From 2031e5e91c2c19797d3df8ee527d546a8b1a3ed9 Mon Sep 17 00:00:00 2001
From: Benoit Socias <bso@odoo.com>
Date: Wed, 30 Aug 2023 08:55:59 +0200
Subject: [PATCH] [FIX] website: get the name of the visitor through the
related field
Since [1] if the partner related to a visitor belongs to a company that
cannot be accessed by the current user, an error is raised when trying
to display the list of visitors.
This commit makes the name obtained through an additional sudo on the
`partner_id` record which might not be accessible to the current user.
This is equivalent to using the `name` field of visitor, except that
accessing the `partner_id` field will fail if `website.visitor` itself
cannot be accessed.
Steps to reproduce:
- Go to Settings / Companies
- Create a second company
- Go to Website / Reporting / Visitors
- Select "Edwin Hansen"
- Navigate to its linked partner in the contact field
"Gemini Furniture, Edwin Hansen"
- Navigate to its company "Gemini Furniture"
- In the "Sales & Purchase" tab, assign the second company as the
Company
- Save (this creates an error - but it is saved)
- Go to Website / Reporting / Visitors
=> The page was not displayed and an access error message was
displayed.
[1]: https://github.com/odoo/odoo/commit/d348bed1ad9d3d16b295f013f015706be6c07820
opw-3462104
closes odoo/odoo#133553
Signed-off-by: Romain Derie (rde) <rde@odoo.com>
---
addons/website/models/website_visitor.py | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/addons/website/models/website_visitor.py b/addons/website/models/website_visitor.py
index 6f7babe60c38..1bc1d693037f 100644
--- a/addons/website/models/website_visitor.py
+++ b/addons/website/models/website_visitor.py
@@ -87,9 +87,11 @@ class WebsiteVisitor(models.Model):
def name_get(self):
res = []
for record in self:
+ # Accessing name of partner through sudo to avoid infringing
+ # record rule if partner belongs to another company.
res.append((
record.id,
- record.partner_id.name or _('Website Visitor #%s', record.id)
+ record.partner_id.sudo().name or _('Website Visitor #%s', record.id)
))
return res
--
GitLab