Web addons for OpenERP

[web_easy_switch_company] ACL / Permissions insufficient for non-admin users

Bug #1303944 reported by Ray Carnes
14
This bug affects 2 people
Affects Status Importance Assigned to Milestone
Web addons for OpenERP
Confirmed
Undecided
Stéphane Bidoul (Acsone)

Bug Description

I am unable to get this functionality working for users other than admin.

I have made sure users have 'Multi Companies' checked, and that 'Allowed Companies' is more than one, however the widget never appears for these users.

Per direction from Sylvain, I am loggin a bug.

Related branches

lp://staging/~acsone-openerp/web-addons/bug-1303944-sbi
Pedro Manuel Baeza: Approve (code review and test)
Sylvain LE GAL (GRAP) (community): Approve (code review, test)
arthru (community): Approve (tested)
Diff: 53 lines (+24/-8)
1 file modified
web_easy_switch_company/static/src/js/switch_company.js (+24/-8)
Pedro Manuel Baeza (pedro.baeza)
summary: - ACL / Permissions insufficient for non-admin users
+ [web_easy_switch_company] ACL / Permissions insufficient for non-admin
+ users
Sylvain LE GAL (GRAP) (sylvain-legal)
Changed in web-addons:
status: New → Confirmed
assignee: nobody → Sylvain LE GAL (GRAP) (sylvain-legal)
Revision history for this message
Sylvain LE GAL (GRAP) (sylvain-legal) wrote :

Hi,

You're right. I didn't see that because I tested the module only with admin (no ACL constraint) and with my database that use non default ACL permissions.

The problem is :
when a user is in a company, by default, he has no access to other companies. Using the default interface, it works because there is a special call with a special context value 'user_preference'. (base/../res_users.py#160).
I can not reproduce the correct call, using web call.

I'll investigate in a few days but if you have some ideas...

Regards.

Revision history for this message
Ray Carnes (rcarnes) wrote :

Thanks for the info. I have no ideas myself, but will re-test as soon as you need me to.

Revision history for this message
Stéphane Bidoul (Acsone) (sbi) wrote :

Hello,

One way to work around is to replace the default record rule for res.company by

[('id','child_of',[c.id for c in user.company_ids])]

hence providing access to all companies allowed to the user.

This may have other side effects, though.

-sbi

Revision history for this message
Stéphane Bidoul (Acsone) (sbi) wrote :

Hi Sylvain, all,

I submitted a MP with a proposed fix.

-sbi

Changed in web-addons:
assignee: Sylvain LE GAL (GRAP) (sylvain-legal) → Stéphane Bidoul (Acsone) (sbi)
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.