From 08f92f53dd75770f250a1ffbfe41fe9a696d29dd Mon Sep 17 00:00:00 2001
From: Dario Lodeiros <dario@aloxa.eu>
Date: Sun, 10 Mar 2019 19:50:36 +0100
Subject: [PATCH] [FIX] Security Views

---
 hotel/models/hotel_service.py           |  6 ++++--
 hotel/views/hotel_reservation_views.xml | 19 ++++++++++---------
 hotel/views/hotel_service_views.xml     | 10 +++++-----
 3 files changed, 19 insertions(+), 16 deletions(-)

diff --git a/hotel/models/hotel_service.py b/hotel/models/hotel_service.py
index c1438f693..3f8d912e8 100644
--- a/hotel/models/hotel_service.py
+++ b/hotel/models/hotel_service.py
@@ -7,6 +7,7 @@ from odoo.tools import (
     float_compare,
     DEFAULT_SERVER_DATE_FORMAT)
 from datetime import timedelta
+from odoo.exceptions import ValidationError
 from odoo.addons import decimal_precision as dp
 import logging
 _logger = logging.getLogger(__name__)
@@ -37,6 +38,7 @@ class HotelService(models.Model):
             result.append((res.id, name))
         return result
 
+
     @api.model
     def _default_ser_room_line(self):
         if self.env.context.get('room_lines'):
@@ -117,13 +119,13 @@ class HotelService(models.Model):
                                default=_default_folio_id)
     ser_room_line = fields.Many2one('hotel.reservation', 'Room',
                                     default=_default_ser_room_line)
-    per_day = fields.Boolean(related='product_id.per_day')
+    per_day = fields.Boolean(related='product_id.per_day', related_sudo=True)
     service_line_ids = fields.One2many('hotel.service.line', 'service_id')
     product_qty = fields.Integer('Quantity')
     days_qty = fields.Integer(compute="_compute_days_qty", store=True)
     is_board_service = fields.Boolean()
     # Non-stored related field to allow portal user to see the image of the product he has ordered
-    product_image = fields.Binary('Product Image', related="product_id.image", store=False)
+    product_image = fields.Binary('Product Image', related="product_id.image", store=False, related_sudo=True)
     company_id = fields.Many2one(related='folio_id.company_id', string='Company', store=True, readonly=True)
     invoice_status = fields.Selection([
          ('invoiced', 'Fully Invoiced'),
diff --git a/hotel/views/hotel_reservation_views.xml b/hotel/views/hotel_reservation_views.xml
index c2cf12f39..9f1c24678 100644
--- a/hotel/views/hotel_reservation_views.xml
+++ b/hotel/views/hotel_reservation_views.xml
@@ -112,7 +112,7 @@
                                 </span>
                                 <span class="o_stat_text">Pending Payment</span>
                             </div>
-                        </button> 
+                        </button>
                         <button type="object" class="oe_stat_button" id="invoice_button"
                             icon="fa-pencil-square-o" name="open_invoices_reservation"
                             attrs="{'invisible': [('invoice_count','&lt;=',0)]}">
@@ -245,18 +245,18 @@
                                             decoration-success="is_board_service == True">
                                         <field name="is_board_service" invisible="1" />
                                         <button type="object" class="oe_stat_button"
-                                            icon="fa fa-1x fa-bed"                                                                                              
+                                            icon="fa fa-1x fa-bed"
                                             name="open_service_lines"
                                             attrs="{'invisible':[('is_board_service','=', False)]}" />
-                                        <field name="per_day" invisible="1"/>
+                                        <field name="per_day" invisible="1" readonly="1"/>
                                         <field name="folio_id" invisible="1"/>
                                         <field name="ser_room_line" invisible="1"
                                             attrs = "{'required': [('per_day','=',True)]}" />
                                         <field name="product_id"
                                             domain="[('sale_ok', '=', True)]"
-                                            options="{'no_create': True,'no_open': True}" />                                            
+                                            options="{'no_create': True,'no_open': True}" />
                                         <field name="name"/>
-                                        <field name="product_qty" attrs="{'readonly': [('per_day','=',True)]}" force_save="1"/>                                            
+                                        <field name="product_qty" attrs="{'readonly': [('per_day','=',True)]}" force_save="1"/>
                                         <button type="object" class="oe_stat_button"
                                             icon="fa fa-2x fa-bars"
                                             name="open_service_lines"
@@ -267,7 +267,7 @@
                                         <field name="tax_ids" widget="many2many_tags"/>
                                         <field name="price_subtotal" />
                                         <field name="price_tax" />
-                                        <field name="price_total" />      
+                                        <field name="price_total" />
                                         <field name="service_line_ids" invisible="1">
                                             <tree string="Days" >
                                                 <field name="date" />
@@ -390,7 +390,7 @@
                             attrs="{'invisible': [('reservation_type','not in',('normal'))]}"/>
                         <span class="fa fa-black-tie" style="margin-left:20px; color: #C67;"
                             attrs="{'invisible': [('reservation_type','not in',('staff'))]}"/>
-                        
+
                         <h3>
                             From <span class="fa fa-sign-in" style="margin: 5px;"/>
                                 <field name="checkin" style="margin-right: 10px;"
@@ -399,7 +399,7 @@
                             <span class="fa fa-sign-out" style="margin-right: 5px;"/>
                             <field name="checkout" readonly="1"  />
                         </h3>
-                    </h2>                       
+                    </h2>
                     <group>
                         <field name="segmentation_ids" widget="many2many_tags" placeholder="Segmentation..."
                                 options="{'no_create': True,'no_open': True}" />
@@ -428,6 +428,7 @@
                decoration-success="folio_pending_amount == 0 and checkout &lt;= current_date and not overbooking"
                decoration-warning="overbooking">
                 <field name="splitted" invisible="1" />
+                 <field name="pricelist_id" invisible="1" />
                 <button icon="fa fa-1x fa-chain-broken"
                     type="object"
                     class="oe_stat_button"
@@ -519,7 +520,7 @@
             </xpath>
              <xpath expr="//field[@name='create_uid']" position="attributes">
                 <attribute name="invisible">True</attribute>
-            </xpath>           
+            </xpath>
         </field>
     </record>
 
