pengyuthon/odoo_source
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[FIX] account: do not show payment data to non-billing users

Browse Source 
Users will generally not have the right to read Journal Items unless
they are members of one of the Accounting/Invoicing groups.

Removing the payment-related fields & widgets from the view should let
those users view relevant customer invoices (e.g. for Salesmen) without
getting an AccessError, due to the underlying access to Journal Items.
This commit is contained in:
Olivier Dony
2017-08-23 03:03:49 +02:00
parent 2850612d37
commit dbdf994df8
2 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
addons/account/models/account_invoice.py
+3 -3
View File
@@ -321,9 +321,9 @@ class AccountInvoice(models.Model):
related='partner_id.commercial_partner_id', store=True, readonly=True,
help="The commercial entity that will be used on Journal Entries for this invoice")
outstanding_credits_debits_widget = fields.Text(compute='_get_outstanding_info_JSON')
payments_widget = fields.Text(compute='_get_payment_info_JSON')
has_outstanding = fields.Boolean(compute='_get_outstanding_info_JSON')
outstanding_credits_debits_widget = fields.Text(compute='_get_outstanding_info_JSON', groups="account.group_account_invoice")
payments_widget = fields.Text(compute='_get_payment_info_JSON', groups="account.group_account_invoice")
has_outstanding = fields.Boolean(compute='_get_outstanding_info_JSON', groups="account.group_account_invoice")
_sql_constraints = [
('number_uniq', 'unique(number, company_id, journal_id, type)', 'Invoice Number must be unique per Company!'),
addons/account/views/account_invoice_view.xml
+2 -2
View File
@@ -224,7 +224,7 @@
<button name="action_invoice_draft" states="cancel" string="Set to Draft" type="object" groups="account.group_account_invoice"/>
<field name="state" widget="statusbar" statusbar_visible="draft,open,paid" />
</header>
<div class="alert alert-info" role="alert" style="margin-bottom:0px;" attrs="{'invisible': [('has_outstanding','=',False)]}">
<div groups="account.group_account_invoice" class="alert alert-info" role="alert" style="margin-bottom:0px;" attrs="{'invisible': [('has_outstanding','=',False)]}">
You have <bold><a class="alert-link" href="#outstanding" role="button">outstanding debits</a></bold> for this supplier. You can allocate them to mark this bill as paid.
</div>
<field name="has_outstanding" invisible="1"/>
@@ -359,7 +359,7 @@
<button name="action_invoice_draft" states="cancel" string="Reset to Draft" type="object" groups="account.group_account_invoice"/>
<field name="state" widget="statusbar" nolabel="1" statusbar_visible="draft,open,paid"/>
</header>
<div class="alert alert-info" role="alert" style="margin-bottom:0px;" attrs="{'invisible': [('has_outstanding','=',False)]}">
<div groups="account.group_account_invoice" class="alert alert-info" role="alert" style="margin-bottom:0px;" attrs="{'invisible': [('has_outstanding','=',False)]}">
You have <bold><a class="alert-link" href="#outstanding" role="button">outstanding payments</a></bold> for this customer. You can allocate them to mark this invoice as paid.
</div>
<field name="has_outstanding" invisible="1"/>