From e7d270063fafba60b775d0f9f96024b9fe7aa312 Mon Sep 17 00:00:00 2001 From: "Pedram (pebr)" Date: Mon, 4 Mar 2024 17:01:31 +0100 Subject: [PATCH] [FIX] pos_self_order: prevent multi-company access error Before this commit, if the POS user didn't have access to the first company, an access error would be raised when accessing the self-order page. The steps to reproduce this issue are as follows: 1. Add another company and set up POS self-order. 2. Remove the other company from the Marc user. 3. Open the POS in the new company. 4. Try to access the mobile menu. This would result in an access error. The issue was that the first company existed in the `allowed_company_ids` in the context. To solve this, we need to correctly set the `allowed_company_ids` in the context. opw-3744500 closes odoo/odoo#156357 Signed-off-by: Joseph Caburnay (jcb) --- addons/pos_self_order/controllers/orders.py | 4 ++-- addons/pos_self_order/controllers/self_entry.py | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/addons/pos_self_order/controllers/orders.py b/addons/pos_self_order/controllers/orders.py index ee364c7f4d1..efd145bbbfd 100644 --- a/addons/pos_self_order/controllers/orders.py +++ b/addons/pos_self_order/controllers/orders.py @@ -323,7 +323,7 @@ class PosSelfOrderController(http.Controller): raise Unauthorized("Invalid access token") company = pos_config_sudo.company_id user = pos_config_sudo.current_session_id.user_id or pos_config_sudo.self_ordering_default_user_id - return pos_config_sudo.sudo(False).with_company(company).with_user(user) + return pos_config_sudo.sudo(False).with_company(company).with_user(user).with_context(allowed_company_ids=company.ids) def _verify_authorization(self, access_token, table_identifier, take_away): """ @@ -338,5 +338,5 @@ class PosSelfOrderController(http.Controller): company = pos_config.company_id user = pos_config.current_session_id.user_id or pos_config.self_ordering_default_user_id - table = table_sudo.sudo(False).with_company(company).with_user(user) + table = table_sudo.sudo(False).with_company(company).with_user(user).with_context(allowed_company_ids=company.ids) return pos_config, table diff --git a/addons/pos_self_order/controllers/self_entry.py b/addons/pos_self_order/controllers/self_entry.py index 8145503f511..0741a1beddc 100644 --- a/addons/pos_self_order/controllers/self_entry.py +++ b/addons/pos_self_order/controllers/self_entry.py @@ -27,7 +27,7 @@ class PosSelfKiosk(http.Controller): company = pos_config_sudo.company_id user = pos_config_sudo.current_session_id.user_id or pos_config_sudo.self_ordering_default_user_id - pos_config = pos_config_sudo.sudo(False).with_company(company).with_user(user) + pos_config = pos_config_sudo.sudo(False).with_company(company).with_user(user).with_context(allowed_company_ids=company.ids) if not pos_config: raise werkzeug.exceptions.NotFound()