Merge lp:~openerp-dev/openobject-server/6.0-opw-574351-nep into lp:openobject-server/6.0

[Nehal Panchal (OpenERP)]

Hello,

Non-admin user cannot set default value with "only for you" option.

This fixes the issue.

Thanks.

[Naresh(OpenERP) (nch-openerp)]

Hello

The changes are huge and very risky to be merged to stable version. This may cause regression and effect the existing customers. I would reject this merge proposal.

Thanks,

review: Disapprove

Unmerged revisions

3618. By Nehal Panchal (OpenERP) on 2012-05-09

[FIX] base : Non-admin user cannot set default value with 'only for you' option

=== modified file 'bin/addons/base/ir/ir_values.py'
--- bin/addons/base/ir/ir_values.py	2012-02-09 08:53:51 +0000
+++ bin/addons/base/ir/ir_values.py	2012-05-09 12:18:18 +0000
@@ -27,20 +27,28 @@
 EXCLUDED_FIELDS = set((
     'report_sxw_content', 'report_rml_content', 'report_sxw', 'report_rml',
     'report_sxw_content_data', 'report_rml_content_data', 'search_view', ))
+    
+ACTION_SLOTS = [
+                "client_action_multi",  # sidebar wizard action
+                "client_print_multi",   # sidebar report printing button
+                "client_action_relate", # sidebar related link
+                "tree_but_open",        # double-click on item in tree view
+                "tree_but_action",      # deprecated: same as tree_but_open
+               ]
 
 class ir_values(osv.osv):
     _name = 'ir.values'
 
     def _value_unpickle(self, cursor, user, ids, name, arg, context=None):
         res = {}
-        for report in self.browse(cursor, user, ids, context=context):
-            value = report[name[:-9]]
-            if not report.object and value:
+        for record in self.browse(cursor, user, ids, context=context):
+            value = record[name[:-9]]
+            if record.key == 'default' and value:
                 try:
                     value = str(pickle.loads(value))
-                except:
+                except Exception:
                     pass
-            res[report.id] = value
+            res[record.id] = value
         return res
 
     def _value_pickle(self, cursor, user, id, name, value, arg, context=None):
@@ -49,18 +57,19 @@
         ctx = context.copy()
         if self.CONCURRENCY_CHECK_FIELD in ctx:
             del ctx[self.CONCURRENCY_CHECK_FIELD]
-        if not self.browse(cursor, user, id, context=context).object:
+        record = self.browse(cursor, user, id, context=context)
+        if record.key == 'default':
             value = pickle.dumps(value)
         self.write(cursor, user, id, {name[:-9]: value}, context=ctx)
 
-    def onchange_object_id(self, cr, uid, ids, object_id, context={}):
+    def onchange_object_id(self, cr, uid, ids, object_id, context=None):
         if not object_id: return {}
         act = self.pool.get('ir.model').browse(cr, uid, object_id, context=context)
         return {
                 'value': {'model': act.model}
         }
 
-    def onchange_action_id(self, cr, uid, ids, action_id, context={}):
+    def onchange_action_id(self, cr, uid, ids, action_id, context=None):
         if not action_id: return {}
         act = self.pool.get('ir.actions.actions').browse(cr, uid, action_id, context=context)
         return {
@@ -68,29 +77,44 @@
         }
 
