odoo/odoo#200722
Created by Bugfix, Levi Siuzdak
Merged
at 7aae23301ef4dafd913dc47a92687dc5c95d2ced
Statuses:
- legal/cla: Contributor License Agreement check
- ci/runbot: Odoo Test Suite
- ci/upgrade_enterprise: Test upgrades for enterprise master
- ci/template: Contact runbot team on discord for help.
- ci/style: Optional style check. Ignore it only if strictly necessary.
- ci/security: Required security check. Can only be ignored by security team.
- label
- odoo-dev:17.0-opw-4554639-sudo_check_invoice_state-sile
- head
- 0bb298b45a1e5ef97c5cf9039ac7edc55b9e8ae0
- merged
- 7 months ago by Sales, Victor Feyens (vfe)
| odoo/odoo | |
|---|---|
| 17.0 | #200722 |
| saas-17.4 | #200833 |
| 18.0 | #200847 |
| saas-18.1 | #200860 |
| saas-18.2 | #200867 |
| saas-18.3 | |
| saas-18.4 | |
| 19.0 | |
| master | #200870 |
[FIX] sale: sudo check invoice state in wizard
Versions
- 17.0+
Steps
- Log in as admin;
- have a user with access to Sales: Own Documents but not Invoicing;
- assign them as a salesperson to a sales order;
- create a draft invoice for the order;
- assign admin as salesperson on the invoice;
- log in as user;
- create invoice for the sales order.
Issue
- No existing draft warning is displayed.
- Trying to create a draft results in an access error.
Cause
The wizards starts out as a newId. Consequently, its sale_order_ids field is also newId with the actual order id as its origin. When trying to read the invoice_ids of a pseudo-record, it will ignore any records you don't have access to. This is why you don't see an exisiting draft invoice warning.
Then when creating the invoice, the check is done again, but no longer as pseudo-records. Now it does get an invoice to check, and throws an error because it's assigned to a different user.
Solution
Use _origin.sudo() to ensure access to the state field of the invoices.