odoo/odoo#200870
Created by fw-bot
Merged
at 2dbc946ca5f100c3cbd5416aefc2319e71edb45c
Statuses:
- legal/cla: Contributor License Agreement check
- ci/runbot: Odoo Test Suite
- ci/upgrade_enterprise: Test upgrades for enterprise master
- ci/style: Optional style check. Ignore it only if strictly necessary.
- ci/security: Required security check. Can only be ignored by security team.
- label
- odoo-dev:master-17.0-opw-4554639-sudo_check_invoice_state-sile-421419-fw
- head
- 1c561f6ec17a14eb421e29681e6c6d5c7f9cafe7
- merged
- 7 months ago by Bugfix, Levi Siuzdak
| odoo/odoo | |
|---|---|
| 17.0 | #200722 |
| saas-17.4 | #200833 |
| 18.0 | #200847 |
| saas-18.1 | #200860 |
| saas-18.2 | #200867 |
| saas-18.3 | |
| saas-18.4 | |
| 19.0 | |
| master | #200870 |
[FW][FIX] sale: sudo check invoice state in wizard
Versions
- 17.0+
Steps
- Log in as admin;
- have a user with access to Sales: Own Documents but not Invoicing;
- assign them as a salesperson to a sales order;
- create a draft invoice for the order;
- assign admin as salesperson on the invoice;
- log in as user;
- create invoice for the sales order.
Issue
- No existing draft warning is displayed.
- Trying to create a draft results in an access error.
Cause
The wizards starts out as a newId. Consequently, its sale_order_ids field is also newId with the actual order id as its origin. When trying to read the invoice_ids of a pseudo-record, it will ignore any records you don't have access to. This is why you don't see an exisiting draft invoice warning.
Then when creating the invoice, the check is done again, but no longer as pseudo-records. Now it does get an invoice to check, and throws an error because it's assigned to a different user.
Solution
Use _origin.sudo() to ensure access to the state field of the invoices.
Forward-Port-Of: #200722