From 8a57e84a320f3ea8d867aa850d357a89c91af09a Mon Sep 17 00:00:00 2001
From: "Andrea Grazioso (agr-odoo)" <agr@odoo.com>
Date: Thu, 30 Apr 2020 14:40:42 +0000
Subject: [PATCH] [FIX] sale_timesheet: fix user permission to set sale order
Create a service product [DEMO] with service tracking
'Create a task in a new project'
Create a sale order SO1 with User 1 with [DEMO] product
Create a sale order SO2 with User 2 with [DEMO] product
SO1 will create a task in a project, edit this task and
assign as parent task the one created by SO2
The action will be blocked by security rules, because user 1 cannnot
see the sale order data of user 2 but the action should be
allowed.
Fixing the error with a sudo call
opw-2243370
closes odoo/odoo#50585
X-original-commit: 8c7d0266cc6d7bd0569721e92128096e64d9c361
Signed-off-by: Nicolas Martinelli (nim) <nim@odoo.com>
---
addons/sale_timesheet/models/project.py | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/addons/sale_timesheet/models/project.py b/addons/sale_timesheet/models/project.py
index a50ecc7afbdc..97ea7d7335e2 100644
--- a/addons/sale_timesheet/models/project.py
+++ b/addons/sale_timesheet/models/project.py
@@ -226,7 +226,7 @@ class ProjectTask(models.Model):
def _compute_sale_order_id(self):
for task in self:
if task.billable_type == 'task_rate':
- task.sale_order_id = task.sale_line_id.order_id or task.project_id.sale_order_id
+ task.sale_order_id = task.sale_line_id.sudo().order_id or task.project_id.sale_order_id
elif task.billable_type == 'employee_rate':
task.sale_order_id = task.project_id.sale_order_id
elif task.billable_type == 'no':
--
GitLab