odoo
/
odoo
2
0
Fork 0
Code Pull Requests Releases Activity

[IMP] crm,project,hr: fix group_by_full implementation to respect access_right_uid 

This helps avoid access right issues in restricted
contexts, such as embedded web client, or shared
access (via portal or share wizard).

bzr revid: odo@openerp.com-20111123133132-22g2mqzupuysbyqq
This commit is contained in:
Olivier Dony 2011-11-23 14:31:32 +01:00
parent 7f7f00a52f
commit 21e3b1c5db
3 changed files with 19 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
addons/crm/crm_lead.py
View File

@ -42,14 +42,16 @@ class crm_lead(crm_case, osv.osv):
_order = "priority,date_action,id desc"
_inherit = ['mail.thread','res.partner.address']
def _read_group_stage_ids(self, cr, uid, ids, domain, read_group_order=None, context=None):
def _read_group_stage_ids(self, cr, uid, ids, domain, read_group_order=None, access_rights_uid=None, context=None):
access_rights_uid = access_rights_uid or uid
stage_obj = self.pool.get('crm.case.stage')
order = stage_obj._order
if read_group_order == 'stage_id desc':
# lame hack to allow reverting search, should just work in the trivial case
order = "%s desc" % order
stage_ids = stage_obj.search(cr, uid, ['|', ('id','in',ids),('case_default','=',1)], order=order, context=context)
result = stage_obj.name_get(cr, uid, stage_ids, context=context)
stage_ids = stage_obj._search(cr, uid, ['|', ('id','in',ids),('case_default','=',1)], order=order,
access_rights_uid=access_rights_uid, context=context)
result = stage_obj.name_get(cr, access_rights_uid, stage_ids, context=context)
# restore order of the search
result.sort(lambda x,y: cmp(stage_ids.index(x[0]), stage_ids.index(y[0])))
return result

8
addons/hr_recruitment/hr_recruitment.py
View File

@ -197,14 +197,16 @@ class hr_applicant(crm.crm_case, osv.osv):
'color': 0,
}
def _read_group_stage_ids(self, cr, uid, ids, domain, read_group_order=None, context=None):
def _read_group_stage_ids(self, cr, uid, ids, domain, read_group_order=None, access_rights_uid=None, context=None):
access_rights_uid = access_rights_uid or uid
stage_obj = self.pool.get('hr.recruitment.stage')
order = stage_obj._order
if read_group_order == 'stage_id desc':
# lame hack to allow reverting search, should just work in the trivial case
order = "%s desc" % order
stage_ids = stage_obj.search(cr, uid, ['|',('id','in',ids),('department_id','=',False)], order=order, context=context)
result = stage_obj.name_get(cr, uid, stage_ids, context=context)
stage_ids = stage_obj._search(cr, uid, ['|',('id','in',ids),('department_id','=',False)], order=order,
access_rights_uid=access_rights_uid, context=context)
result = stage_obj.name_get(cr, access_rights_uid, stage_ids, context=context)
# restore order of the search
result.sort(lambda x,y: cmp(stage_ids.index(x[0]), stage_ids.index(y[0])))
return result

16
addons/project/project.py
View File

@ -439,10 +439,11 @@ class task(osv.osv):
if len(project_ids) == 1:
return project_ids[0][0]
def _read_group_type_id(self, cr, uid, ids, domain, read_group_order=None, context=None):
def _read_group_type_id(self, cr, uid, ids, domain, read_group_order=None, access_rights_uid=None, context=None):
stage_obj = self.pool.get('project.task.type')
project_id = self._resolve_project_id_from_context(cr, uid, context=context)
order = stage_obj._order
access_rights_uid = access_rights_uid or uid
if read_group_order == 'type_id desc':
# lame way to allow reverting search, should just work in the trivial case
order = '%s desc' % order
@ -450,24 +451,25 @@ class task(osv.osv):
domain = ['|', ('id','in',ids), ('project_ids','in',project_id)]
else:
domain = ['|', ('id','in',ids), ('project_default','=',1)]
stage_ids = stage_obj.search(cr, uid, domain, order=order, context=context)
result = stage_obj.name_get(cr, uid, stage_ids, context=context)
stage_ids = stage_obj._search(cr, uid, domain, order=order, access_rights_uid=access_rights_uid, context=context)
result = stage_obj.name_get(cr, access_rights_uid, stage_ids, context=context)
# restore order of the search
result.sort(lambda x,y: cmp(stage_ids.index(x[0]), stage_ids.index(y[0])))
return result
def _read_group_user_id(self, cr, uid, ids, domain, read_group_order=None, context=None):
def _read_group_user_id(self, cr, uid, ids, domain, read_group_order=None, access_rights_uid=None, context=None):
res_users = self.pool.get('res.users')
project_id = self._resolve_project_id_from_context(cr, uid, context=context)
access_rights_uid = access_rights_uid or uid
if project_id:
ids += self.pool.get('project.project').read(cr, uid, project_id, ['members'], context=context)['members']
ids += self.pool.get('project.project').read(cr, access_rights_uid, project_id, ['members'], context=context)['members']
order = res_users._order
# lame way to allow reverting search, should just work in the trivial case
if read_group_order == 'user_id desc':
order = '%s desc' % order
# de-duplicate and apply search order
ids = res_users.search(cr, uid, [('id','in',ids)], order=order, context=context)
result = res_users.name_get(cr, uid, ids, context=context)
ids = res_users._search(cr, uid, [('id','in',ids)], order=order, access_rights_uid=access_rights_uid, context=context)
result = res_users.name_get(cr, access_rights_uid, ids, context=context)
# restore order of the search
result.sort(lambda x,y: cmp(ids.index(x[0]), ids.index(y[0])))
return result