Wednesday, April 10, 2024
1 change · 17.0
Resolved issues and error corrections
This fix prevents portal users from being able to edit timesheet records when viewing subtask timesheets through the project app. Previously, portal users could inadvertently gain write access to timesheets due to permissions granted by the MRP module, which was not intended for the project application. The fix creates read-only views specifically for portal users to prevent unauthorized modifications.
Original PR description
Currently, there is an access right problem concerning timesheet. The module mrp gives write access to portal user on analytic line, but it is not something we want for the project app. step to…
Currently, there is an access right problem concerning timesheet. The module mrp gives write access to portal user on analytic line, but it is not something we want for the project app. step to reproduce: - install hr_timesheet on a saas-16.3 db - go to project app, open office design - select any task, and add a subtask to it - go the the view form of the subtask - create a new timesheet for this subtask - go back to the view form of the parent task a button 'subtask timesheet' is now visible - share the project in edit mode with a portal user - connect with that portal user - open the office design project - go to the view form of the parent task and click on the button - the user is redirected to a view tree with the timesheet of the subtask this view tree is editable Source of the problem: in the mrp module, the access rights of the analytic line is overwritten to give write access to it to portal user. Soluce: We have to make the view in readonly mode for timesheet when the connected user is a portal one. Unfortunately, it is not 100% possible because setting the field to readonly still gives the user the opportunity to click on those fields (which triggers access errors). So we have to create new views and specifically open those views when the user is a portal one. affected version: saas-16.3 - master task - 3751315 Description of the issue/feature this PR addresses: Current behavior before PR: Desired behavior after PR is merged: --- I confirm I have signed the CLA and read the PR guidelines at www.odoo.com/submit-pr Forward-Port-Of: odoo/odoo#155768