From 6f26a5f7b286cd456064c24c7fd33ab6f2bf32dd Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Krier?= <ced@b2ck.com>
Date: Mon, 22 May 2017 18:01:10 +0200
Subject: [PATCH] Ensure timesheet_works return only employee's company works

It can not rely on the record rule to return the right list of works because
user from the admin group does not have the record rule.

issue6505
review40361002
---
 routes.py | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/routes.py b/routes.py
index 98179ffab5..160a14e41a 100644
--- a/routes.py
+++ b/routes.py
@@ -33,7 +33,9 @@ def timesheet_works(request, pool, employee):
     employee = Employee(employee)
     with Transaction().set_context(
             company=employee.company.id, employee=employee.id):
-        works = Work.search([])
+        works = Work.search([
+                ('company', '=', employee.company.id),
+                ])
     return [{
             'id': w.id,
             'name': w.rec_name,