From c2293ca70c2792c76b08c80adb936cdc474ab1cf Mon Sep 17 00:00:00 2001 From: Raphael Collet Date: Mon, 11 Jul 2022 10:08:07 +0000 Subject: [PATCH] [FIX] crm: add missing compute_sudo on crm.lead.company_currency The field `company_currency` is indirectly used by portal users, and does not seem to be a security concern in that context. But as portal users cannot read companies, the field should be computed in superuser mode. This apparently used to work by accident in the past... closes odoo/odoo#95325 Signed-off-by: Raphael Collet --- addons/crm/models/crm_lead.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/addons/crm/models/crm_lead.py b/addons/crm/models/crm_lead.py index 248426b02d5..e7e884165d1 100644 --- a/addons/crm/models/crm_lead.py +++ b/addons/crm/models/crm_lead.py @@ -150,7 +150,7 @@ class Lead(models.Model): compute="_compute_recurring_revenue_monthly") recurring_revenue_monthly_prorated = fields.Monetary('Prorated MRR', currency_field='company_currency', store=True, compute="_compute_recurring_revenue_monthly_prorated") - company_currency = fields.Many2one("res.currency", string='Currency', compute="_compute_company_currency", readonly=True) + company_currency = fields.Many2one("res.currency", string='Currency', compute="_compute_company_currency", compute_sudo=True) # Dates date_closed = fields.Datetime('Closed Date', readonly=True, copy=False) date_action_last = fields.Datetime('Last Action', readonly=True)