From c38a0d67680818dbb2e3334106e183aa307f5734 Mon Sep 17 00:00:00 2001 From: Nans Lefebvre Date: Mon, 4 Feb 2019 12:57:46 +0000 Subject: [PATCH] [FIX] mail: allow to assign an activity to an user currently in another company Let users A, B be in in companies C1 and C2, such that A is currently in C1 and B in C2. User A tries to assign to B an activity on record R belonging to C1. It fails because at the time of the check B is not in the correct company, even if B could handle the activity after switching company. The _check_access_assignation was added in commit 96a223a5f0fc3ab, to avoid activities to be created for records that the target user can't read. Previous use-case is a legitimate one where we want to bypass this restriction. Note that the systray notification widget is not company dependent, and there is no way to remove a notification on a record the user can't read.* In case where the record is company dependent and on a different company, we skip the record rules check. It is assumed that the check would fail because or company-related record rules. It will create some unwanted activities, but only the minimal number we can let through while allowing for all legitimate flows. *Better solution for master is to give the user some more explicit message if reading the record, suggesting to switch company, or to allow to dismiss the notification altogether. opw 1933862 closes odoo/odoo#30810 --- addons/mail/models/mail_activity.py | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/addons/mail/models/mail_activity.py b/addons/mail/models/mail_activity.py index 0191541ea1c..4fc05a95e05 100644 --- a/addons/mail/models/mail_activity.py +++ b/addons/mail/models/mail_activity.py @@ -259,6 +259,12 @@ class MailActivity(models.Model): activity.user_id.display_name) else: try: + target_user = activity.user_id + target_record = self.env[activity.res_model].browse(activity.res_id) + if hasattr(target_record, 'company_id') and ( + target_record.company_id != target_user.company_id and ( + len(target_user.company_ids) > 1)): + return # in that case we skip the check, assuming it would fail because of the company model.browse(activity.res_id).check_access_rule('read') except exceptions.AccessError: raise exceptions.UserError(