[IMP] crm,project,hr: fix group_by_full implementation to respect access_right_uid

This helps avoid access right issues in restricted
contexts, such as embedded web client, or shared
access (via portal or share wizard).

bzr revid: odo@openerp.com-20111123133132-22g2mqzupuysbyqq

diff --git a/addons/crm/crm_lead.py b/addons/crm/crm_lead.py
index e72358a..e74ce00 100644 (file)
--- a/addons/crm/crm_lead.py
+++ b/addons/crm/crm_lead.py
@@ -42,14 +42,16 @@ class crm_lead(crm_case, osv.osv):
     _order = "priority,date_action,id desc"
     _inherit = ['mail.thread','res.partner.address']
 
-    def _read_group_stage_ids(self, cr, uid, ids, domain, read_group_order=None, context=None):
+    def _read_group_stage_ids(self, cr, uid, ids, domain, read_group_order=None, access_rights_uid=None, context=None):
+        access_rights_uid = access_rights_uid or uid
         stage_obj = self.pool.get('crm.case.stage')
         order = stage_obj._order
         if read_group_order == 'stage_id desc':
             # lame hack to allow reverting search, should just work in the trivial case
             order = "%s desc" % order
-        stage_ids = stage_obj.search(cr, uid, ['|', ('id','in',ids),('case_default','=',1)], order=order, context=context)
-        result = stage_obj.name_get(cr, uid, stage_ids, context=context)
+        stage_ids = stage_obj._search(cr, uid, ['|', ('id','in',ids),('case_default','=',1)], order=order,
+                                      access_rights_uid=access_rights_uid, context=context)
+        result = stage_obj.name_get(cr, access_rights_uid, stage_ids, context=context)
         # restore order of the search
         result.sort(lambda x,y: cmp(stage_ids.index(x[0]), stage_ids.index(y[0])))
         return result

diff --git a/addons/hr_recruitment/hr_recruitment.py b/addons/hr_recruitment/hr_recruitment.py
index d9438e9..8acb95e 100644 (file)
--- a/addons/hr_recruitment/hr_recruitment.py
+++ b/addons/hr_recruitment/hr_recruitment.py
@@ -197,14 +197,16 @@ class hr_applicant(crm.crm_case, osv.osv):
         'color': 0,
     }
 
-    def _read_group_stage_ids(self, cr, uid, ids, domain, read_group_order=None, context=None):
+    def _read_group_stage_ids(self, cr, uid, ids, domain, read_group_order=None, access_rights_uid=None, context=None):
+        access_rights_uid = access_rights_uid or uid
         stage_obj = self.pool.get('hr.recruitment.stage')
         order = stage_obj._order
         if read_group_order == 'stage_id desc':
             # lame hack to allow reverting search, should just work in the trivial case
             order = "%s desc" % order
-        stage_ids = stage_obj.search(cr, uid, ['|',('id','in',ids),('department_id','=',False)], order=order, context=context)
-        result = stage_obj.name_get(cr, uid, stage_ids, context=context)
+        stage_ids = stage_obj._search(cr, uid, ['|',('id','in',ids),('department_id','=',False)], order=order,
+                                      access_rights_uid=access_rights_uid, context=context)
+        result = stage_obj.name_get(cr, access_rights_uid, stage_ids, context=context)
         # restore order of the search
         result.sort(lambda x,y: cmp(stage_ids.index(x[0]), stage_ids.index(y[0])))
         return result

diff --git a/addons/project/project.py b/addons/project/project.py
index 589d3eb..abebd2d 100644 (file)
--- a/addons/project/project.py
+++ b/addons/project/project.py
@@ -439,10 +439,11 @@ class task(osv.osv):
             if len(project_ids) == 1:
                 return project_ids[0][0]
 
-    def _read_group_type_id(self, cr, uid, ids, domain, read_group_order=None, context=None):
+    def _read_group_type_id(self, cr, uid, ids, domain, read_group_order=None, access_rights_uid=None, context=None):
         stage_obj = self.pool.get('project.task.type')
         project_id = self._resolve_project_id_from_context(cr, uid, context=context)
         order = stage_obj._order
+        access_rights_uid = access_rights_uid or uid
         if read_group_order == 'type_id desc':
             # lame way to allow reverting search, should just work in the trivial case
             order = '%s desc' % order
@@ -450,24 +451,25 @@ class task(osv.osv):
             domain = ['|', ('id','in',ids), ('project_ids','in',project_id)]
         else:
             domain = ['|', ('id','in',ids), ('project_default','=',1)]
-        stage_ids = stage_obj.search(cr, uid, domain, order=order, context=context)
-        result = stage_obj.name_get(cr, uid, stage_ids, context=context)
+        stage_ids = stage_obj._search(cr, uid, domain, order=order, access_rights_uid=access_rights_uid, context=context)
+        result = stage_obj.name_get(cr, access_rights_uid, stage_ids, context=context)
         # restore order of the search
         result.sort(lambda x,y: cmp(stage_ids.index(x[0]), stage_ids.index(y[0])))
         return result
 
-    def _read_group_user_id(self, cr, uid, ids, domain, read_group_order=None, context=None):
+    def _read_group_user_id(self, cr, uid, ids, domain, read_group_order=None, access_rights_uid=None, context=None):
         res_users = self.pool.get('res.users')
         project_id = self._resolve_project_id_from_context(cr, uid, context=context)
+        access_rights_uid = access_rights_uid or uid
         if project_id:
-            ids += self.pool.get('project.project').read(cr, uid, project_id, ['members'], context=context)['members']
+            ids += self.pool.get('project.project').read(cr, access_rights_uid, project_id, ['members'], context=context)['members']
             order = res_users._order
             # lame way to allow reverting search, should just work in the trivial case
             if read_group_order == 'user_id desc':
                 order = '%s desc' % order
             # de-duplicate and apply search order
-            ids = res_users.search(cr, uid, [('id','in',ids)], order=order, context=context)
-        result = res_users.name_get(cr, uid, ids, context=context)
+            ids = res_users._search(cr, uid, [('id','in',ids)], order=order, access_rights_uid=access_rights_uid, context=context)
+        result = res_users.name_get(cr, access_rights_uid, ids, context=context)
         # restore order of the search
         result.sort(lambda x,y: cmp(ids.index(x[0]), ids.index(y[0])))
         return result