     _columns = {
-        'name': fields.char('Name', size=128),
-        'model_id': fields.many2one('ir.model', 'Object', size=128,
-            help="This field is not used, it only helps you to select a good model."),
-        'model': fields.char('Object Name', size=128, select=True),
-        'action_id': fields.many2one('ir.actions.actions', 'Action',
-            help="This field is not used, it only helps you to select the right action."),
-        'value': fields.text('Value'),
+        'name': fields.char('Name', size=128, required=True),
+        'model': fields.char('Model Name', size=128, select=True, required=True,
+                             help="Model to which this entry applies"),
+        'model_id': fields.many2one('ir.model', 'Model (change only)', size=128,
+                                    help="Model to which this entry applies - "
+                                         "helper field for setting a model, will "
+                                         "automatically set the correct model name"),
+        'action_id': fields.many2one('ir.actions.actions', 'Action (change only)',
+                                     help="Action bound to this entry - "
+                                         "helper field for binding an action, will "
+                                         "automatically set the correct reference"),
+        'value': fields.text('Value', help="Default value (pickled) or reference to an action"),
         'value_unpickle': fields.function(_value_unpickle, fnct_inv=_value_pickle,
-            method=True, type='text', string='Value'),
-        'object': fields.boolean('Is Object'),
-        'key': fields.selection([('action','Action'),('default','Default')], 'Type', size=128, select=True),
-        'key2' : fields.char('Event Type',help="The kind of action or button in the client side that will trigger the action.", size=128, select=True),
-        'meta': fields.text('Meta Datas'),
-        'meta_unpickle': fields.function(_value_unpickle, fnct_inv=_value_pickle,
-            method=True, type='text', string='Metadata'),
-        'res_id': fields.integer('Object ID', help="Keep 0 if the action must appear on all resources.", select=True),
-        'user_id': fields.many2one('res.users', 'User', ondelete='cascade', select=True),
-        'company_id': fields.many2one('res.company', 'Company', select=True)
+                                          type='text',
+                                          string='Default value or action reference'),
+        'key': fields.selection([('action','Action'),('default','Default')],
+                                'Type', size=128, select=True, required=True,
+                                help="- Action: an action attached to one slot of the given model\n"
+                                     "- Default: a default value for a model field"),
+        'key2' : fields.char('Qualifier', size=128, select=True,
+                             help="For actions, one of the possible action slots: \n"
+                                  "  - client_action_multi\n"
+                                  "  - client_print_multi\n"
+                                  "  - client_action_relate\n"
+                                  "  - tree_but_open\n"
+                                  "For defaults, an optional condition"
+                             ,),
+        'res_id': fields.integer('Record ID', select=True,
+                                 help="Database identifier of the record to which this applies. "
+                                      "0 = for all records"),
+        'user_id': fields.many2one('res.users', 'User', ondelete='cascade', select=True,
+                                   help="If set, action binding only applies for this user."),
+        'company_id': fields.many2one('res.company', 'Company', ondelete='cascade', select=True,
+                                      help="If set, action binding only applies for this company")
     }
     _defaults = {
-        'key': lambda *a: 'action',
-        'key2': lambda *a: 'tree_but_open',
-        'company_id': lambda *a: False
+        'key': 'action',
+        'key2': 'tree_but_open',
     }
 
     def _auto_init(self, cr, context=None):
@@ -99,137 +123,146 @@
         if not cr.fetchone():
             cr.execute('CREATE INDEX ir_values_key_model_key2_res_id_user_id_idx ON ir_values (key, model, key2, res_id, user_id)')
 
