[FIX] project: set as favorite

- Connect as a user with only 'User' rights on projects
- Set a project as favorite (click the star)

The project is not set as favorite.

Since only project managers are allowed to write on projects, the field
`is_favorite` is set as read-only. Therefore, it is filtered out by
`_generateChanges`, and nothing happens.

First step is to set the attribute `force_save` in the view, so the RPC
`write` call is forced. Second step is to compute directly the inverse
thus bypassing access rights.

Co-authored-by: Nicolas Lempereur <nle@odoo.com>
opw-814604
opw-801587
closes #22938

addons/project/models/project.py

@@ -262,7 +262,11 @@ class Project(models.Model):
 
     @api.multi
     def write(self, vals):
-        res = super(Project, self).write(vals)
+        # directly compute is_favorite to dodge allow write access right
+        if 'is_favorite' in vals:
+            vals.pop('is_favorite')
+            self._fields['is_favorite'].determine_inverse(self)
+        res = super(Project, self).write(vals) if vals else True
         if 'active' in vals:
             # archiving/unarchiving a project does it on its tasks, too
             self.with_context(active_test=False).mapped('tasks').write({'active': vals['active']})

addons/project/tests/test_access_rights.py

@@ -52,6 +52,15 @@ class TestPortalProject(TestPortalProjectBase):
             'project_id': pigs.id})
         tmp_task.sudo(self.user_projectuser).unlink()
 
+    @mute_logger('odoo.addons.base.ir.ir_model')
+    def test_favorite_project_access_rights(self):
+        pigs = self.project_pigs.sudo(self.user_projectuser)
+
+        # we can't write on project name
+        self.assertRaises(AccessError, pigs.write, {'name': 'False Pigs'})
+        # we can write on is_favorite
+        pigs.write({'is_favorite': True})
+
     @mute_logger('odoo.addons.base.ir.ir_model')
     def test_followers_project_access_rights(self):
         pigs = self.project_pigs

addons/project/views/project_views.xml

@@ -321,7 +321,7 @@
                                         </div>
                                     </div>
                                     <a class="o_kanban_manage_toggle_button o_left" href="#" groups="project.group_project_manager"><i class="fa fa-ellipsis-v" /></a>
-                                    <span class="o_right"><field name="is_favorite" widget="boolean_favorite" nolabel="1" /></span>
+                                    <span class="o_right"><field name="is_favorite" widget="boolean_favorite" nolabel="1" force_save="1" /></span>
                                 </div>
 
                                 <div class="o_project_kanban_boxes">