From cc68eee1c4d9ba79bac86b8df3cc8a808b727e8c Mon Sep 17 00:00:00 2001 From: Adrien Widart Date: Thu, 21 Apr 2022 16:10:50 +0000 Subject: [PATCH] [FIX] sale_{purchase,stock}, stock: decreasing the ordered qty In a MTO case, when a salesman decreases the ordered quantity, it can lead to an access error To reproduce the issue: (Use demo data) 1. In Users, edit Marc Demo: - Invoicing: None - Purchase: None 2. Create a product P: - Type: Storable - Add a vendor V - Routes: - MTO - Buy 3. Log in as Marc Demo 4. Create a sale order SO with 2 x P 5. Confirm SO 6. Edit SO: - Set the qty of P to 1 - ignore the warning 7. Save the SO Error: There is an access error ("create" on "Activity" (mail.activity)) Because the user decreases the quantity, we want to log this decreasing on the related documents: https://github.com/odoo/odoo/blob/ee9ea35ad218be87564de484470f1c4e9c433977/addons/sale_stock/models/sale_order.py#L91-L94 In the above case, it leads to a write operation on the generated purchase order. However, Marc Demo hasn't any right to perform such an operation. We should bypass the rights checking in such situation. Note: in `/sale_stock:SaleOrder.write`: we need to specify what kind of precision we are using. OPW-2745317 closes odoo/odoo#90782 X-original-commit: 525d3e2a7e6679a73de1b1a16f666d015543e5bd Signed-off-by: William Henrotin (whe) Signed-off-by: Adrien Widart --- addons/sale_purchase_stock/tests/__init__.py | 1 + .../tests/test_access_rights.py | 76 +++++++++++++++++++ addons/sale_stock/models/sale_order.py | 7 +- 3 files changed, 82 insertions(+), 2 deletions(-) create mode 100644 addons/sale_purchase_stock/tests/test_access_rights.py diff --git a/addons/sale_purchase_stock/tests/__init__.py b/addons/sale_purchase_stock/tests/__init__.py index ec59b790bc1..54b0c0958fd 100644 --- a/addons/sale_purchase_stock/tests/__init__.py +++ b/addons/sale_purchase_stock/tests/__init__.py @@ -2,3 +2,4 @@ # Part of Odoo. See LICENSE file for full copyright and licensing details. from . import test_sale_purchase_stock_flow +from . import test_access_rights diff --git a/addons/sale_purchase_stock/tests/test_access_rights.py b/addons/sale_purchase_stock/tests/test_access_rights.py new file mode 100644 index 00000000000..fa66f4304b5 --- /dev/null +++ b/addons/sale_purchase_stock/tests/test_access_rights.py @@ -0,0 +1,76 @@ +# -*- coding: utf-8 -*- +# Part of Odoo. See LICENSE file for full copyright and licensing details. + +from odoo.tests import tagged +from odoo.addons.sale_purchase.tests.common import TestCommonSalePurchaseNoChart + + +@tagged('post_install', '-at_install') +class TestAccessRights(TestCommonSalePurchaseNoChart): + + @classmethod + def setUpClass(cls): + super(TestAccessRights, cls).setUpClass() + + group_sale_user = cls.env.ref('sales_team.group_sale_salesman') + + cls.user_salesperson = cls.env['res.users'].with_context(no_reset_password=True).create({ + 'name': 'Le Grand Jojo User', + 'login': 'grand.jojo', + 'email': 'grand.jojo@chansonbelge.com', + 'groups_id': [(6, 0, [group_sale_user.id])] + }) + + def test_access_saleperson_decreases_qty(self): + """ + Suppose a user who has no right on PO + Suppose a PO linked to a SO + The user decreases the qty on the SO + This test ensures that an activity (warning) is added to the PO + """ + mto_route = self.env.ref('stock.route_warehouse0_mto') + buy_route = self.env.ref('purchase_stock.route_warehouse0_buy') + mto_route.active = True + + vendor = self.env['res.partner'].create({'name': 'vendor'}) + seller = self.env['product.supplierinfo'].create({ + 'partner_id': vendor.id, + 'price': 8, + }) + + product = self.env['product.product'].create({ + 'name': 'SuperProduct', + 'type': 'product', + 'seller_ids': [(6, 0, seller.ids)], + 'route_ids': [(6, 0, (mto_route + buy_route).ids)] + }) + + so = self.env['sale.order'].with_user(self.user_salesperson).create({ + 'partner_id': self.partner_a.id, + 'user_id': self.user_salesperson.id, + }) + so_line, _ = self.env['sale.order.line'].create([{ + 'name': product.name, + 'product_id': product.id, + 'product_uom_qty': 1, + 'product_uom': product.uom_id.id, + 'price_unit': product.list_price, + 'tax_id': False, + 'order_id': so.id, + }, { + 'name': 'Super Section', + 'display_type': 'line_section', + 'order_id': so.id, + }]) + + so.action_confirm() + + po = self.env['purchase.order'].search([('partner_id', '=', vendor.id)]) + po.button_confirm() + + # salesperson writes on the SO + so.write({ + 'order_line': [(1, so_line.id, {'product_uom_qty': 0.9})] + }) + + self.assertIn(so.name, po.activity_ids.note) diff --git a/addons/sale_stock/models/sale_order.py b/addons/sale_stock/models/sale_order.py index d379d865ebf..5feaa25a4ad 100644 --- a/addons/sale_stock/models/sale_order.py +++ b/addons/sale_stock/models/sale_order.py @@ -119,13 +119,16 @@ class SaleOrder(models.Model): res = super(SaleOrder, self).write(values) if values.get('order_line') and self.state == 'sale': + rounding = self.env['decimal.precision'].precision_get('Product Unit of Measure') for order in self: to_log = {} for order_line in order.order_line: - if float_compare(order_line.product_uom_qty, pre_order_line_qty.get(order_line, 0.0), order_line.product_uom.rounding) < 0: + if order_line.display_type: + continue + if float_compare(order_line.product_uom_qty, pre_order_line_qty.get(order_line, 0.0), precision_rounding=order_line.product_uom.rounding or rounding) < 0: to_log[order_line] = (order_line.product_uom_qty, pre_order_line_qty.get(order_line, 0.0)) if to_log: - documents = self.env['stock.picking']._log_activity_get_documents(to_log, 'move_ids', 'UP') + documents = self.env['stock.picking'].sudo()._log_activity_get_documents(to_log, 'move_ids', 'UP') documents = {k: v for k, v in documents.items() if k[0].state != 'cancel'} order._log_decrease_ordered_quantity(documents) return res