Files
odoo_source/addons/board/controllers/main.py
T
Adrien Widart 24071ff94a [FIX] board: user can add to his dashboard
A user without admin access cannot add any views to his dashboard

To reproduce the error:
1. Connect using an account without admin rights
2. Go to CRM (for instance)
3. Favorites > Add to my dashboard
4. Set name & Save

=> An AccessError is raised

A user should be able to add some views to his dashboard.

OPW-2382713

closes odoo/odoo#62034

X-original-commit: a2d2006f24f56e16007a62cdec5af32a03f5552a
Signed-off-by: adwid <adwid@users.noreply.github.com>
2020-11-19 16:28:21 +00:00

41 lines
1.7 KiB
Python

# -*- coding: utf-8 -*-
# Part of Odoo. See LICENSE file for full copyright and licensing details.
from lxml import etree as ElementTree
from odoo.http import Controller, route, request
class Board(Controller):
@route('/board/add_to_dashboard', type='json', auth='user')
def add_to_dashboard(self, action_id, context_to_save, domain, view_mode, name=''):
# Retrieve the 'My Dashboard' action from its xmlid
action = request.env.ref('board.open_board_my_dash_action').sudo()
if action and action['res_model'] == 'board.board' and action['views'][0][1] == 'form' and action_id:
# Maybe should check the content instead of model board.board ?
view_id = action['views'][0][0]
board = request.env['board.board'].fields_view_get(view_id, 'form')
if board and 'arch' in board:
xml = ElementTree.fromstring(board['arch'])
column = xml.find('./board/column')
if column is not None:
new_action = ElementTree.Element('action', {
'name': str(action_id),
'string': name,
'view_mode': view_mode,
'context': str(context_to_save),
'domain': str(domain)
})
column.insert(0, new_action)
arch = ElementTree.tostring(xml, encoding='unicode')
request.env['ir.ui.view.custom'].create({
'user_id': request.session.uid,
'ref_id': view_id,
'arch': arch
})
return True
return False