From c39d40f98d4b27adfe0c5ca51d0373e44f176f32 Mon Sep 17 00:00:00 2001
From: Nicolas Lempereur <nle@odoo.com>
Date: Mon, 14 May 2018 13:14:04 +0200
Subject: [PATCH 1/2] [FIX] hr_recruitment: job stages choosen manually

In 9.0, stages of a job position in recruitment are not share by
default, there is a "New" stage and existing stages can be added in the
form view (since 780f46ae).

When creating a job position, the "New" is not working with the given
widget type.

This commit doesn't show stages in the form view until the record is
created.

opw-1839217
closes #24706
---
 addons/hr_recruitment/views/hr_recruitment_views.xml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/addons/hr_recruitment/views/hr_recruitment_views.xml b/addons/hr_recruitment/views/hr_recruitment_views.xml
index 73276d83556..f66ca6224bd 100644
--- a/addons/hr_recruitment/views/hr_recruitment_views.xml
+++ b/addons/hr_recruitment/views/hr_recruitment_views.xml
@@ -408,7 +408,9 @@
                     <field name="address_id" context="{'show_address': 1}" domain= "[('is_company', '=', True )]" options="{'always_reload': True}"/>
                 </group>
                 <group colspan="2">
-                    <field name="stage_ids" widget="many2many_tags" options="{'no_create': True}" />
+                    <!-- ONLY FOR 9.0 -->
+                    <field name="id" invisible="1"/>
+                    <field name="stage_ids" widget="many2many_tags" options="{'no_create': True}" attrs="{'invisible': [('id', '=', False)]}"/>
                 </group>
             </group>
             <xpath expr="//field[@name='department_id']" position="after">

From 19878d011f8abdc737b7b702c4c79632670d4b78 Mon Sep 17 00:00:00 2001
From: RomainLibert <rli@odoo.com>
Date: Mon, 14 May 2018 15:51:51 +0200
Subject: [PATCH 2/2] [FIX] event: fix bug with users

We need to fix a problem with the users where someone might get
informations on registrations.
---
 addons/event/security/ir.model.access.csv     | 4 ++--
 addons/website_event/controllers/main.py      | 2 +-
 addons/website_event_sale/controllers/main.py | 2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/addons/event/security/ir.model.access.csv b/addons/event/security/ir.model.access.csv
index 8801c173f17..35f82422352 100644
--- a/addons/event/security/ir.model.access.csv
+++ b/addons/event/security/ir.model.access.csv
@@ -5,8 +5,8 @@ access_event_event,event.event,model_event_event,event.group_event_user,1,1,1,1
 access_event_registration,event.registration,model_event_registration,event.group_event_user,1,1,1,1
 access_report_event_registration,report.event.registration,model_report_event_registration,event.group_event_user,1,1,1,1
 access_event_event_portal,event.event,model_event_event,,1,0,0,0
-access_event_registration_portal,event.registration,model_event_registration,,1,0,0,0
+access_event_registration_portal,event.registration,model_event_registration,,0,0,0,0
 access_event_mail,event.mail,model_event_mail,event.group_event_user,1,0,0,0
 access_event_mail_manager,event.mail manager,model_event_mail,event.group_event_manager,1,1,1,1
 access_event_mail_registration,event.mail.registration,model_event_mail_registration,event.group_event_user,1,0,0,0
-access_event_mail_registration_manager,event.mail.registration.manager,model_event_mail_registration,event.group_event_manager,1,1,1,1
\ No newline at end of file
+access_event_mail_registration_manager,event.mail.registration.manager,model_event_mail_registration,event.group_event_manager,1,1,1,1
diff --git a/addons/website_event/controllers/main.py b/addons/website_event/controllers/main.py
index 6df93deca78..42ce0f704c3 100644
--- a/addons/website_event/controllers/main.py
+++ b/addons/website_event/controllers/main.py
@@ -286,7 +286,7 @@ class website_event(http.Controller):
                     Registration._prepare_attendee_values(cr, uid, registration),
                     context=context))
 
-        attendees = Registration.browse(cr, uid, registration_ids, context=context)
+        attendees = Registration.browse(cr, uid, registration_ids, context=context).sudo()
         return request.website.render("website_event.registration_complete", {
             'attendees': attendees,
             'event': event,
diff --git a/addons/website_event_sale/controllers/main.py b/addons/website_event_sale/controllers/main.py
index 99681dcb4a5..c9bae3a52a9 100644
--- a/addons/website_event_sale/controllers/main.py
+++ b/addons/website_event_sale/controllers/main.py
@@ -48,7 +48,7 @@ class website_event(website_event):
         # free tickets -> order with amount = 0: auto-confirm, no checkout
         if not order.amount_total:
             order.action_confirm()  # tde notsure: email sending ?
-            attendees = request.registry['event.registration'].browse(cr, uid, list(attendee_ids), context=context)
+            attendees = request.registry['event.registration'].browse(cr, uid, list(attendee_ids), context=context).sudo()
             # clean context and session, then redirect to the confirmation page
             request.website.sale_reset(context=context)
             return request.website.render("website_event.registration_complete", {