diff --git a/hotel/views/hotel_service_views.xml b/hotel/views/hotel_service_views.xml
index 42ae50650..5ece2349f 100644
--- a/hotel/views/hotel_service_views.xml
+++ b/hotel/views/hotel_service_views.xml
@@ -31,7 +31,7 @@
                         invisible="1"/>
                     <field name="price_subtotal" invisible="1"/>
                     <field name="price_tax" invisible="1"/>
-                    <field name="price_total" invisible="1"/>      
+                    <field name="price_total" invisible="1"/>
                     <field name="service_line_ids" nolabel="1">
                         <tree string="Days" editable="bottom" >
                             <field name="date" />
@@ -52,10 +52,10 @@
             decoration-success="is_board_service == True">
                 <field name="is_board_service" invisible="1" />
                 <button type="object" class="oe_stat_button"
-                    icon="fa fa-1x fa-bed"                                                                                              
+                    icon="fa fa-1x fa-bed"
                     name="open_service_lines"
                     attrs="{'invisible':[('is_board_service','=', False)]}" />
-                <field name="per_day" invisible="1"/>
+                <field name="per_day" invisible="1" readonly="1"/>
                 <field name="folio_id" invisible="1"/>
                 <field name="ser_room_line"
                     attrs = "{'required': [('per_day','=',True)]}" />
@@ -63,7 +63,7 @@
                     domain="[('sale_ok', '=', True)]"
                     options="{'create': False, 'create_edit': False}"/>
                 <field name="name"/>
-                <field name="product_qty" attrs="{'readonly': [('per_day','=',True)]}" force_save="1"/>                                            
+                <field name="product_qty" attrs="{'readonly': [('per_day','=',True)]}" force_save="1"/>
                 <button type="object" class="oe_stat_button"
                     icon="fa fa-2x fa-bars"
                     name="open_service_lines"
@@ -74,7 +74,7 @@
                 <field name="tax_ids" widget="many2many_tags"/>
                 <field name="price_subtotal" />
                 <field name="price_tax" />
-                <field name="price_total" />      
+                <field name="price_total" />
                 <field name="service_line_ids" invisible="1">
                     <tree string="Days" >
                         <field name="date" />