-    def set(self, cr, uid, key, key2, name, models, value, replace=True, isobject=False, meta=False, preserve_user=False, company=False):
+    def set_default(self, cr, uid, model, field_name, value, for_all_users=True, company_id=False, condition=False):
         if isinstance(value, unicode):
             value = value.encode('utf8')
-        if not isobject:
-            value = pickle.dumps(value)
-        if meta:
-            meta = pickle.dumps(meta)
-        assert isinstance(models, (list, tuple)), models
-        assert not company or isinstance(company, int), "Parameter 'company' must be an integer (company ID)!"
-        if company and company is True:
-            current_user_obj = self.pool.get('res.users').browse(cr, uid, uid, context={})
-            company = current_user_obj.company_id.id
-            
-        ids_res = []
-        for model in models:
+        if company_id is True:
+            user = self.pool.get('res.users').browse(cr, uid, uid)
+            company_id = user.company_id.id
+        search_criteria = [
+            ('key', '=', 'default'),
+            ('key2', '=', condition and condition[:200]),
+            ('model', '=', model),
+            ('name', '=', field_name),
+            ('user_id', '=', False if for_all_users else uid),
+            ('company_id','=', company_id)
+            ]
+        self.unlink(cr, uid, self.search(cr, uid, search_criteria))
+        return self.create(cr, uid, {
+            'name': field_name,
+            'value': pickle.dumps(value),
+            'model': model,
+            'key': 'default',
+            'key2': condition and condition[:200],
+            'user_id': False if for_all_users else uid,
+            'company_id': company_id,
+        })
+
+    def get_defaults(self, cr, uid, model, condition=False):
+        query = """SELECT v.id, v.name, v.value FROM ir_values v
+                      LEFT JOIN res_users u ON (v.user_id = u.id)
+                   WHERE v.key = %%s AND v.model = %%s
+                      AND (v.user_id = %%s OR v.user_id IS NULL)
+                      AND (v.company_id IS NULL OR
+                           v.company_id =
+                             (SELECT company_id from res_users where id = %%s)
+                          )
+                      %s
+                   ORDER BY v.user_id, u.company_id"""
+        query = query % ('AND v.key2 = %s' if condition else '')
+        params = ('default', model, uid, uid)
+        if condition:
+            params += (condition[:200],)
+        cr.execute(query, params)
+        defaults = {}
+        for row in cr.dictfetchall():
+            defaults.setdefault(row['name'],
+                (row['id'], row['name'], pickle.loads(row['value'].encode('utf-8'))))
+        return defaults.values()
+
+    def set_action(self, cr, uid, name, action_slot, model, action, res_id=False):
+        assert isinstance(action, basestring) and ',' in action, \
+               'Action definition must be an action reference, e.g. "ir.actions.act_window,42"'
+        assert action_slot in ACTION_SLOTS, \
+               'Action slot (%s) must be one of: %r' % (action_slot, ACTION_SLOTS)
+        search_criteria = [
+            ('key', '=', 'action'),
+            ('key2', '=', action_slot),
+            ('model', '=', model),
+            ('res_id', '=', res_id or 0), # int field -> NULL == 0
+            ('value', '=', action),
+            ]
+        self.unlink(cr, uid, self.search(cr, uid, search_criteria))
+        return self.create(cr, uid, {
+            'key': 'action',
+            'key2': action_slot,
+            'model': model,
+            'res_id': res_id,
+            'name': name,
+            'value': action,
+        })
+        
+    def get_actions(self, cr, uid, action_slot, model, res_id=False, context=None):
+        assert action_slot in ACTION_SLOTS, 'Illegal action slot value: %s' % action_slot
+        query = """SELECT v.id, v.name, v.value FROM ir_values v
+                   WHERE v.key = %s AND v.key2 = %s
+                        AND v.model = %s
+                        AND (v.res_id = %s
+                             OR v.res_id IS NULL
+                             OR v.res_id = 0)
+                   ORDER BY v.id"""
+        cr.execute(query, ('action', action_slot, model, res_id or None))
+        results = {}
+        for action in cr.dictfetchall():
+            action_model,id = action['value'].split(',')
+            fields = [
+                    field
+                    for field in self.pool.get(action_model)._all_columns
+                    if field not in EXCLUDED_FIELDS]
+            try:
+                action_def = self.pool.get(action_model).read(cr, uid, int(id), fields, context)
+                if action_def:
+                    if action_model in ('ir.actions.report.xml','ir.actions.act_window',
+                                        'ir.actions.wizard'):
+                        groups = action_def.get('groups_id')
+                        if groups:
+                            cr.execute('SELECT 1 FROM res_groups_users_rel WHERE gid IN %s AND uid=%s',
+                                       (tuple(groups), uid))
+                            if not cr.fetchone():
+                                if action['name'] == 'Menuitem':
+                                    raise osv.except_osv('Error !',
+                                                         'You do not have the permission to perform this operation !!!')
+                                continue
+                results[action['name']] = (action['id'], action['name'], action_def)
+            except except_orm, e:
+                continue
+        return results.values()
+
+    def _map_legacy_model_list(self, model_list, map_fn, merge_results=False):
+        assert isinstance(model_list, (list, tuple)), \
+            "model_list should be in the form [model,..] or [(model,res_id), ..]"
+        results = []
+        for model in model_list:
+            res_id = False      
             if isinstance(model, (list, tuple)):
-                model,res_id = model
+                model, res_id = model
+            result = map_fn(model, res_id)
+            if merge_results:
+                results.extend(result)
             else:
-                res_id=False
-            if replace:
-                search_criteria = [
-                    ('key', '=', key),
-                    ('key2', '=', key2),
-                    ('model', '=', model),
-                    ('res_id', '=', res_id),
-                    ('user_id', '=', preserve_user and uid),
-                    ('company_id' ,'=', company)
-                    
-                ]
-                if key in ('meta', 'default'):
-                    search_criteria.append(('name', '=', name))
-                else:
-                    search_criteria.append(('value', '=', value))
+                results.append(result)
+        return results                
 
