From 1e42cbc1f425d31bbc83f3994f3bd8836aa201a2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Thibault=20Delavall=C3=A9e?= <tde@openerp.com>
Date: Sat, 7 Jul 2018 17:35:42 +0200
Subject: [PATCH] [FIX] mail: log correct user deleting the record

When using sudo, the administrator is logged as deleting the action.
For audit reason, log the correct user.
To avoid access rights errors, only group system can delete the action.
---
 addons/mail/models/mail_template.py       | 6 +++---
 addons/mail/views/mail_template_views.xml | 2 ++
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/addons/mail/models/mail_template.py b/addons/mail/models/mail_template.py
index 9691ed700b7..4aaada0ba56 100644
--- a/addons/mail/models/mail_template.py
+++ b/addons/mail/models/mail_template.py
@@ -252,17 +252,17 @@ class MailTemplate(models.Model):
     def unlink_action(self):
         for template in self:
             if template.ref_ir_act_window:
-                template.ref_ir_act_window.sudo().unlink()
+                template.ref_ir_act_window.unlink()
         return True
 
     @api.multi
     def create_action(self):
-        ActWindowSudo = self.env['ir.actions.act_window'].sudo()
+        ActWindow = self.env['ir.actions.act_window']
         view = self.env.ref('mail.email_compose_message_wizard_form')
 
         for template in self:
             button_name = _('Send Mail (%s)') % template.name
-            action = ActWindowSudo.create({
+            action = ActWindow.create({
                 'name': button_name,
                 'type': 'ir.actions.act_window',
                 'res_model': 'mail.compose.message',
diff --git a/addons/mail/views/mail_template_views.xml b/addons/mail/views/mail_template_views.xml
index 077f3f6105f..d54cb59c957 100644
--- a/addons/mail/views/mail_template_views.xml
+++ b/addons/mail/views/mail_template_views.xml
@@ -10,6 +10,7 @@
                         <div class="oe_button_box" name="button_box">
                             <field name="ref_ir_act_window" invisible="1"/>
                             <button class="oe_stat_button" name="create_action" type="object"
+                                    groups="base.group_system"
                                     attrs="{'invisible':[('ref_ir_act_window','!=',False)]}" icon="fa-plus"
                                     help="Display an option on related documents to open a composition wizard with this template">
                                 <div class="o_field_widget o_stat_info">
@@ -18,6 +19,7 @@
                                 </div>
                             </button>
                             <button name="unlink_action" type="object" 
+                                    groups="base.group_system"
                                     class="oe_stat_button" icon="fa-minus"
                                     attrs="{'invisible':[('ref_ir_act_window','=',False)]}"
                                     help="Remove the contextual action to use this template on related documents" widget="statinfo">