user can't change company

[Leigh Willard]

OpenERP v6.0.2

As administrator, I put my user Miss Piggie into 5 different companies and set her company as Company1.

When Miss Piggie logs in, she can open up her preferences and can select her company as Company2, but
it never gets saved.

Also note that when Miss Piggie goes into Administration / Users and looks at her account through there,
she only sees Company1 in the list of Companies. Administrator sees all 5 of the companies assigned to her.

[Leigh Willard (leigh)]

Note that in the scenario above Company5 is NOT a child company of Company1.

[Leigh Willard (leigh)]

The fix for this is in line 368 of base/res/res_user.py

Change:

if not (values['company_id'] in self.read(cr, uid, uid, ['company_ids'], context=context)['company_ids']):

To be:

if not (values['company_id'] in self.read(cr, 1, uid, ['company_ids'], context=context)['company_ids']):

Because it is doing the read in the context of the current company id of the user, whereas it needs to
see all of the companies of the user.

[Ferdinand (office-chricar)]

please see comments in
https://bugs.launchpad.net/openobject-addons/+bug/767270

[Serge (sboivin)]

The rules is not the problem, the problem is, when openerp go read the company, openerp use the ID of the user , at this moment user can only see company 1, so the read return only the company 1, so refuse to change company to company 2

The read need to use the administrator right to bypass rules and go see if the user really have the right to select this company.

self.read(cr, uid, uid, ['company_ids'], context=context)['company_ids'])

This will always return the current company select and is children, so in Leigh sample, company 1 and 2 are not parent, so if user use company 1, he cant change to company 2.

self.read(cr, 1, uid, ['company_ids'], context=context)['company_ids'])

This use the administrator right to go read the user (UID) allowed companies.

And please remove Duplicate, because other talk about rule, here we talk about the bad use of uid to go read.

In my side i patched version 6.0.2 with that.

[Ferdinand (office-chricar)]

i put this and ONLY this rule for res.users

['|',('company_id.child_ids','child_of',[user.company_id.id]),('company_id','child_of',[user.company_id.id])]

and this works without patching

[Ferdinand (office-chricar)]

I agree with Serge's comment

self.read(cr, 1, uid, ['company_ids'], context=context)['company_ids'])

is necessary

[Naresh(OpenERP) (nch-openerp)]

Hello,

Thanks for reporting !

It has been improved in Trunk and stable as well.

Thanks !

[Olivier Dony (Odoo) (odo-openerp)]

The fix for this has landed in 6.0 directly (this is an important issue for OPW too), and has been ported to trunk as well.
- 6.0: rev. 3420 rev-id: <email address hidden>
- trunk: merged at rev. 3401, rev-id: <email address hidden>

Leigh, thanks a lot for reporting and providing a patch. I apologize for not crediting the patch to you, I made it independently as a quick fix while fixing something else, and noticed your bug report afterwards. This is also the reason why my commit is not linked to this bugreport :-(
I really wish Bazaar would allow us to edit commit metadata (message, bug links, etc.) after they have been pushed...

Here is my commit: http://bit.ly/l5wRcp