From 164feadb42a2acd7ea876e8d9aa1f0c77637ce5e Mon Sep 17 00:00:00 2001
From: RomainLibert <rli@odoo.com>
Date: Tue, 17 Sep 2019 13:30:16 +0000
Subject: [PATCH] [FIX] hr: stop planning acitivity if user has no access

Since the introduction of the public/private employee model, having an
acitivity defined on hr.employee (the private one) for an employee that
has no rights to read it is useless.

Task id 2072987

closes odoo/odoo#37021

Signed-off-by: Yannick Tivisse (yti) <yti@odoo.com>
---
 addons/hr/wizard/hr_plan_wizard.py | 25 ++++++++++++++-----------
 1 file changed, 14 insertions(+), 11 deletions(-)

diff --git a/addons/hr/wizard/hr_plan_wizard.py b/addons/hr/wizard/hr_plan_wizard.py
index cbd195a7344..7dc74bbb035 100644
--- a/addons/hr/wizard/hr_plan_wizard.py
+++ b/addons/hr/wizard/hr_plan_wizard.py
@@ -9,9 +9,9 @@ class HrPlanWizard(models.TransientModel):
     _description = 'Plan Wizard'
 
     @api.model
-    def default_get(self, fields):
-        res = super(HrPlanWizard, self).default_get(fields)
-        if (not fields or 'employee_id' in fields) and 'employee_id' not in res:
+    def default_get(self, fields_list):
+        res = super(HrPlanWizard, self).default_get(fields_list)
+        if (not fields_list or 'employee_id' in fields_list) and 'employee_id' not in res:
             if self.env.context.get('active_id'):
                 res['employee_id'] = self.env.context['active_id']
         return res
@@ -21,14 +21,17 @@ class HrPlanWizard(models.TransientModel):
 
     def action_launch(self):
         for activity_type in self.plan_id.plan_activity_type_ids:
-            self.env['mail.activity'].create({
-                'res_id': self.employee_id.id,
-                'res_model_id': self.env['ir.model']._get('hr.employee').id,
-                'summary': activity_type.summary,
-                'note': activity_type.note,
-                'activity_type_id': activity_type.activity_type_id.id,
-                'user_id': activity_type.get_responsible_id(self.employee_id).id,
-            })
+            responsible = activity_type.get_responsible_id(self.employee_id)
+
+            if self.env['hr.employee'].with_user(responsible).check_access_rights('read', raise_exception=False):
+                self.env['mail.activity'].create({
+                    'res_id': self.employee_id.id,
+                    'res_model_id': self.env['ir.model']._get('hr.employee').id,
+                    'summary': activity_type.summary,
+                    'note': activity_type.note,
+                    'activity_type_id': activity_type.activity_type_id.id,
+                    'user_id': responsible.id,
+                })
 
         return {
             'type': 'ir.actions.act_window',