partner search & record rules & muliticompanies

Bug #1094212 reported by Joannes Landy on 2012-12-28
94
This bug affects 18 people
Affects Status Importance Assigned to Milestone
Odoo Server (MOVED TO GITHUB)
Fix Released
Medium
OpenERP's Framework R&D
7.0
Fix Released
Undecided
Unassigned

Bug Description

The search function of the partner view don't work when there is a acces rules change.

For example, in a multi compagnies context: if there is a access rules change on "res.partner company" like:
only see the partner of your company and his childs: ['|',('company_id','child_of',[user.company_id.id]),('company_id','=',False)]

Before the access rules was : "res.partner company" ['|','|',('company_id.child_ids','child_of',[user.company_id.id]),('company_id','child_of',[user.company_id.id]),('company_id','=',False)]

the access rules work fine, a user in a new company can see only the partner of his company, BUT

the search function of the tree form always return an "access denied", so it's not possible to filter the partner list.
The message is:

Access Denied
The requested operation cannot be completed due to security restrictions. Please contact your system administrator.
(Document type: Partner, Operation: read)

It's problably the "name_search" function in partner class who don't take care of access rule.

Related branches

Amit Parik (amit-parik) wrote :

Hello,

See the lp:1085981 (producible steps).

Thank you!

Changed in openobject-server:
status: New → Confirmed
importance: Undecided → Medium
assignee: nobody → OpenERP's Framework R&D (openerp-dev-framework)
Niels Huylebroeck (red15) wrote :

I found this to be a very simple fix and have also reported this on maintenance contract (but did not receive response - not even case number - yet)

See attached branch now.

Niels Huylebroeck (red15) wrote :

The problem:

The result of cr.execute is bad (why hasn't everyone at openerp been brainwashed yet?) because it will contain results not appropriate for the current user (because of un-applied record rules)

The solution:

After we fetched the result cr.execute I now force the search to be executed (unconditionally) which is no problem even if "args" was not passed (see beginning of function where it is set to [] if it was None). Doing this search it will pass all the ids we have found so far but will also apply or record rules, thus filtering out the unreadable partner ids in the process.

Joannes Landy (j-landy) wrote :

Hi Niels,

i have tested your solution, that is working fine for me.

I waiting the merge by OpenERP.

Thank's

Joannes Landy (j-landy) wrote :

Hi,

The previous solution don't work everytime.

Finaly, i resolve the problem by rewritting the search_name function of partner (the file is attached).
I bypass the search name function of the orm. (it's not compatible with the record rule for the partner)

For the Record Rules, i authorised the patner linking to the users and the companies. Because, it's used for the internal message.

This solution is ok for me now.

regard

Xavier ALT (xal-openerp) wrote :

Hi,

Fix landed on stable server v7.0 branch with revision-id:

  <email address hidden>

Regards,
Xavier

Changed in openobject-server:
status: Confirmed → Fix Released
Changed in openobject-server:
milestone: none → 7.0
description: updated
To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Other bug subscribers

Bug attachments