[7.0]Access error on project task work (Document type: hr analytic timesheet, Operation: create)

[El Hadji Dem (http://www.savoirfairelinux.com)]

When I create a task work in Project -> Tasks, I have this message

The requested operation cannot be completed due to security restrictions. Please contact your system administrator.

(Document type: hr analytic timesheet, Operation: create)

[Amit Bhavsar (Open ERP) (amb-openerp)]

Hello,

I have faced the same problem on 7.0 and 6.1 when create a task line with project user rights. so I have attched the screensort for reference. please give look.. .

Thanks!

[Amit Parik (amit-parik)]

Hello,

On trunk this issue is working fine, problem only occurs up tp 7.0

Thank you!

[El Hadji Dem (http://www.savoirfairelinux.com) (eh-dem)]

Hello Amit, I tested but I have the same message .I have attached a screenshot for reference.

[Amit Parik (amit-parik)]

Hello,

Tried with http://trunk_1317.runbot.openerp.com but didn't get the problem.
Additionally problem only faced on 7.0 only.

Thank you!

[El Hadji Dem (http://www.savoirfairelinux.com) (eh-dem)]

Hello , I got the same problem .

Anyone has an idea to resolve this bug.

I tested but the bug persists in openerp6.1 and OpenErp7.0.

[Amit Bhavsar (Open ERP) (amb-openerp)]

Hello Folks,

I have double check this Issue. It's still presist. That's why I have attached the screen capture for reference.

for more info :- lp:1136289

Thanks!

[El Hadji Dem (http://www.savoirfairelinux.com) (eh-dem)]

Hello Amit, I got the same problem. I am still waiting for a solution.

[Rifakat Husen (OpenERP) (rha-openerp)]

Hi guys,

I think this is record rule problem. Task work entry of any user should not be seen by other users and this is not been taken care.

Technically the problem is,
Project - "project1" (team= administrator, user1, user2)
Task - "task1", Assigned to = No one

- user1 logs in and enter task work entry.
- user2 logs in, able to see task work entry of user1(problem)
- user2 adds his new entry
- try to save task, raises access warning(either hr.analytic.timesheet or Timesheet Line)

It is because when user2 tries to save record, project.task.write() call for for o2m task work(work_ids), it adds new dict for
user2 entry([0, False, {}]) as well as keep the link of user1's task entry(by [4, id, False]), this ultimately means,
when a user tries to save his record, another's user's record is also getting linked in write() call(web client architecture).

I am going to add a record rule for object project.task.work so entry should be seen by a user himself.
Please correct me if I am wrong.

[Rifakat Husen (OpenERP) (rha-openerp)]

Hi eh.dem,

Does this branch solve the problem, could you please check?
lp:~openerp-dev/openobject-addons/7.0-opw-593517-rha
rev 4295

Thanks.

[Rifakat Husen (OpenERP) (rha-openerp)]

Hi, I just tested this on runbot http://trunk-16181.runbot.openerp.com/ and this bug is reproduceable on Trunk too.
I reproduce it wrt #8.

[Rifakat Husen (OpenERP) (rha-openerp)]

Fixed for 7.0 in,
lp:~openerp-dev/openobject-addons/7.0-opw-593517-rha
r9327, <email address hidden>

Thanks for reporting,
Rifakat

[Rifakat Husen (OpenERP) (rha-openerp)]

This has been taken care from server 7.0,
Revision 5162, Revision ID: <email address hidden>

Thanks Martin for your fix,
Rifakat