From d5bc0e57cd9288dc7950495c48dd94bca037d9a7 Mon Sep 17 00:00:00 2001
From: XavierDo <xdo@odoo.com>
Date: Mon, 10 Sep 2018 12:44:36 +0200
Subject: [PATCH] [FIX] project: use user right on portal task

The search on project were done as sudo with a domain matching the
"project_task_rule_portal" rule. This commits remove the sudo call
and corresponding domains.

This replace lpe's fix b8fe404e, and user connected to portal to see
his tasks, avoiding an error during crawling tests:

Error use case:
User try to access a task list from /my/projects with a filter on a project.
The project filter does not exist in task list since the rules applied are for
portal user -> an error is raised

Now, project list on /my/projects and the filter available on /my/tasks should
be the same.
---
 addons/project/controllers/portal.py | 31 ++++++++--------------------
 1 file changed, 9 insertions(+), 22 deletions(-)

diff --git a/addons/project/controllers/portal.py b/addons/project/controllers/portal.py
index 1aa89e787f1..aae45fa9805 100644
--- a/addons/project/controllers/portal.py
+++ b/addons/project/controllers/portal.py
@@ -17,12 +17,8 @@ class CustomerPortal(CustomerPortal):
 
     def _prepare_portal_layout_values(self):
         values = super(CustomerPortal, self)._prepare_portal_layout_values()
-        Project = request.env['project.project']
-        Task = request.env['project.task']
-        # portal users can't view projects they don't follow
-        projects = Project.sudo().search([('privacy_visibility', '=', 'portal')])
-        values['project_count'] = Project.search_count([('id', 'in', projects.ids)])
-        values['task_count'] = Task.search_count([('project_id', 'in', projects.ids)])
+        values['project_count'] = request.env['project.project'].search_count([])
+        values['task_count'] = request.env['project.task'].search_count([])
         return values
 
     # ------------------------------------------------------------
@@ -39,7 +35,7 @@ class CustomerPortal(CustomerPortal):
     def portal_my_projects(self, page=1, date_begin=None, date_end=None, sortby=None, **kw):
         values = self._prepare_portal_layout_values()
         Project = request.env['project.project']
-        domain = [('privacy_visibility', '=', 'portal')]
+        domain = []
 
         searchbar_sortings = {
             'date': {'label': _('Newest'), 'order': 'create_date desc'},
@@ -127,20 +123,12 @@ class CustomerPortal(CustomerPortal):
         }
         # extends filterby criteria with project (criteria name is the project id)
         # Note: portal users can't view projects they don't follow
-        partner = request.env.user.partner_id
-        domain_projects = [
-            '&',
-            ('privacy_visibility', '=', 'portal'),
-            '|',
-            ('message_partner_ids', 'child_of', [partner.commercial_partner_id.id]),
-            ('task_ids.message_partner_ids', 'child_of', [partner.commercial_partner_id.id])
-        ]
-
-        projects = request.env['project.project'].sudo().search(domain_projects)
-        domain = [('project_id', 'in', projects.ids)]
-        for proj in projects:
+        project_groups = request.env['project.task'].read_group([], ['project_id'], ['project_id'])
+        for group in project_groups:
+            proj_id = group['project_id'][0] if group['project_id'] else False
+            proj_name = group['project_id'][1] if group['project_id'] else _('Others')
             searchbar_filters.update({
-                str(proj.id): {'label': proj.name, 'domain': [('project_id', '=', proj.id)]}
+                str(proj_id): {'label': proj_name, 'domain': [('project_id', '=', proj_id)]}
             })
 
         # default sort by value
@@ -150,7 +138,7 @@ class CustomerPortal(CustomerPortal):
         # default filter by value
         if not filterby:
             filterby = 'all'
-        domain += searchbar_filters[filterby]['domain']
+        domain = searchbar_filters[filterby]['domain']
 
         # archive groups - Default Group By 'create_date'
         archive_groups = self._get_archive_groups('project.task', domain)
@@ -193,7 +181,6 @@ class CustomerPortal(CustomerPortal):
         values.update({
             'date': date_begin,
             'date_end': date_end,
-            'projects': projects,
             'grouped_tasks': grouped_tasks,
             'page_name': 'task',
             'archive_groups': archive_groups,