From e2fdac55f6a66b733f4966d5f8a1d2f2f4fd8796 Mon Sep 17 00:00:00 2001 From: Laurent Smet Date: Thu, 15 Jul 2021 07:49:52 +0000 Subject: [PATCH] [FIX] payment: Fix payment access rights for not admin users MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The journal needs to access the payment acquirers to determine with payment method is still available. Since the acquirers can't be accessed only for admin users, an accountant doesn't any right to read them, and then, an access error was raised when opening the journal form view. Also, the 'payment.acquirer' was accessed from the 'account' module instead of being overridden in 'payment'. closes odoo/odoo#73761 X-original-commit: 7b4580c3756657c902eceb9840984dde76429dcd Signed-off-by: William André (wan) Signed-off-by: Laurent Smet --- addons/account/models/account_payment_method.py | 6 ------ addons/payment/models/account_journal.py | 6 +++--- addons/payment/models/account_payment_method.py | 16 +++++++++++++++- addons/payment/views/account_journal_views.xml | 8 ++++++-- 4 files changed, 24 insertions(+), 12 deletions(-) diff --git a/addons/account/models/account_payment_method.py b/addons/account/models/account_payment_method.py index 7004192e9ca..de907a260e1 100644 --- a/addons/account/models/account_payment_method.py +++ b/addons/account/models/account_payment_method.py @@ -44,7 +44,6 @@ class AccountPaymentMethod(models.Model): self.ensure_one() information = self._get_payment_method_information().get(self.code) - unique = information.get('mode') == 'unique' currency_id = information.get('currency_id') country_id = information.get('country_id') default_domain = [('type', 'in', ('bank', 'cash'))] @@ -59,11 +58,6 @@ class AccountPaymentMethod(models.Model): if country_id: domains += [[('company_id.account_fiscal_country_id', '=', country_id)]] - if unique: - company_ids = self.env['payment.acquirer'].search([('provider', '=', self.code)]).mapped('company_id') - if company_ids: - domains += [[('company_id', 'in', company_ids.ids)]] - return expression.AND(domains) @api.model diff --git a/addons/payment/models/account_journal.py b/addons/payment/models/account_journal.py index c0fcd74ef9c..b4cbeb29d3a 100644 --- a/addons/payment/models/account_journal.py +++ b/addons/payment/models/account_journal.py @@ -30,8 +30,8 @@ class AccountJournal(models.Model): AND acquirer.company_id IN %(company_ids)s ''', {'company_ids': tuple(self.company_id.ids)}) ids = [r[0] for r in self._cr.fetchall()] - acquirers = self.env['payment.acquirer'].browse(ids) - if acquirers: + if ids: + acquirers = self.env['payment.acquirer'].sudo().browse(ids) raise UserError(_("You can't delete a payment method that is linked to an acquirer in the enabled or test state.\n" "Linked acquirer(s): %s", ', '.join(a.display_name for a in acquirers))) @@ -44,7 +44,7 @@ class AccountJournal(models.Model): def _compute_available_payment_method_ids(self): super()._compute_available_payment_method_ids() - installed_acquirers = self.env['payment.acquirer'].search([]) + installed_acquirers = self.env['payment.acquirer'].sudo().search([]) method_information = self.env['account.payment.method']._get_payment_method_information() pay_methods = self.env['account.payment.method'].search([('code', 'in', list(method_information.keys()))]) pay_method_by_code = {x.code + x.payment_type: x for x in pay_methods} diff --git a/addons/payment/models/account_payment_method.py b/addons/payment/models/account_payment_method.py index bfdbf6c4f22..9e24c957f89 100644 --- a/addons/payment/models/account_payment_method.py +++ b/addons/payment/models/account_payment_method.py @@ -2,6 +2,7 @@ # Part of Odoo. See LICENSE file for full copyright and licensing details. from odoo import api, fields, models, _ +from odoo.osv import expression class AccountPaymentMethodLine(models.Model): @@ -18,7 +19,7 @@ class AccountPaymentMethodLine(models.Model): @api.depends('payment_method_id') def _compute_payment_acquirer_id(self): - acquirers = self.env['payment.acquirer'].search([ + acquirers = self.env['payment.acquirer'].sudo().search([ ('provider', 'in', self.mapped('code')), ('company_id', 'in', self.journal_id.company_id.ids), ]) @@ -28,6 +29,19 @@ class AccountPaymentMethodLine(models.Model): company = line.journal_id.company_id line.payment_acquirer_id = acquirers_map.get((code, company), False) + def _get_payment_method_domain(self): + # OVERRIDE + domain = super()._get_payment_method_domain() + information = self._get_payment_method_information().get(self.code) + + unique = information.get('mode') == 'unique' + if unique: + company_ids = self.env['payment.acquirer'].sudo().search([('provider', '=', self.code)]).mapped('company_id') + if company_ids: + domain = expression.AND([domain, [('company_id', 'in', company_ids.ids)]]) + + return domain + def action_open_acquirer_form(self): self.ensure_one() return { diff --git a/addons/payment/views/account_journal_views.xml b/addons/payment/views/account_journal_views.xml index 9b96b8468bf..6d1c3b5970f 100644 --- a/addons/payment/views/account_journal_views.xml +++ b/addons/payment/views/account_journal_views.xml @@ -9,8 +9,12 @@ -