Xavier-Do
e9b62b47dc
Some of the non canononical timezones are not present in Ubuntu Noble, it would be a better practice to only use canonical timezones in data and tests. Note that this is not a real fix for all cases since the database that ran on Ubuntu Jammy and are moved to an ubuntu Noble server will have the issue with timezones already in database. One of the possible fix would be to manage that during upgrades, but this isn't a verry flexible solution since upgrade are meant to manage chyange of version, not change of server. If an old 17.0 versions needs to be moved to a Noble server, this won't work. Another solution would be to install package like tzdata-legacy that may keep the old timezones but it is not the only think since TAI-10 are also in this package. This solution is not ideal because non canonical timezone will still be shown in the dropdown. We would need to filter them. A last solution would be to add the support for those old timezones by monkeypatching the lib. This way, only new timezones would be shown but non canonical one won't crash when used. This is not ideal either because we may need to keep this for a while. But in combination with the upgrade solution, it may work proprely. Part-of: odoo/odoo#160842
233 lines
11 KiB
Python
233 lines
11 KiB
Python
# -*- coding: utf-8 -*-
|
|
# Part of Odoo. See LICENSE file for full copyright and licensing details.
|
|
|
|
from collections import OrderedDict
|
|
from itertools import chain
|
|
from lxml import etree
|
|
|
|
from odoo.addons.hr.tests.common import TestHrCommon
|
|
from odoo.tests import new_test_user, tagged, Form
|
|
from odoo.exceptions import AccessError
|
|
|
|
@tagged('post_install', '-at_install')
|
|
class TestSelfAccessProfile(TestHrCommon):
|
|
|
|
def test_access_my_profile(self):
|
|
""" A simple user should be able to read all fields in his profile """
|
|
james = new_test_user(self.env, login='hel', groups='base.group_user', name='Simple employee', email='ric@example.com')
|
|
james = james.with_user(james)
|
|
self.env['hr.employee'].create({
|
|
'name': 'James',
|
|
'user_id': james.id,
|
|
})
|
|
view = self.env.ref('hr.res_users_view_form_profile')
|
|
view_infos = james.get_view(view.id)
|
|
fields = [el.get('name') for el in etree.fromstring(view_infos['arch']).xpath('//field[not(ancestor::field)]')]
|
|
james.read(fields)
|
|
|
|
def test_readonly_fields(self):
|
|
""" Employee related fields should be readonly if self editing is not allowed """
|
|
self.env['ir.config_parameter'].sudo().set_param('hr.hr_employee_self_edit', False)
|
|
james = new_test_user(self.env, login='hel', groups='base.group_user', name='Simple employee', email='ric@example.com')
|
|
james = james.with_user(james)
|
|
self.env['hr.employee'].create({
|
|
'name': 'James',
|
|
'user_id': james.id,
|
|
})
|
|
|
|
view = self.env.ref('hr.res_users_view_form_profile')
|
|
fields = james._fields
|
|
view_infos = james.get_view(view.id)
|
|
employee_related_fields = {
|
|
el.get('name')
|
|
for el in etree.fromstring(view_infos['arch']).xpath('//field[not(ancestor::field)]')
|
|
if fields[el.get('name')].related and fields[el.get('name')].related.split('.')[0] == 'employee_id'
|
|
}
|
|
|
|
form = Form(james, view=view)
|
|
for field in employee_related_fields:
|
|
with self.assertRaises(AssertionError, msg="Field '%s' should be readonly in the employee profile when self editing is not allowed." % field):
|
|
form.__setattr__(field, 'some value')
|
|
|
|
|
|
def test_profile_view_fields(self):
|
|
""" A simple user should see all fields in profile view, even if they are protected by groups """
|
|
view = self.env.ref('hr.res_users_view_form_profile')
|
|
|
|
# For reference, check the view with user with every groups protecting user fields
|
|
all_groups_xml_ids = chain(*[
|
|
field.groups.split(',')
|
|
for field in self.env['res.users']._fields.values()
