lase@odoo.com
1160d80da4
Steps to reproduce:
- Activate Subcontracting in the settings.
- Create a storable product
- Create a BOM of type "subcontracting" where the subcontractor is a
Portal user (e.g. Joel Willis) for that product.
- Log out and connect as your portal user.
- Go to the website shop and search your product.
Expected behavior:
The portal user should only be able to see the published products.
Current behavior:
The portal user sees unpublished products for which he is subcontractor.
Cause of the issue:
The commit 99b56ec has introduced a subcontracting portal. In order for
portal users to be able to interact with product templates, the
following rule was added to the "base.group_portal":
https://github.com/odoo/odoo/blame/f0a0d596ab716c96de38a5c0f837da2924338d7b/addons/mrp_subcontracting/security/mrp_subcontracting_security.xml#L120-L131
When you go to the website shop, the records displayed in the shop will
be computed here:
https://github.com/odoo/odoo/blob/1c321cd1fe0aabd9cd92c13cd1eae604e5817ae0/addons/website_sale/controllers/main.py#L348
https://github.com/odoo/odoo/blob/f0a0d596ab716c96de38a5c0f837da2924338d7b/addons/website/models/mixins.py#L353-L357
However, during this call, the "ir.rule" added for portal users will be
added to the SQL query here:
https://github.com/odoo/odoo/blob/1c321cd1fe0aabd9cd92c13cd1eae604e5817ae0/odoo/models.py#L4682
As such, products (enven if unpublished) for which the portal user is a
subcontractor will be fetched and displayed in the shop.
Fix:
Since the "ir.rule" can not be changed only for flows involving the
`website_sale` application, we propose to make a change similar to
commit b1f6171 whose purpose is to hide unpublished products for non
internal users:
https://github.com/odoo/odoo/blob/1c321cd1fe0aabd9cd92c13cd1eae604e5817ae0/addons/website_sale/models/product_template.py#L105-L108
opw-3768845
closes odoo/odoo#160703
X-original-commit: d57db5b6a7ca4579145723139223cab3d8a7dd24
Signed-off-by: Valentin Chevalier <vcr@odoo.com>
Signed-off-by: Lancelot Semal (lase) <lase@odoo.com>
Odoo
Odoo is a suite of web based open source business apps.
The main Odoo Apps include an Open Source CRM, Website Builder, eCommerce, Warehouse Management, Project Management, Billing & Accounting, Point of Sale, Human Resources, Marketing, Manufacturing, ...
Odoo Apps can be used as stand-alone applications, but they also integrate seamlessly so you get a full-featured Open Source ERP when you install several Apps.
Getting started with Odoo
For a standard installation please follow the Setup instructions from the documentation.
To learn the software, we recommend the Odoo eLearning, or Scale-up, the business game. Developers can start with the developer tutorials