Daily updates from Odoo
Friday, March 29, 2024
1 change
Resolved issues and error corrections
Portal users were unable to filter opportunities by activity date (Overdue/Today/This Week) due to insufficient access rights, resulting in a 403 error. This fix adjusts how the system handles permission checks during searches, allowing users to properly filter their assigned opportunities while maintaining security controls.
Original PR description
…search **Issue Description:** Due to changes in field access rights verification as seen here: https://github.com/odoo/odoo/blob/494231e796b562162d3bfb19fc8ce7550657cf07/odoo/models.py#L5334-L5345…
…search **Issue Description:** Due to changes in field access rights verification as seen here: https://github.com/odoo/odoo/blob/494231e796b562162d3bfb19fc8ce7550657cf07/odoo/models.py#L5334-L5345 And the removal of sudo rights for CrmLead: https://github.com/odoo/odoo/blob/494231e796b562162d3bfb19fc8ce7550657cf07/addons/website_crm_partner_assign/controllers/main.py#L98 Attempting to open a search by domain with the `activity_date_deadline` field triggers a 403 error: "You do not have enough rights to access the fields 'activity_date_deadline' on Lead/Opportunity (crm.lead). Please contact your system administrator." **Steps to Reproduce:** 1. Install the `website_crm_partner_assign` module. 2. Assign Joel Willis a partner level (via the partner assignment tab in the `Contact` app). 3. Navigate to CRM, select an opportunity, and assign it to Joel Willis (using the assigned partner tab in the lead form). 4. Log in to the portal as Joel Willis, navigate to Opportunities, and click any filter on the activities date `Overdue / today / this week activities`. This action results in a crash. **Proposed Solution:** Our approach focuses on secure and efficient access to data, especially for sensitive fields like `activity_date_deadline` and `activity_ids.date_deadline`. We selectively apply higher permissions during search operations to ensure users can access crucial information without compromising data security. By carefully using higher permissions and applying internal rules after searches, we strike a balance between making data available for legitimate needs and upholding our security measures. opw-3703583