From 28a9e90dce735ad74670137d8d7014180cd2fd3b Mon Sep 17 00:00:00 2001
From: uso-odoo <uso@odoo.com>
Date: Wed, 15 Jul 2020 07:34:40 +0000
Subject: [PATCH] [FIX] fleet: Fix access error on assign driver linked to
 internal user

Currently, Failing at base/models/res_partner.py#L535
We write on the partner because of the related `plan_to_change_car`

When Assign driver linked to internal user without admin rights
it gives an error in security rules due to write on partner.

So while creating the vehicle when driver is assigned pop the value
for related field plan_to_change_car and rewrite the same with sudo.

closes odoo/odoo#60358

Issue: #54199
Taskid: 2309192
X-original-commit: af21dba516de688743f75e6ffb3bc3341578e37a
Signed-off-by: Yannick Tivisse (yti) <yti@odoo.com>
Co-authored-by: LucasLefevre <lul@odoo.com>
---
 addons/fleet/models/fleet_vehicle.py     |  5 +++++
 addons/fleet/tests/__init__.py           |  4 ++++
 addons/fleet/tests/test_access_rights.py | 22 ++++++++++++++++++++++
 3 files changed, 31 insertions(+)
 create mode 100644 addons/fleet/tests/__init__.py
 create mode 100644 addons/fleet/tests/test_access_rights.py

diff --git a/addons/fleet/models/fleet_vehicle.py b/addons/fleet/models/fleet_vehicle.py
index 50ced40e3c2..6f09da7680a 100644
--- a/addons/fleet/models/fleet_vehicle.py
+++ b/addons/fleet/models/fleet_vehicle.py
@@ -214,7 +214,12 @@ class FleetVehicle(models.Model):
 
     @api.model
     def create(self, vals):
+        # Fleet administrator may not have rights to create the plan_to_change_car value when the driver_id is a res.user
+        # This trick is used to prevent access right error.
+        ptc_value = 'plan_to_change_car' in vals.keys() and {'plan_to_change_car': vals.pop('plan_to_change_car')}
         res = super(FleetVehicle, self).create(vals)
+        if ptc_value:
+            res.sudo().write(ptc_value)
         if 'driver_id' in vals and vals['driver_id']:
             res.create_driver_history(vals['driver_id'])
         if 'future_driver_id' in vals and vals['future_driver_id']:
diff --git a/addons/fleet/tests/__init__.py b/addons/fleet/tests/__init__.py
new file mode 100644
index 00000000000..ed30c97c0e0
--- /dev/null
+++ b/addons/fleet/tests/__init__.py
@@ -0,0 +1,4 @@
+# -*- coding: utf-8 -*-
+# Part of Odoo. See LICENSE file for full copyright and licensing details.
+
+from . import test_access_rights
diff --git a/addons/fleet/tests/test_access_rights.py b/addons/fleet/tests/test_access_rights.py
new file mode 100644
index 00000000000..2fc9014926a
--- /dev/null
+++ b/addons/fleet/tests/test_access_rights.py
@@ -0,0 +1,22 @@
+# -*- coding: utf-8 -*-
+# Part of Odoo. See LICENSE file for full copyright and licensing details.
+from odoo.tests import common, new_test_user
+
+
+class TestFleet(common.SavepointCase):
+
+    def test_manager_create_vehicle(self):
+        manager = new_test_user(self.env, "test fleet manager", groups="fleet.fleet_group_manager,base.group_partner_manager")
+        user = new_test_user(self.env, "test base user", groups="base.group_user")
+        brand = self.env["fleet.vehicle.model.brand"].create({
+            "name": "Audi",
+        })
+        model = self.env["fleet.vehicle.model"].create({
+            "brand_id": brand.id,
+            "name": "A3",
+        })
+        self.env["fleet.vehicle"].with_user(manager).create({
+            "model_id": model.id,
+            "driver_id": user.partner_id.id,
+            "plan_to_change_car": False
+        })