|
|
if field.groups
|
|
if field.groups != '.' # "no-access" group on purpose
|
|
])
|
|
all_groups = self.env['res.groups']
|
|
for xml_id in all_groups_xml_ids:
|
|
all_groups |= self.env.ref(xml_id.strip())
|
|
user_all_groups = new_test_user(self.env, groups='base.group_user', login='hel', name='God')
|
|
user_all_groups.write({'groups_id': [(4, group.id, False) for group in all_groups]})
|
|
view_infos = self.env['res.users'].with_user(user_all_groups).get_view(view.id)
|
|
full_fields = [el.get('name') for el in etree.fromstring(view_infos['arch']).xpath('//field[not(ancestor::field)]')]
|
|
|
|
# Now check the view for a simple user
|
|
user = new_test_user(self.env, login='gro', name='Grouillot')
|
|
view_infos = self.env['res.users'].with_user(user).get_view(view.id)
|
|
fields = [el.get('name') for el in etree.fromstring(view_infos['arch']).xpath('//field[not(ancestor::field)]')]
|
|
|
|
# Compare both
|
|
self.assertEqual(full_fields, fields, "View fields should not depend on user's groups")
|
|
|
|
def test_access_my_profile_toolbar(self):
|
|
""" A simple user shouldn't have the possibilities to see the 'Change Password' action"""
|
|
james = new_test_user(self.env, login='jam', groups='base.group_user', name='Simple employee', email='jam@example.com')
|
|
james = james.with_user(james)
|
|
self.env['hr.employee'].create({
|
|
'name': 'James',
|
|
'user_id': james.id,
|
|
})
|
|
view = self.env.ref('hr.res_users_view_form_profile')
|
|
available_actions = james.get_views([(view.id, 'form')], {'toolbar': True})['views']['form']['toolbar']['action']
|
|
change_password_action = self.env.ref("base.change_password_wizard_action")
|
|
|
|
self.assertFalse(any(x['id'] == change_password_action.id for x in available_actions))
|
|
|
|
# An ERP manager should have the possibilities to see the 'Change Password'
|
|
john = new_test_user(self.env, login='joh', groups='base.group_erp_manager', name='ERP Manager', email='joh@example.com')
|
|
john = john.with_user(john)
|
|
self.env['hr.employee'].create({
|
|
'name': 'John',
|
|
'user_id': john.id,
|
|
})
|
|
view = self.env.ref('hr.res_users_view_form_profile')
|
|
available_actions = john.get_views([(view.id, 'form')], {'toolbar': True})['views']['form']['toolbar']['action']
|
|
self.assertTrue(any(x['id'] == change_password_action.id for x in available_actions))
|
|
|
|
|
|
class TestSelfAccessRights(TestHrCommon):
|
|
|
|
@classmethod
|
|
def setUpClass(cls):
|
|
super(TestSelfAccessRights, cls).setUpClass()
|
|
cls.richard = new_test_user(cls.env, login='ric', groups='base.group_user', name='Simple employee', email='ric@example.com')
|
|
cls.richard_emp = cls.env['hr.employee'].create({
|
|
'name': 'Richard',
|
|
'user_id': cls.richard.id,
|
|
'private_phone': '21454',
|
|
})
|
|
cls.hubert = new_test_user(cls.env, login='hub', groups='base.group_user', name='Simple employee', email='hub@example.com')
|
|
cls.hubert_emp = cls.env['hr.employee'].create({
|
|
'name': 'Hubert',
|
|
'user_id': cls.hubert.id,
|
|
})
|
|
|
|
cls.protected_fields_emp = OrderedDict([(k, v) for k, v in cls.env['hr.employee']._fields.items() if v.groups == 'hr.group_hr_user'])
|
|
# Compute fields and id field are always readable by everyone
|
|
cls.read_protected_fields_emp = OrderedDict([(k, v) for k, v in cls.env['hr.employee']._fields.items() if not v.compute and k != 'id'])
|
|
cls.self_protected_fields_user = OrderedDict([
|
|
(k, v)
|
|
for k, v in cls.env['res.users']._fields.items()
|
|
if v.groups == 'hr.group_hr_user' and k in cls.env['res.users'].SELF_READABLE_FIELDS
|
|
])
|
|
|
|
# Read hr.employee #
|
|
def testReadSelfEmployee(self):
|
|
with self.assertRaises(AccessError):
|
|
self.hubert_emp.with_user(self.richard).read(self.protected_fields_emp.keys())
|
|
|
|
def testReadOtherEmployee(self):
|
|
with self.assertRaises(AccessError):
|
|
