[18.0][product_cost_security] Unable to change picked on stock move without product cost read rights

Open
  • Is something wrong?
#2,256 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
3/5
Estimated time
1-2 days
Newbie friendliness
35/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Stale
Tech stack
python
Domain
authorization, backend

Research direction

Start with the product_cost_security module and the line that reads self.product_id.standard_price while computing the amount for a stock move line's picked change. Reproduce as a user without product cost read rights, with project_stock_account installed and analytic costs enabled on the operation type. Done means saving picked succeeds for that user without an AccessError, and the cost is still computed correctly. The issue links OCA issue 2115 as a precedent for the sudo and cache approach.

Written by the indexing model from the issue text.

Description

bug

Module

product_cost_security

Describe the bug

The module prevents changin boolean field "picked" on stock.move.line when installed for users without read access to product cost fields. Inventory users should be able to change field "picked" on stock.move even if they are not allowed to see product costs.

amount = - unit_amount * self.product_id.standard_price

Since standard_price requires read access on the product cost, this raises an AccessError for users without required rights when product_cost_security is installed.
It seems that this call should likely use sudo() and price saved in cache as it was resolved in issue https://github.com/OCA/product-attribute/issues/2115
However, i am not sure if any other change should be made along this.

Image

To Reproduce

Affected versions: 18.0.1.0.0

Steps to reproduce the behavior:

  1. Start new odoo18 database
  2. Login as admin
  3. Install modules: project_stock_account, product_cost_security
  4. Give admin user permission for Analytic Accounting
  5. Activate developer mode
  6. Enable Analytic Costs on operation type
  7. Create/edit stock.picking with operation type from previous step and add project
  8. In stock.picking lines, select "picked" field to be shown
  9. In stock.picking lines, change boolean field "picked" and save document
    Result:
    Saving "picked" field fails with an access error when reading product_id.standard_price.

Expected behavior
Changing boolean field "picked" on stock move should succeed for users without product cost access rights. The module should not block standard stock operations.

Dominant language
HTML
Stars
250
Forks
867
Avg merge
9d 2h
Merged PRs (30d)
12

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from OCA/product-attribute

All issues in OCA/product-attribute

Similar issues

More Security issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.