612,7 +612,7 @@ class AccountInvoice(models.Model): return self.action_cancel() @api.multi - def get_formview_id(self): + def get_formview_id(self, access_uid=None): """ Update form view id of action to open the invoice """ if self.type in ('in_invoice', 'in_refund'): return self.env.ref('account.invoice_supplier_form').id diff --git a/addons/crm/models/crm_lead.py b/addons/crm/models/crm_lead.py index 2d127588aa6..7afd9367e1b 100644 --- a/addons/crm/models/crm_lead.py +++ b/addons/crm/models/crm_lead.py @@ -1035,7 +1035,7 @@ class Lead(models.Model): return {lead.id: aliases.get(lead.team_id.id or 0, False) for lead in leads} @api.multi - def get_formview_id(self): + def get_formview_id(self, access_uid=None): if self.type == 'opportunity': view_id = self.env.ref('crm.crm_case_form_view_oppor').id else: diff --git a/odoo/models.py b/odoo/models.py index 2540fcd59ce..fe302fb0a4f 100644 --- a/odoo/models.py +++ b/odoo/models.py @@ -1347,10 +1347,13 @@ class BaseModel(object): return result @api.multi - def get_formview_id(self): + def get_formview_id(self, access_uid=None): """ Return an view id to open the document ``self`` with. This method is meant to be overridden in addons that want to give specific view ids for example. + + Optional access_uid holds the user that would access the form view + id different from the current environment user. """ return False @@ -1360,7 +1363,7 @@ class BaseModel(object): to be overridden in addons that want to give specific view ids for example. """ - view_id = self.get_formview_id() + view_id = self.sudo().get_formview_id(access_uid=self.env.uid) return { 'type': 'ir.actions.act_window', 'res_model': self._name,