Yolann Sabaux
bece0fb675
Steps to reproduce:
- have a project with a stage having the user_id set to Mitchell Admin (in this scenario you would have to add the field in the view)
- create a task in this stage
- log in with Marc Demo
- Try to open the project
Issue:
There will be an access error
Cause:
The domain allows to fetch all tasks from a project; even those from a prohibited stage
Solution:
- As in d4252825f5, we'll restrict the domain and "hide task stages if user is set".
- Prevent the user to create/modify a record to it with with a `user_id` and `project_ids`
opw-2917631
closes odoo/odoo#101965
X-original-commit: fdaef9276b89e2170128e205a4b7fd0b8defc2b1
Signed-off-by: Laurent Stukkens (ltu) <ltu@odoo.com>
Signed-off-by: Xavier <xbo@odoo.com>
27 lines
883 B
Python
27 lines
883 B
Python
# -*- coding: utf-8 -*-
|
|
|
|
from . import test_access_rights
|
|
from . import test_burndown_chart
|
|
from . import test_project_base
|
|
from . import test_project_config
|
|
from . import test_project_flow
|
|
from . import test_project_milestone
|
|
from . import test_project_profitability
|
|
from . import test_project_recurrence
|
|
from . import test_project_sharing
|
|
from . import test_project_sharing_portal_access
|
|
from . import test_project_sharing_ui
|
|
from . import test_project_subtasks
|
|
from . import test_project_task_type
|
|
from . import test_project_ui
|
|
from . import test_project_update_access_rights
|
|
from . import test_project_update_flow
|
|
from . import test_project_update_ui
|
|
from . import test_portal
|
|
from . import test_multicompany
|
|
from . import test_personal_stages
|
|
from . import test_task_dependencies
|
|
from . import test_task_follow
|
|
from . import test_task_tracking
|
|
from . import test_project_report
|