audrius/stock-rma
1
0
Fork 0
mirror of https://github.com/ForgeFlow/stock-rma.git synced 2025-01-21 12:57:49 +02:00
Code Issues Packages Projects Releases Wiki Activity

[FIX] multicompany security

Browse Source 
the rma module had company_id fields on rma.order and rma.order.line but not on rma.operation,
and no global multicompany record rules.

-> we fix this and avoid a mess with people allowed to see an operation in the drop down list
but unable to use it because if points to a warehouse of another company
This commit is contained in:
Alexandre Fayolle
2019-06-19 00:10:34 +02:00
committed by ahenriquez
parent e0e8e2a624
commit 3b123ea5de
5 changed files with 26 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
rma/README.rst
View File

@@ -115,6 +115,7 @@ Contributors
* Lois Rilo <lois.rilo@eficent.com>
* Bhavesh Odedra <bodedra@opensourceintegrators.com>
* Akim Juillerat <akim.juillerat@camptocamp.com>
* Alexandre Fayolle <alexandre.fayolle@camptocamp.com>
Maintainer
----------

2
rma/__manifest__.py
View File

@@ -3,7 +3,7 @@
{
'name': 'RMA (Return Merchandise Authorization)',
'version': '12.0.2.0.0',
'version': '12.0.2.1.0',
'license': 'LGPL-3',
'category': 'RMA',
'summary': 'Introduces the return merchandise authorization (RMA) process '

4
rma/models/rma_operation.py
View File

@@ -75,3 +75,7 @@ class RmaOperation(models.Model):
comodel_name='rma.order.line', inverse_name='operation_id',
string='RMA lines',
)
company_id = fields.Many2one(
comodel_name='res.company', string='Company', required=True,
default=lambda self: self.env.user.company_id
)

19
rma/security/rma.xml
View File

@@ -49,6 +49,25 @@
eval="[(4, ref('group_rma_customer_user')),
(4, ref('group_rma_supplier_user'))]"/>
</record>
<record model="ir.rule" id="rma_order_rule">
<field name="name">rma order multi-company</field>
<field name="model_id" search="[('model','=','rma.order')]" model="ir.model"/>
<field name="global" eval="True"/>
<field name="domain_force">['|',('company_id','=',False),('company_id','child_of',[user.company_id.id])]</field>
</record>
<record model="ir.rule" id="rma_order_line_rule">
<field name="name">rma order line multi-company</field>
<field name="model_id" search="[('model','=','rma.order.line')]" model="ir.model"/>
<field name="global" eval="True"/>
<field name="domain_force">['|',('company_id','=',False),('company_id','child_of',[user.company_id.id])]</field>
</record>
<record model="ir.rule" id="rma_operation_rule">
<field name="name">rma operation multi-company</field>
<field name="model_id" search="[('model','=','rma.operation')]" model="ir.model"/>
<field name="global" eval="True"/>
<field name="domain_force">['|',('company_id','=',False),('company_id','child_of',[user.company_id.id])]</field>
</record>
</data>
</odoo>

1
rma/views/rma_operation_view.xml
View File

@@ -26,6 +26,7 @@
<field name="name"/>
<field name="type"/>
<field name="active"/>
<field name="company_id" groups="base.group_multi_company"/>
</group>
<group name="policies"
string="Policies">