-                self.unlink(cr, uid, self.search(cr, uid, search_criteria))
-            vals = {
-                'name': name,
-                'value': value,
-                'model': model,
-                'object': isobject,
-                'key': key,
-                'key2': key2 and key2[:200],
-                'meta': meta,
-                'user_id': preserve_user and uid,
-                'company_id':company
-            }
-            if res_id:
-                vals['res_id'] = res_id
-            ids_res.append(self.create(cr, uid, vals))
-        return ids_res
+    def set(self, cr, uid, key, key2, name, models, value, replace=True, isobject=False, meta=False, preserve_user=False, company=False):
+        assert key in ['default', 'action'], "ir.values entry keys must be in ['default','action']"
+        if key == 'default':
+            def do_set(model,res_id):
+                return self.set_default(cr, uid, model, field_name=name, value=value,
+                                        for_all_users=(not preserve_user), company_id=company,
+                                        condition=key2)
+        elif key == 'action':
+            def do_set(model,res_id):
+                return self.set_action(cr, uid, name, action_slot=key2, model=model, action=value, res_id=res_id)
+        return self._map_legacy_model_list(models, do_set)
 
     def get(self, cr, uid, key, key2, models, meta=False, context={}, res_id_req=False, without_user=True, key2_req=True):
-        result = []
-        for m in models:
-            if isinstance(m, (list, tuple)):
-                m, res_id = m
-            else:
-                res_id=False
-
-            where = ['key=%s','model=%s']
-            params = [key, str(m)]
-            if key2:
-                where.append('key2=%s')
-                params.append(key2[:200])
-            elif key2_req and not meta:
-                where.append('key2 is null')
-            if res_id_req and (models[-1][0]==m):
-                if res_id:
-                    where.append('res_id=%s')
-                    params.append(res_id)
-                else:
-                    where.append('(res_id is NULL)')
-            elif res_id:
-                if (models[-1][0]==m):
-                    where.append('(res_id=%s or (res_id is null))')
-                    params.append(res_id)
-                else:
-                    where.append('res_id=%s')
-                    params.append(res_id)
-
-            order = 'id, company_id'
-            where.append('''(user_id=%s or (user_id IS NULL))
-                and (company_id is null or
-                company_id = (SELECT company_id FROM res_users WHERE id = %s)) order by '''+ order)
-            params += [uid, uid]
-            clause = ' and '.join(where)
-            cr.execute('select id,name,value,object,meta, key from ir_values where ' + clause, params)
-            result = cr.fetchall()
-            if result:
-                break
-
-        if not result:
-            return []
-
-        def _result_get(x, keys):
-            if x[1] in keys:
-                return False
-            keys.append(x[1])
-            if x[3]:
-                model,id = x[2].split(',')
-                # FIXME: It might be a good idea to opt-in that kind of stuff
-                # FIXME: instead of arbitrarily removing random fields
-                fields = [
-                    field
-                    for field in self.pool.get(model).fields_get_keys(cr, uid)
-                    if field not in EXCLUDED_FIELDS]
-
-                try:
