[FIX] sale_project: solve access rights issue in project update

Steps to reproduce:
-------------------
1. Install sale_project with demo data
2. Create a user with no access rights other than Project/User
3. With that user, navigate to the 'AGR - S00064 - Sales Order' project > Project Update
4. In the Right Side Panel, at the bottom of the 'Sale Order Items' section, click on 'Load More'

This will give an access rights error.
The reason is that while we load the first five SOLs with sudo rights, we don't use sudo for subsequents items, thus leading to an access right error.

This commit adds two sudos to avoid that error.

closes odoo/odoo#154271

X-original-commit: 8750b94c53c6ab58567873b0745fa6d9a18c97d0
Signed-off-by: Xavier Bol (xbo) <xbo@odoo.com>
This commit is contained in:
Vincent Larcin
2024-02-16 07:32:29 +00:00
parent 549d7c8225
commit c2e1f34f31
+3 -3
View File
@@ -364,9 +364,9 @@ class Project(models.Model):
} for sol_read in sols.with_context(with_price_unit=True).read(['display_name', 'product_uom_qty', 'qty_delivered', 'qty_invoiced', 'product_uom'])]
def _get_sale_items_domain(self, additional_domain=None):
sale_items = self._get_sale_order_items()
sale_items = self.sudo()._get_sale_order_items()
domain = [
('order_id', 'in', sale_items.order_id.ids),
('order_id', 'in', sale_items.sudo().order_id.ids),
('is_downpayment', '=', False),
('state', '=', 'sale'),
('display_type', '=', False),
@@ -381,7 +381,7 @@ class Project(models.Model):
return domain
def _get_sale_items(self, with_action=True):
domain = self.sudo()._get_sale_items_domain()
domain = self._get_sale_items_domain()
return {
'total': self.env['sale.order.line'].sudo().search_count(domain),
'data': self.get_sale_items_data(domain, limit=5, with_action=with_action),