From e7dcf6ac30d9e5a11b00aef76dbc2ccd73fbf88a Mon Sep 17 00:00:00 2001 From: Toufik Ben Jaa Date: Wed, 15 Jul 2020 11:44:03 +0000 Subject: [PATCH] [FIX] hr_timesheet: allow leaves to be modified - The HR staff may not be able to accept/refuse/cancel leaves if the module `project_timesheet_holidays` is installed. This is due to the commit c9da1571498ad1ded6b16d1483b8cb084d71f9de introducing a manual check on the current user's group without checking if the current environment is in superuser mode. - Also fix the test verifying the access restriction, which meant to use a different user, but did that with sudo(), obviously defeating the fix. sudo is not used to switch user anymore, that `with_user`. closes odoo/odoo#55274 X-original-commit: 75a166f1d115cc712bb39e7711d0fcb173732650 Related: odoo/enterprise#12149 Signed-off-by: Olivier Dony (odo) --- addons/hr_timesheet/models/hr_timesheet.py | 2 +- addons/hr_timesheet/tests/test_timesheet.py | 5 ++--- 2 files changed, 3 insertions(+), 4 deletions(-) diff --git a/addons/hr_timesheet/models/hr_timesheet.py b/addons/hr_timesheet/models/hr_timesheet.py index 50fd2bce355..bd4338673c1 100644 --- a/addons/hr_timesheet/models/hr_timesheet.py +++ b/addons/hr_timesheet/models/hr_timesheet.py @@ -94,7 +94,7 @@ class AccountAnalyticLine(models.Model): def write(self, values): # If it's a basic user then check if the timesheet is his own. - if not self.user_has_groups('hr_timesheet.group_hr_timesheet_approver') and any(self.env.user.id != analytic_line.user_id.id for analytic_line in self): + if not (self.user_has_groups('hr_timesheet.group_hr_timesheet_approver') or self.env.su) and any(self.env.user.id != analytic_line.user_id.id for analytic_line in self): raise AccessError(_("You cannot access timesheets that are not yours.")) values = self._timesheet_preprocess(values) diff --git a/addons/hr_timesheet/tests/test_timesheet.py b/addons/hr_timesheet/tests/test_timesheet.py index 64e7f13d2af..4113b052ea0 100644 --- a/addons/hr_timesheet/tests/test_timesheet.py +++ b/addons/hr_timesheet/tests/test_timesheet.py @@ -267,10 +267,9 @@ class TestTimesheet(TestCommonTimesheet): }) timesheets = timesheet_1 + timesheet_2 - # increase unit_amount to trigger amount recomputation with self.assertRaises(AccessError): - # because the employee 1 is the sudo and he doesn't have the access right to update timesheet of employee 2 - timesheets.sudo().write({ + # should raise since employee 1 doesn't have the access rights to update employee's 2 timesheet + timesheets.with_user(self.empl_employee.user_id).write({ 'unit_amount': 2, })