From cadb7e0bfddf90d9b97b7c45d96010759495e8d2 Mon Sep 17 00:00:00 2001 From: Goffin Simon Date: Thu, 24 Nov 2016 13:52:16 +0100 Subject: [PATCH] [FIX] base: writing on is_company field The commercial_partner_id field on "account.invoice" is a stored related field to commercial_partner_id on res.partner and this field is recomputed when changing the is_company field (by the function _commercial_partner_store_triggers). So when changing the "is_company" field, the commercial_partner_id is recomputed and a write is made on each account.invoice linked to the commercial_partner_id. To avoid access rights problem on account.invoice, the write on "is_company" must be done in SUPERUSER. opw:694687 --- openerp/addons/base/res/res_partner.py | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/openerp/addons/base/res/res_partner.py b/openerp/addons/base/res/res_partner.py index 7a55dee0535..4995c13b975 100644 --- a/openerp/addons/base/res/res_partner.py +++ b/openerp/addons/base/res/res_partner.py @@ -9,7 +9,7 @@ import threading import urlparse import openerp -from openerp import tools, api +from openerp import tools, api, SUPERUSER_ID from openerp.osv import osv, fields from openerp.osv.expression import get_unaccent_wrapper from openerp.tools.translate import _ @@ -506,8 +506,12 @@ class res_partner(osv.Model, format_address): elif 'is_company' in vals: vals['company_type'] = is_company and 'company' or 'person' tools.image_resize_images(vals) - - result = super(res_partner, self).write(vals) + result = True + #To write in SUPERUSER on field is_company and avoid access rights problems. + if 'is_company' in vals and self.user_has_groups('base.group_partner_manager') and not self.env.uid == SUPERUSER_ID: + result = super(res_partner, self).sudo().write({'is_company': vals.get('is_company')}) + del vals['is_company'] + result = result and super(res_partner, self).write(vals) for partner in self: if any(u.has_group('base.group_user') for u in partner.user_ids if u != self.env.user): self.env['res.users'].check_access_rights('write')