From 19878d011f8abdc737b7b702c4c79632670d4b78 Mon Sep 17 00:00:00 2001
From: RomainLibert <rli@odoo.com>
Date: Mon, 14 May 2018 15:51:51 +0200
Subject: [PATCH] [FIX] event: fix bug with users

We need to fix a problem with the users where someone might get
informations on registrations.
---
 addons/event/security/ir.model.access.csv     | 4 ++--
 addons/website_event/controllers/main.py      | 2 +-
 addons/website_event_sale/controllers/main.py | 2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/addons/event/security/ir.model.access.csv b/addons/event/security/ir.model.access.csv
index 8801c173f17..35f82422352 100644
--- a/addons/event/security/ir.model.access.csv
+++ b/addons/event/security/ir.model.access.csv
@@ -5,8 +5,8 @@ access_event_event,event.event,model_event_event,event.group_event_user,1,1,1,1
 access_event_registration,event.registration,model_event_registration,event.group_event_user,1,1,1,1
 access_report_event_registration,report.event.registration,model_report_event_registration,event.group_event_user,1,1,1,1
 access_event_event_portal,event.event,model_event_event,,1,0,0,0
-access_event_registration_portal,event.registration,model_event_registration,,1,0,0,0
+access_event_registration_portal,event.registration,model_event_registration,,0,0,0,0
 access_event_mail,event.mail,model_event_mail,event.group_event_user,1,0,0,0
 access_event_mail_manager,event.mail manager,model_event_mail,event.group_event_manager,1,1,1,1
 access_event_mail_registration,event.mail.registration,model_event_mail_registration,event.group_event_user,1,0,0,0
-access_event_mail_registration_manager,event.mail.registration.manager,model_event_mail_registration,event.group_event_manager,1,1,1,1
\ No newline at end of file
+access_event_mail_registration_manager,event.mail.registration.manager,model_event_mail_registration,event.group_event_manager,1,1,1,1
diff --git a/addons/website_event/controllers/main.py b/addons/website_event/controllers/main.py
index 6df93deca78..42ce0f704c3 100644
--- a/addons/website_event/controllers/main.py
+++ b/addons/website_event/controllers/main.py
@@ -286,7 +286,7 @@ class website_event(http.Controller):
                     Registration._prepare_attendee_values(cr, uid, registration),
                     context=context))
 
-        attendees = Registration.browse(cr, uid, registration_ids, context=context)
+        attendees = Registration.browse(cr, uid, registration_ids, context=context).sudo()
         return request.website.render("website_event.registration_complete", {
             'attendees': attendees,
             'event': event,
diff --git a/addons/website_event_sale/controllers/main.py b/addons/website_event_sale/controllers/main.py
index 99681dcb4a5..c9bae3a52a9 100644
--- a/addons/website_event_sale/controllers/main.py
+++ b/addons/website_event_sale/controllers/main.py
@@ -48,7 +48,7 @@ class website_event(website_event):
         # free tickets -> order with amount = 0: auto-confirm, no checkout
         if not order.amount_total:
             order.action_confirm()  # tde notsure: email sending ?
-            attendees = request.registry['event.registration'].browse(cr, uid, list(attendee_ids), context=context)
+            attendees = request.registry['event.registration'].browse(cr, uid, list(attendee_ids), context=context).sudo()
             # clean context and session, then redirect to the confirmation page
             request.website.sale_reset(context=context)
             return request.website.render("website_event.registration_complete", {