[18.0][FIX] agreement: open partner agreements as a non-admin user - #131
Open
ROBBYHOOD9 wants to merge 1 commit into
Open
[18.0][FIX] agreement: open partner agreements as a non-admin user#131ROBBYHOOD9 wants to merge 1 commit into
ROBBYHOOD9 wants to merge 1 commit into
Conversation
`action_open_agreement` read the action record as the current user, but
`ir.actions.act_window` is only readable by the Settings group
(`base.group_system`). Any other user clicking the "Agreements" stat
button on a partner form got:
You are not allowed to access 'Action Window' (ir.actions.act_window)
records.
Fetch the action through `ir.actions.act_window._for_xml_id()`, which
reads it with superuser rights and returns only the fields the web client
needs.
Contributor
|
Hi @ygol, @alexis-via, |
ROBBYHOOD9
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Steps to error
agreementwith demo data.Administration/Settings, e.g.demo.base.res_partner_12, which has an Agreement.Root cause
The existing code uses
action.read()[0], which reads the Action with the current user's permissions. However, the core ACL for this model only allowsgroup_system, causing an Access Error for regular users.Fix
Use
_for_xml_id()instead, which handles reading the Action withsudoand returns only the fields required by the web client. This is preferred oversudo().read()[0]to avoid granting or reading more data than necessary.