0

This happens when a Project/User drops his task unto a destination stage containing tasks not owned by him.

Apparently, Odoo remembers the stack ordering of tasks within a stage via project.task.sequence, and updates all the task cards' sequence fields when the Project/User completes the drop action. But since the Project/User is not authorized to modify other users' tasks (of project.task object type). The Odoo server raises the exception shown below.

enter image description here

Access restriction is implemented via the following record rule for Project/User:

Name: Project/Task: only assignee and creator can modify task
Object: Task (project.task)
Apply for: Write
Domain filter: ['|',('user_id','=',user.id),('create_uid','=',user.id)] 
Group name: Project/User

Is there any workaround to this problem?

At time of writing, the error can be reproduced at http://demo.odoo.com currently running Odoo version 8.saas~6.

Note that by default Human Resources / Employees are allowed to modify tasks not assigned to them, so the write and delete access of record rule "Project/Task: employees: public, portal, employee or (followers and following)" must first be removed.

1 Answer 1

0

Couldn't think of a better solution, so I just did the following hack instead:

Add to top portion of _write function of openerp.models.BaseModel in the file ODOO_ROOT/models.py:

def _write(self, cr, user, ids, vals, context=None):
    # use admin if just writing to 'sequence' field of model 'project.task'
    if self._name == 'project.task' and vals.keys() == ['sequence']:
        user = SUPERUSER_ID

This is probably OK since the sequence field is not really a very important field to protect from casual modification by non-owners.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.