From 634c62610efc784b47206a700a796fdbb343ec30 Mon Sep 17 00:00:00 2001 From: Joren Van Onder Date: Wed, 27 Jan 2016 12:21:40 +0100 Subject: [PATCH] [FIX] purchase: only search in requested model Because otherwise a user who has access to a view displaying supplier_invoice_count will get an access error if he doesn't also have access to purchase.order, even if that wouldn't have been displayed. opw-666935 --- addons/purchase/partner.py | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-) diff --git a/addons/purchase/partner.py b/addons/purchase/partner.py index bc2255cca03..b86471fafaa 100644 --- a/addons/purchase/partner.py +++ b/addons/purchase/partner.py @@ -28,13 +28,17 @@ class res_partner(osv.osv): def _purchase_invoice_count(self, cr, uid, ids, field_name, arg, context=None): PurchaseOrder = self.pool['purchase.order'] Invoice = self.pool['account.invoice'] - return { - partner_id: { - 'purchase_order_count': PurchaseOrder.search_count(cr,uid, [('partner_id', 'child_of', partner_id)], context=context), - 'supplier_invoice_count': Invoice.search_count(cr,uid, [('partner_id', 'child_of', partner_id), ('type','=','in_invoice')], context=context) - } - for partner_id in ids - } + res = {} + + for partner_id in ids: + res[partner_id] = {} + + if 'purchase_order_count' in field_name: + res[partner_id]['purchase_order_count'] = PurchaseOrder.search_count(cr,uid, [('partner_id', 'child_of', partner_id)], context=context) + if 'supplier_invoice_count' in field_name: + res[partner_id]['supplier_invoice_count'] = Invoice.search_count(cr,uid, [('partner_id', 'child_of', partner_id), ('type','=','in_invoice')], context=context) + + return res def _commercial_fields(self, cr, uid, context=None): return super(res_partner, self)._commercial_fields(cr, uid, context=context) + ['property_product_pricelist_purchase']