Merge PR #134 into 15.0

Signed-off-by pedrobaeza

resource_booking/migrations/15.0.1.4.0/noupdate_changes.xml

@@ -0,0 +1,13 @@
+<?xml version='1.0' encoding='utf-8' ?>
+<odoo>
+    <record id="rule_resource_booking_portal" model="ir.rule">
+        <field
+            name="domain_force"
+        >['|', ('partner_ids', 'child_of', user.partner_id.ids), ('message_partner_ids', 'child_of', user.partner_id.ids)]</field>
+    </record>
+    <record id="rule_resource_booking_user" model="ir.rule">
+        <field
+            name="domain_force"
+        >['|', '|', ('partner_ids', 'child_of', user.partner_id.ids), ('message_partner_ids', 'child_of', user.partner_id.ids), ('combination_id.resource_ids.user_id', 'in', user.ids)]</field>
+    </record>
+</odoo>

resource_booking/migrations/15.0.1.4.0/post-migration.py

@@ -17,3 +17,6 @@ def convert_resource_booking_partners(env):
 def migrate(env, version):
     """Put partner_id in partner_ids"""
     convert_resource_booking_partners(env)
+    openupgrade.load_data(
+        env.cr, "resource_booking", "migrations/15.0.1.4.0/noupdate_changes.xml"
+    )

resource_booking/models/resource_booking.py

@@ -127,6 +127,7 @@ class ResourceBooking(models.Model):
         comodel_name="res.partner",
         compute="_compute_partner_id",
         inverse="_inverse_partner_id",
+        search="_search_partner_id",
         readonly=False,
         string="Requester",
     )
@@ -228,6 +229,14 @@ def _inverse_partner_id(self):
         for one in self:
             one.partner_ids = one.partner_id
 
+    @api.model
+    def _search_partner_id(self, operator, value):
+        """Overwrite this for security, partner_id field is not stored and if we search
+        for it by mistake (or out of ignorance) we will get all the records.
+        To avoid this behavior, we search for the correct field: partner_ids
+        """
+        return [("partner_ids", operator, value)]
+
     @api.model
     def _default_user_id(self):
         return self.env.user