-                    datas = self.pool.get(model).read(cr, uid, [int(id)], fields, context)
-                except except_orm, e:
-                    return False
-                datas = datas and datas[0]
-                if not datas:
-                    return False
-            else:
-                datas = pickle.loads(x[2].encode('utf-8'))
-            if meta:
-                return (x[0], x[1], datas, pickle.loads(x[4]))
-            return (x[0], x[1], datas)
-        keys = []
-        res = filter(None, map(lambda x: _result_get(x, keys), result))
-        res2 = res[:]
-        for r in res:
-            if isinstance(r[2], dict) and r[2].get('type') in ('ir.actions.report.xml','ir.actions.act_window','ir.actions.wizard'):
-                groups = r[2].get('groups_id')
-                if groups:
-                    cr.execute('SELECT COUNT(1) FROM res_groups_users_rel WHERE gid IN %s AND uid=%s',(tuple(groups), uid))
-                    cnt = cr.fetchone()[0]
-                    if not cnt:
-                        res2.remove(r)
-                    if r[1] == 'Menuitem' and not res2:
-                        raise osv.except_osv('Error !','You do not have the permission to perform this operation !!!')
-        return res2
+        assert key in ['default', 'action'], "ir.values entry keys must be in ['default','action']"
+        if key == 'default':
+            def do_get(model,res_id):
+                return self.get_defaults(cr, uid, model, condition=key2)
+        elif key == 'action':
+            def do_get(model,res_id):
+                return self.get_actions(cr, uid, action_slot=key2, model=model, res_id=res_id, context=context)
+        return self._map_legacy_model_list(models, do_get, merge_results=True)
+    
 ir_values()

=== modified file 'bin/addons/base/security/base_security.xml'
--- bin/addons/base/security/base_security.xml	2011-03-03 15:59:18 +0000
+++ bin/addons/base/security/base_security.xml	2012-05-09 12:18:18 +0000
@@ -62,6 +62,13 @@
         <field name="global" eval="True"/>
         <field name="domain_force">[('company_id','child_of',[user.company_id.id])]</field>
     </record>
+    
+    <record model="ir.rule" id="ir_values_default_rule">
+        <field name="name">Defaults: alter personal values only</field>
+        <field name="model_id" ref="model_ir_values"/>
+        <field name="domain_force">[('key','=','default'),('user_id','=',user.id)]</field>
+        <field name="perm_read" eval="False"/>
+    </record>    
 
     </data>
 </openerp>

=== modified file 'bin/addons/base/security/ir.model.access.csv'
--- bin/addons/base/security/ir.model.access.csv	2011-02-23 15:58:33 +0000
+++ bin/addons/base/security/ir.model.access.csv	2012-05-09 12:18:18 +0000
@@ -38,8 +38,7 @@
 "access_ir_ui_view_custom_group_user","ir_ui_view_custom_group_user","model_ir_ui_view_custom",,1,0,0,0
 "access_ir_ui_view_custom_group_system","ir_ui_view_custom_group_system","model_ir_ui_view_custom","group_system",1,1,1,1
 "access_ir_ui_view_sc_group_user","ir_ui_view_sc group_user","model_ir_ui_view_sc",,1,1,1,1
-"access_ir_values_group_erp_manager","ir_values group_erp_manager","model_ir_values","group_erp_manager",1,1,1,1
-"access_ir_values_group_all","ir_values group_all","model_ir_values",,1,0,1,0
+"access_ir_values_group_all","ir_values group_all","model_ir_values",,1,1,1,1
 "access_res_company_group_erp_manager","res_company group_erp_manager","model_res_company","group_erp_manager",1,1,1,1
 "access_res_company_group_user","res_company group_user","model_res_company",,1,0,0,0
 "access_res_country_group_all","res_country group_user_all","model_res_country",,1,0,0,0