[SECURITY] ~fix access to pos.make.payment

[burette/coup_de_pouce_velo.git] / point_of_sale.py

diff --git a/point_of_sale.py b/point_of_sale.py
index 30a1b2c..9c9a016 100644 (file)
--- a/point_of_sale.py
+++ b/point_of_sale.py
@@ -11,12 +11,12 @@ from openerp.tools.translate import _
 class pos_order(orm.Model):
     _inherit = 'pos.order'
 
 class pos_order(orm.Model):
     _inherit = 'pos.order'
 

-    def check_partner_mobile(self, cr, uid, partner_id, context=None):
+    def check_partner_mobile(self, cr, uid, order_id, context=None):

         """Check if a partner mobile number is defined and display warning
         message if not."""
         """Check if a partner mobile number is defined and display warning
         message if not."""

-        partner_obj = self.pool.get('res.partner')
-        partner = partner_obj.browse(cr, uid, partner_id, context=context)
-        is_mobile = partner.mobile
+        order = self.browse(cr, uid, order_id, context=context)
+        is_mobile = order.partner_id.mobile
+        partner = order.partner_id

         if not is_mobile:
             warn_message = _(
                 """Mobile is required to print a «Coup de Pouce» receipt.\
         if not is_mobile:
             warn_message = _(
                 """Mobile is required to print a «Coup de Pouce» receipt.\


@@ -27,26 +27,17 @@ class pos_order(orm.Model):
                 warn_message)
         return True
 
                 warn_message)
         return True
 

-    _columns = {
-        'is_cpv': fields.boolean('"Coup de Pouce Velo"?', change_default=True),
-    }
-
-    def create(self, cr, uid, vals, context=None):
-        if 'partner_id' in vals:
-            partner_id = vals['partner_id']
-            if 'is_cpv' in vals:
-                if vals['is_cpv']:
-                    self.check_partner_mobile(cr, uid, partner_id, context)
-        return super(pos_order, self).create(
-            cr, uid, vals, context=context
-        )
-

     def write(self, cr, uid, ids, vals, context=None):
         order = self.browse(cr, uid, ids[0], context=context)
     def write(self, cr, uid, ids, vals, context=None):
         order = self.browse(cr, uid, ids[0], context=context)

+        order_id = order.id

         partner_id = order.partner_id.id
         partner_id = order.partner_id.id

-        if 'is_cpv' in vals:
-            if vals['is_cpv']:
-                self.check_partner_mobile(cr, uid, partner_id, context)
+        statements = order.statement_ids
+        is_cpv = 0
+        for statement in statements:
+            if statement.journal_id.is_cpv:
+                is_cpv +=1
+        if is_cpv:
+            self.check_partner_mobile(cr, uid, order_id, context)

         return super(pos_order, self).write(
             cr, uid, ids, vals, context=context
         )
         return super(pos_order, self).write(
             cr, uid, ids, vals, context=context
         )