Martin TrigauxandXavier Morel
49838338e0
The open_action_with_context was not using _for_xml_id, producing an error when reading the action content. In open_action, the action_name was taken from the context and needs sanity checks. Ensure only actions from the account module can be read and only if the user has access to the target model. This is a limitation of the previous behaviour but, at the moment, all known calls are made refering to an action from the account module. Limit the scope of this method while the 14.0 is still early to avoid having a door open to ready any action, and difficult to close later. Remove old action fetching from the context in create_move that is no longer used. closes odoo/odoo#61602 X-original-commit: a39e94f7e4dc74e850650ac90bbc5f85af130bc8 Related: odoo/enterprise#14695 Signed-off-by: Martin Trigaux (mat) <mat@odoo.com> Co-authored-by: Xavier Morel <xmo@odoo.com>
45 lines
2.0 KiB
Python
45 lines
2.0 KiB
Python
# -*- coding: utf-8 -*-
|
|
# Part of Odoo. See LICENSE file for full copyright and licensing details.
|
|
|
|
from odoo import api, models
|
|
from odoo.tools.misc import formatLang
|
|
|
|
|
|
class AccountJournal(models.Model):
|
|
_inherit = "account.journal"
|
|
|
|
def _get_expenses_to_pay_query(self):
|
|
"""
|
|
Returns a tuple containing as it's first element the SQL query used to
|
|
gather the expenses in reported state data, and the arguments
|
|
dictionary to use to run it as it's second.
|
|
"""
|
|
query = """SELECT total_amount as amount_total, currency_id AS currency
|
|
FROM hr_expense_sheet
|
|
WHERE state IN ('approve', 'post')
|
|
and journal_id = %(journal_id)s"""
|
|
return (query, {'journal_id': self.id})
|
|
|
|
def get_journal_dashboard_datas(self):
|
|
res = super(AccountJournal, self).get_journal_dashboard_datas()
|
|
#add the number and sum of expenses to pay to the json defining the accounting dashboard data
|
|
(query, query_args) = self._get_expenses_to_pay_query()
|
|
self.env.cr.execute(query, query_args)
|
|
query_results_to_pay = self.env.cr.dictfetchall()
|
|
(number_to_pay, sum_to_pay) = self._count_results_and_sum_amounts(query_results_to_pay, self.company_id.currency_id)
|
|
res['number_expenses_to_pay'] = number_to_pay
|
|
res['sum_expenses_to_pay'] = formatLang(self.env, sum_to_pay or 0.0, currency_obj=self.currency_id or self.company_id.currency_id)
|
|
return res
|
|
|
|
def open_expenses_action(self):
|
|
action = self.env['ir.actions.act_window']._for_xml_id('hr_expense.action_hr_expense_sheet_all_all')
|
|
action['context'] = {
|
|
'search_default_approved': 1,
|
|
'search_default_to_post': 1,
|
|
'search_default_journal_id': self.id,
|
|
'default_journal_id': self.id,
|
|
}
|
|
action['view_mode'] = 'tree,form'
|
|
action['views'] = [(k,v) for k,v in action['views'] if v in ['tree', 'form']]
|
|
return action
|