Martin Trigaux
604a47ead8
THese are rarely intended for all users but often intended only for employees. account: account.incoterms: only used within internal business models account.journal.group: same as account.journal, add sudo in computed field account_edi: need access to accounting objects base_address_extended: res.city: only employees should access address data board: only employees uses this (old) module crm: crm.stage: internal users business object hr_recruitment: employees can read im_livechat: apply same as for the steps l10n_ar: used on partner, not only invoices l10n_ec: accessed only through account.move l10n_latam: accessed on res.partner mail: publisher.warrenty.contract: no data, only static models mail.channel: group_user has already his own rule mail.group: group_user has already his own rule mail.message.subtype: group_user has already his own rule mail.message.all: remove, already has a portal and employee rule partner_autocomplete: no interaction with public project: project.tags: only needed for project sharing sale_management: sale.order.option: same as sale.order utm: employee already has write access web_editor: test models that have nothing to do here web_tour: only employees uses tours website_sale: product.ribbon: add sudo for access base: ir.default: only employees uses set (could probably be converted to group_system) ir.ui.view.custom: same as ir.ui.view, add sudo when needed report.*: portal users don't configure reports res.users.log: create in sudo, no access needed (adapt test to use another model) res.lang: still needed for public closes odoo/odoo#118701 Related: odoo/enterprise#41285 Signed-off-by: Martin Trigaux (mat) <mat@odoo.com>
24 lines
900 B
Python
24 lines
900 B
Python
# Part of Odoo. See LICENSE file for full copyright and licensing details.
|
|
|
|
from odoo.exceptions import AccessError
|
|
from odoo.http import Controller, route, request
|
|
from odoo.tools.translate import _
|
|
|
|
|
|
class View(Controller):
|
|
|
|
@route('/web/view/edit_custom', type='json', auth="user")
|
|
def edit_custom(self, custom_id, arch):
|
|
"""
|
|
Edit a custom view
|
|
|
|
:param int custom_id: the id of the edited custom view
|
|
:param str arch: the edited arch of the custom view
|
|
:returns: dict with acknowledged operation (result set to True)
|
|
"""
|
|
custom_view = request.env['ir.ui.view.custom'].sudo().browse(custom_id)
|
|
if not custom_view.user_id == request.env.user:
|
|
raise AccessError(_("Custom view %s does not belong to user %s", custom_id, self.env.user.login))
|
|
custom_view.write({'arch': arch})
|
|
return {'result': True}
|