odoo
/
odoo
2
0
Fork 0
Code Pull Requests Releases Activity

[FIX] purchase: only search in requested model 

Because otherwise a user who has access to a view displaying
supplier_invoice_count will get an access error if he doesn't also have
access to purchase.order, even if that wouldn't have been displayed.

opw-666935
This commit is contained in:
Joren Van Onder 2016-01-27 12:21:40 +01:00
parent 43a4ffe6b6
commit 634c62610e
1 changed files with 11 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
addons/purchase/partner.py
View File

@ -28,13 +28,17 @@ class res_partner(osv.osv):
def _purchase_invoice_count(self, cr, uid, ids, field_name, arg, context=None):
PurchaseOrder = self.pool['purchase.order']
Invoice = self.pool['account.invoice']
return {
partner_id: {
'purchase_order_count': PurchaseOrder.search_count(cr,uid, [('partner_id', 'child_of', partner_id)], context=context),
'supplier_invoice_count': Invoice.search_count(cr,uid, [('partner_id', 'child_of', partner_id), ('type','=','in_invoice')], context=context)
}
for partner_id in ids
}
res = {}
for partner_id in ids:
res[partner_id] = {}
if 'purchase_order_count' in field_name:
res[partner_id]['purchase_order_count'] = PurchaseOrder.search_count(cr,uid, [('partner_id', 'child_of', partner_id)], context=context)
if 'supplier_invoice_count' in field_name:
res[partner_id]['supplier_invoice_count'] = Invoice.search_count(cr,uid, [('partner_id', 'child_of', partner_id), ('type','=','in_invoice')], context=context)
return res
def _commercial_fields(self, cr, uid, context=None):
return super(res_partner, self)._commercial_fields(cr, uid, context=context) + ['property_product_pricelist_purchase']