[FIX] base_company_dependent: protect company_dependent M2o fields fr…#406
Closed
lef-adhoc wants to merge 1 commit into
Closed
[FIX] base_company_dependent: protect company_dependent M2o fields fr…#406lef-adhoc wants to merge 1 commit into
lef-adhoc wants to merge 1 commit into
Conversation
Contributor
|
|
lef-adhoc
added a commit
to adhoc-dev/miscellaneous
that referenced
this pull request
Jun 9, 2026
…adius docs, Odoo 19 su fix Closes all open points from jjs's review on PR ingadhoc#406: 1. End-to-end tests that run without `account` - Add `bcd_test_cd_partner_id` (company_dependent M2o → res.partner) on `res.partner` via `_inherit` as a test-only field; no new table. - Add `TestCompanyCrossCheckEndToEnd` with 11 tests covering: write() / create() / load() end-to-end, company_id=False no-false-positive, and sibling-branch domain behavior (adaptive: introspects _check_company_domain and locks whatever behavior is current). - Tests always run in CI base-only (no account dependency). 2. Odoo 19 su=False fix - `Environment.__new__` in Odoo 19 forces su=True for uid==SUPERUSER_ID. Replaced `env(su=False)` with `env(user=base.user_admin)` (uid=2, guaranteed su=False) so the guard is correctly exercised. 3. Blast-radius documentation in models/base.py - Docstring: explicit warning that write/create overrides run on every model and every non-sudo write in the entire fleet. - Comment on `if not self.env.su`: documented as deliberate (not an oversight), with rationale and trade-off noted. - Docstring on `_check_company_dependent_m2o`: performance note and complete list of handled edge cases. 4. Version bump 1.1.0 → 1.2.0 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
lef-adhoc
force-pushed
the
19.0-t-62339-lef
branch
7 times, most recently
from
5a8cea9 to
b4dda27
Compare
…ependent M2o Validate on write/create/import that a company_dependent Many2one is not set to a record owned by another company (non-sudo writes only). Covered by E2E tests through write/create/load and multi-branch scenarios, using a transient test model so the suite runs without depending on account. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
lef-adhoc
force-pushed
the
19.0-t-62339-lef
branch
from
b4dda27 to
491e920
Compare
Contributor
|
@roboadhoc r+ nobump |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
…om cross-company writes
Adds validation in the base ORM write/create to prevent a company_dependent Many2one field from being set to a record belonging to a different company than env.company. Without this fix, importing a product with an account from Company A while logged into Company B silently contaminated the JSONB column, causing "Invalid Operation" errors when creating invoices.
Odoo's built-in check_company mechanism skips company_dependent fields unless they are explicitly annotated with check_company=True (which most fields are not). This fix closes that gap transparently for all models without requiring per-field annotation. sudo() context is exempt to allow administrative and migration operations.
Also merges the two base-inheriting classes in the module into one file (resolves pylint R8180).