[FIX] purchase: only search in requested model
Because otherwise a user who has access to a view displaying supplier_invoice_count will get an access error if he doesn't also have access to purchase.order, even if that wouldn't have been displayed. opw-666935
This commit is contained in:
parent
43a4ffe6b6
commit
634c62610e
|
@ -28,13 +28,17 @@ class res_partner(osv.osv):
|
||||||
def _purchase_invoice_count(self, cr, uid, ids, field_name, arg, context=None):
|
def _purchase_invoice_count(self, cr, uid, ids, field_name, arg, context=None):
|
||||||
PurchaseOrder = self.pool['purchase.order']
|
PurchaseOrder = self.pool['purchase.order']
|
||||||
Invoice = self.pool['account.invoice']
|
Invoice = self.pool['account.invoice']
|
||||||
return {
|
res = {}
|
||||||
partner_id: {
|
|
||||||
'purchase_order_count': PurchaseOrder.search_count(cr,uid, [('partner_id', 'child_of', partner_id)], context=context),
|
for partner_id in ids:
|
||||||
'supplier_invoice_count': Invoice.search_count(cr,uid, [('partner_id', 'child_of', partner_id), ('type','=','in_invoice')], context=context)
|
res[partner_id] = {}
|
||||||
}
|
|
||||||
for partner_id in ids
|
if 'purchase_order_count' in field_name:
|
||||||
}
|
res[partner_id]['purchase_order_count'] = PurchaseOrder.search_count(cr,uid, [('partner_id', 'child_of', partner_id)], context=context)
|
||||||
|
if 'supplier_invoice_count' in field_name:
|
||||||
|
res[partner_id]['supplier_invoice_count'] = Invoice.search_count(cr,uid, [('partner_id', 'child_of', partner_id), ('type','=','in_invoice')], context=context)
|
||||||
|
|
||||||
|
return res
|
||||||
|
|
||||||
def _commercial_fields(self, cr, uid, context=None):
|
def _commercial_fields(self, cr, uid, context=None):
|
||||||
return super(res_partner, self)._commercial_fields(cr, uid, context=context) + ['property_product_pricelist_purchase']
|
return super(res_partner, self)._commercial_fields(cr, uid, context=context) + ['property_product_pricelist_purchase']
|
||||||
|
|
Loading…
Reference in New Issue