[8.0] pos_pricelist: multi-company problem about pos

[pedrobaeza]

@AdilHoumadi @legalsylvain, can you please check it?

[legalsylvain]

Hi @pedrobaeza,
I personaly use Odoo in multicompany context (20 companies), but without account.fiscal.position.tax. Well, maybe my question is irrelevant but don't you have to fix your problem with correct access right on account.fiscal.position.tax model ? or maybe there is some uid==1 hack in the JS ?

[pedrobaeza]

The problem is that the object account.fiscal.position.tax doesn't have company_id. It's the model account.fiscal.position which has it. Reading all of them, you finally end with an access error over this parent object, because the code access to it in some moment, but I get lost in the JS code.

[legalsylvain]

Ok !

At first analysis, i consider that it's a core bug. (account module)

• account.fiscal.position has company_id
• account.fiscal.position.tax has no company_id field
• account.fiscal.position has a one2many field to account.fiscal.position.tax

It's bad designed. It's not ? And this bug could occure in any module that use both models, not specially pos_pricelist.
Odoo is full of that kind of bugs, specially in PoS.

So I would fix your problem, adding a 'company_id' field on account.fiscal.position.tax related to the company_id field or the parent account.fiscal.position. (store = true)

What do you think ?

If you're agree, the next question is where to fix this bug. I guess not in this module but in an account_multicompany module. don't you think ?

regards.

[pedrobaeza]

Well, it's the same as putting company_id on account.invoice.line, sale.order.line. They shouldn't have it because you usually access them through the main object, not directly, but when you access directly, you take into account the company of the header. Something similar should be done here: get the fiscal positions for the company, and search for the taxes lines for that fiscal positions.

[legalsylvain]

Well,

Sorry to insist, but in fact there are company_id fields on both models you mentioned. My PoV is that you should have company_id (and rules) defined for two reasons :

• in some use cases, it's necessary to access to the line directly. (existing exemple is : to invoice sale order lines);
• in any cases, for security reasons ;

ref : (V 8.0 series)

• account.invoice.line : https://github.com/odoo/odoo/blob/8.0/addons/account/account_invoice.py#L1289
• sale.order.line : https://github.com/odoo/odoo/blob/8.0/addons/sale/sale.py#L944

Well, if you can access to an object (account.fiscal.position.tax) that is linked to an other object you can't access (account.fiscal.position.tax), the access rules are not consistent.

Don't you think ?

[pedrobaeza]

Yeah, both are related fields. Maybe we can add them in this module. If other modules need them, they will add the same field, overwriting it, and create the same rule as duplicated, but no problem on that. I'll try and tell you.

[pedrobaeza]

Here is the corresponding PR that solves it: #85

[flotho]

Hi,

From my point of view the model account.fiscal.position.account should also have the same kind of access rule.
regards

[legalsylvain]

account.fiscal.position.account Model is not loaded by pos_pricelist, doesn't it ?

[flotho]

@legalsylvain you're right, I'm too excessive maybe ;-)