From d46494006f95e59de4af5307d09e870011abd05d Mon Sep 17 00:00:00 2001 From: "Achraf (abz)" Date: Mon, 11 Jul 2022 07:26:10 +0000 Subject: [PATCH] [FIX] hr: Prevent user to access to activities without rights Steps: - Schedule some activities to `admin` (users with hr officer) - Remove hr rights to `admin` - Log-in with `admin` and click on notification - Click on `Summary` - Traceback If we click on `Summary` a `_search` is executed in `hr.employee` When a user does not have the required rights we will apply `_search` on the fields on `hr.employee.public` instead of `hr.employee.private`. Except that in the case of `activity_ids` this field does not exist in `hr.employee.public` opw-2765032 closes odoo/odoo#95802 X-original-commit: c4a5c63b6141424e31d7a7c8bc6d0c00d58643c0 Signed-off-by: Kevin Baptiste --- addons/hr/i18n/hr.pot | 6 ++++++ addons/hr/models/hr_employee.py | 5 ++++- 2 files changed, 10 insertions(+), 1 deletion(-) diff --git a/addons/hr/i18n/hr.pot b/addons/hr/i18n/hr.pot index 09fb0c7b354..f485defd585 100644 --- a/addons/hr/i18n/hr.pot +++ b/addons/hr/i18n/hr.pot @@ -2568,6 +2568,12 @@ msgstr "" msgid "You cannot create recursive departments." msgstr "" +#. module: hr +#: code:addons/hr/models/hr_employee.py:0 +#, python-format +msgid "You do not have access to this document." +msgstr "" + #. module: hr #: code:addons/hr/models/res_config_settings.py:0 #, python-format diff --git a/addons/hr/models/hr_employee.py b/addons/hr/models/hr_employee.py index 5978a2ac7de..2f7166f3c93 100644 --- a/addons/hr/models/hr_employee.py +++ b/addons/hr/models/hr_employee.py @@ -238,7 +238,10 @@ class HrEmployeePrivate(models.Model): """ if self.check_access_rights('read', raise_exception=False): return super(HrEmployeePrivate, self)._search(args, offset=offset, limit=limit, order=order, count=count, access_rights_uid=access_rights_uid) - ids = self.env['hr.employee.public']._search(args, offset=offset, limit=limit, order=order, count=count, access_rights_uid=access_rights_uid) + try: + ids = self.env['hr.employee.public']._search(args, offset=offset, limit=limit, order=order, count=count, access_rights_uid=access_rights_uid) + except ValueError: + raise AccessError(_('You do not have access to this document.')) if not count and isinstance(ids, Query): # the result is expected from this table, so we should link tables ids = super(HrEmployeePrivate, self.sudo())._search([('id', 'in', ids)])