self.hubert_emp.with_user(self.richard).read(self.protected_fields_emp.keys())
|
|
|
|
# Write hr.employee #
|
|
def testWriteSelfEmployee(self):
|
|
for f in self.protected_fields_emp:
|
|
with self.assertRaises(AccessError):
|
|
self.richard_emp.with_user(self.richard).write({f: 'dummy'})
|
|
|
|
def testWriteOtherEmployee(self):
|
|
for f in self.protected_fields_emp:
|
|
with self.assertRaises(AccessError):
|
|
self.hubert_emp.with_user(self.richard).write({f: 'dummy'})
|
|
|
|
# Read res.users #
|
|
def testReadSelfUserEmployee(self):
|
|
for f in self.self_protected_fields_user:
|
|
self.richard.with_user(self.richard).read([f]) # should not raise
|
|
|
|
def testReadOtherUserEmployee(self):
|
|
with self.assertRaises(AccessError):
|
|
self.hubert.with_user(self.richard).read(self.self_protected_fields_user)
|
|
|
|
# Write res.users #
|
|
def testWriteSelfUserEmployeeSettingFalse(self):
|
|
for f, v in self.self_protected_fields_user.items():
|
|
with self.assertRaises(AccessError):
|
|
self.richard.with_user(self.richard).write({f: 'dummy'})
|
|
|
|
def testWriteSelfUserEmployee(self):
|
|
self.env['ir.config_parameter'].set_param('hr.hr_employee_self_edit', True)
|
|
for f, v in self.self_protected_fields_user.items():
|
|
val = None
|
|
if v.type == 'char' or v.type == 'text':
|
|
val = '0000' if f == 'pin' else 'dummy'
|
|
if val is not None:
|
|
self.richard.with_user(self.richard).write({f: val})
|
|
|
|
def testWriteSelfUserPreferencesEmployee(self):
|
|
# self should always be able to update non hr.employee fields if
|
|
# they are in SELF_READABLE_FIELDS
|
|
self.env['ir.config_parameter'].set_param('hr.hr_employee_self_edit', False)
|
|
# should not raise
|
|
vals = [
|
|
{'tz': "Australia/Sydney"},
|
|
{'email': "new@example.com"},
|
|
{'signature': "<p>I'm Richard!</p>"},
|
|
{'notification_type': "email"},
|
|
]
|
|
for v in vals:
|
|
# should not raise
|
|
self.richard.with_user(self.richard).write(v)
|
|
|
|
def testWriteOtherUserPreferencesEmployee(self):
|
|
# self should always be able to update non hr.employee fields if
|
|
# they are in SELF_READABLE_FIELDS
|
|
self.env['ir.config_parameter'].set_param('hr.hr_employee_self_edit', False)
|
|
vals = [
|
|
{'tz': "Australia/Sydney"},
|
|
{'email': "new@example.com"},
|
|
{'signature': "<p>I'm Richard!</p>"},
|
|
{'notification_type': "email"},
|
|
]
|
|
for v in vals:
|
|
with self.assertRaises(AccessError):
|
|
self.hubert.with_user(self.richard).write(v)
|
|
|
|
def testWriteSelfPhoneEmployee(self):
|
|
# phone is a related from res.partner (from base) but added in SELF_READABLE_FIELDS
|
|
self.env['ir.config_parameter'].set_param('hr.hr_employee_self_edit', False)
|
|
with self.assertRaises(AccessError):
|
|
self.richard.with_user(self.richard).write({'phone': '2154545'})
|
|
|
|
def testWriteOtherUserEmployee(self):
|
|
for f in self.self_protected_fields_user:
|
|
with self.assertRaises(AccessError):
|
|
self.hubert.with_user(self.richard).write({f: 'dummy'})
|
|
|
|
def testSearchUserEMployee(self):
|
|
# Searching user based on employee_id field should not raise bad query error
|
|
self.env['res.users'].with_user(self.richard).search([('employee_id', 'ilike', 'Hubert')])
|
|
|
|
def test_onchange_readable_fields_with_no_access(self):
|
|
"""
|
|
The purpose is to test that the onchange logic takes into account `SELF_READABLE_FIELDS`.
|
|
|
|
The view contains fields that are in `SELF_READABLE_FIELDS` (example: `private_street`).
|
|
Even if the user does not have read access to the employee,
|
|
it should not cause an access error if these fields are in `SELF_READABLE_FIELDS`.
|
|
"""
|
|
self.env['res.lang']._activate_lang("fr_FR")
|
|
with Form(self.richard.with_user(self.richard), view='hr.res_users_view_form_profile') as form:
|
|
# triggering an onchange should not trigger some access error
|
|
form.lang = "fr_FR"
|
|
form.tz = "Europe/Brussels"
|