[ThiagoMForgeFlow]

When a portal user creates a task, or changes its stage, the default users are read from the stage/project default_user_ids and written to user_ids. Portal users can't do either: the field domain searches res.groups and user_ids is not portal writable. Both raise AccessError.

Default users are now applied with sudo(), as the core already does in project.task.create for values the portal user can't write. A portal test is added.

Depends on #1875 : the portal test also goes through project_task_code's create, which fails for portal users until that fix is merged.

@ForgeFlow

[OCA-git-bot]

Hi @NICO-SOLUTIONS,
some modules you are maintaining are being modified, check this out!

[NICO-SOLUTIONS]

@ThiagoMForgeFlow
Portal task creation wasn't really in the scope of the module, but hey, it makes sense! I’ll check it ASAP.

[AaronHForgeFlow]

LGTM when CI is green

[NICO-SOLUTIONS]

@ThiagoMForgeFlow

LGTM!
I agree with the approach. Odoo core already uses sudo() for similar operations triggered by portal users, so I don't see a specific security issue here. The actual create() and write() operations are still performed with the original user's permissions.

I tested this from portal and can confirm, that the automatic assignment works as expected and that any direct assignment attempts by the portal user raise an AccessError.

Since the project code fix hasn't been merged yet, we could consider adding the suggested test before merging.

Also, feel free to add yourself to CONTRIBUTORS.md if you’d like!

[NICO-SOLUTIONS]

Suggested change

	from odoo.tests import new_test_user
	from odoo.exceptions import AccessError
	from odoo.tests import new_test_user

[NICO-SOLUTIONS]

Suggested change

	self.assertEqual(task.user_ids.ids, [self.user2.id])
	self.assertEqual(task.user_ids.ids, [self.user2.id])
	def test_portal_cannot_assign_users_directly(self):
	portal_user = new_test_user(
	self.env, login="default_user_portal_security", groups="base.group_portal"
	)
	self.project_with_default.write(
	{
	"privacy_visibility": "portal",
	"collaborator_ids": [
	Command.create({"partner_id": portal_user.partner_id.id})
	],
	}
	)
	self.project_with_default.message_subscribe(
	partner_ids=portal_user.partner_id.ids
	)
	Task = (
	self.env["project.task"]
	.with_user(portal_user)
	.with_context(default_project_id=self.project_with_default.id)
	)
	self.assertFalse(Task._has_field_access(Task._fields["user_ids"], "write"))
	with self.assertRaises(AccessError):
	Task.create(
	{
	"name": "Portal task with explicit users",
	"user_ids": [Command.set([self.user1.id])],
	}
	)
	task = Task.create(
	{"name": "Portal task", "stage_id": self.stage_without_default.id}
	)
	with self.assertRaises(AccessError):
	task.write({"user_ids": [Command.set([self.user1.id])]})