Tasks in Kanban View: card rearrangement error when Project/User is only authorized to modify his own tasks

Question

This happens when a Project/User drops his task unto a destination stage containing tasks not owned by him.

Apparently, Odoo remembers the stack ordering of tasks within a stage via project.task.sequence, and updates all the task cards' sequence fields when the Project/User completes the drop action. But since the Project/User is not authorized to modify other users' tasks (of project.task object type). The Odoo server raises the exception shown below.

Access restriction is implemented via the following record rule for Project/User:

Name: Project/Task: only assignee and creator can modify task
Object: Task (project.task)
Apply for: Write
Domain filter: ['|',('user_id','=',user.id),('create_uid','=',user.id)] 
Group name: Project/User

Is there any workaround to this problem?

At time of writing, the error can be reproduced at http://demo.odoo.com currently running Odoo version 8.saas~6.

Note that by default Human Resources / Employees are allowed to modify tasks not assigned to them, so the write and delete access of record rule "Project/Task: employees: public, portal, employee or (followers and following)" must first be removed.

silvernightstar silvernightstar · Accepted Answer · 2015-08-24T09:35:48

Couldn't think of a better solution, so I just did the following hack instead:

Add to top portion of _write function of openerp.models.BaseModel in the file ODOO_ROOT/models.py:

def _write(self, cr, user, ids, vals, context=None):
    # use admin if just writing to 'sequence' field of model 'project.task'
    if self._name == 'project.task' and vals.keys() == ['sequence']:
        user = SUPERUSER_ID

This is probably OK since the sequence field is not really a very important field to protect from casual modification by non-owners.

Tasks in Kanban View: card rearrangement error when Project/User is only authorized to modify his own tasks

1 Answers