[15.0] groups attribute is ignored in list view with the states attribute

[adrienpeiffer]

Impacted versions:

15.0

Groups attributes are evaluated here :

odoo/odoo/addons/base/models/ir_ui_view.py

Line 1066 in 5e6f4d3

self._apply_groups(node, name_manager, node_info)

Basically, if the user hasn't the requested group, invisible is set to true in the modifiers dict

odoo/odoo/addons/base/models/ir_ui_view.py

Line 995 in 5e6f4d3

node_info['modifiers']['invisible'] = True

states attributes are evaluated just after. Basially, if invisible already exists and is not an instance of a list, Odoo just replace the value in invisible by the domain related to the states attribute.

odoo/odoo/addons/base/models/ir_ui_view.py

Line 95 in 5e6f4d3

modifiers['invisible'] = [('state', 'not in', node.get('states').split(','))]

Conclusion :

If the user hasn't the requested group but if the object is in the states requested by the states attribute, the node is displayed to the user in the list view.

Video/Screenshot link (optional):

An exemple in the time off module : https://youtu.be/fNzzJiP2S8Q

Support ticket number submitted via odoo.com/help (optional): OPW #2976708

[yelizariev]

It looks as a bug indeed.

The view from the video:

odoo/addons/hr_holidays/views/hr_leave_views.xml

Lines 531 to 538 in dffa40f

	<button string="Validate" name="action_validate" type="object"
	icon="fa-check"
	states="validate1"
	groups="hr_holidays.group_hr_holidays_manager"/>
	<button string="Refuse" name="action_refuse" type="object"
	icon="fa-times"
	states="confirm,validate1"
	groups="hr_holidays.group_hr_holidays_manager"/>

[yelizariev]

This problem is fixed in master (v16), where groups are applied at the last moment: 1744870

Potential solution for v15 could be changing order of calls _apply_groups and transfer_node_to_modifiers.

odoo/odoo/addons/base/models/ir_ui_view.py

Lines 1066 to 1067 in 5e6f4d3

	self._apply_groups(node, name_manager, node_info)
	transfer_node_to_modifiers(node, node_info['modifiers'], self._context)

However, it will change visibility of existing views, which is not something that users may expect. Imagine a company with a "Time off officier" user. They do Validation without knowing that they need Administrator access level for that. Then one day they open Time Off menu and find no Validate/Refuse buttons.

For this reason we can't fix it in stable. If you need to use states with groups in your custom modules, you should try some workarounds (e.g. add such buttons via extension view with field groups_id)

PS I'd keep this issue open to track this issue, post more info on workarounds, etc.

[adrienpeiffer]

Yes, It'll change the visibility of existing views because it's the bug. For the moment, the user which hasn't the right to validate the leave can do it because of this bug. You cannot assume that users consider the bug as a default behavior.

[yelizariev]

I ask my colleagues to review my conclusion.

@nle-odoo ?

[adrienpeiffer]

Replace states attribute by attrs should make the job. Please fix it.

[Malek907]

Hello , any news about this bug ?

[Malek907]

@Yenthe666 Can you check this bug please