From 2d32609440239bd284fd472851a5c7936aa516ed Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Thibault=20Delavall=C3=A9e?= <tde@odoo.com>
Date: Sat, 7 Jul 2018 17:35:42 +0200
Subject: [PATCH] [FIX] mail: log correct user deleting the record

When using sudo, the administrator is logged as deleting the action.
For audit reason, log the correct user.
To avoid access rights errors, only group system can delete the action.
---
 addons/mail/models/mail_template.py       | 12 ++++++------
 addons/mail/views/mail_template_views.xml |  7 +++++--
 2 files changed, 11 insertions(+), 8 deletions(-)

diff --git a/addons/mail/models/mail_template.py b/addons/mail/models/mail_template.py
index 37215829bb8..f6022522b2a 100644
--- a/addons/mail/models/mail_template.py
+++ b/addons/mail/models/mail_template.py
@@ -262,22 +262,22 @@ class MailTemplate(models.Model):
     def unlink_action(self):
         for template in self:
             if template.ref_ir_act_window:
-                template.ref_ir_act_window.sudo().unlink()
+                template.ref_ir_act_window.unlink()
             if template.ref_ir_value:
-                template.ref_ir_value.sudo().unlink()
+                template.ref_ir_value.unlink()
         return True
 
     @api.multi
     def create_action(self):
-        ActWindowSudo = self.env['ir.actions.act_window'].sudo()
-        IrValuesSudo = self.env['ir.values'].sudo()
+        ActWindow = self.env['ir.actions.act_window']
+        IrValues = self.env['ir.values']
         view = self.env.ref('mail.email_compose_message_wizard_form')
 
         for template in self:
             src_obj = template.model_id.model
 
             button_name = _('Send Mail (%s)') % template.name
-            action = ActWindowSudo.create({
+            action = ActWindow.create({
                 'name': button_name,
                 'type': 'ir.actions.act_window',
                 'res_model': 'mail.compose.message',
@@ -288,7 +288,7 @@ class MailTemplate(models.Model):
                 'view_id': view.id,
                 'target': 'new',
             })
-            ir_value = IrValuesSudo.create({
+            ir_value = IrValues.create({
                 'name': button_name,
                 'model': src_obj,
                 'key2': 'client_action_multi',
diff --git a/addons/mail/views/mail_template_views.xml b/addons/mail/views/mail_template_views.xml
index 483c80ae394..4306f1fe8d1 100644
--- a/addons/mail/views/mail_template_views.xml
+++ b/addons/mail/views/mail_template_views.xml
@@ -9,7 +9,9 @@
                     <sheet>
                         <div class="oe_button_box" name="button_box">
                             <field name="ref_ir_act_window" invisible="1"/>
-                            <button class="oe_stat_button" name="create_action" type="object"
+                            <button class="oe_stat_button"
+                                    groups="base.group_system"
+                                    name="create_action" type="object"
                                     attrs="{'invisible':[('ref_ir_act_window','!=',False)]}" icon="fa-plus"
                                     help="Display an option on related documents to open a composition wizard with this template">
                                 <div class="o_form_field o_stat_info">
@@ -17,7 +19,8 @@
                                     <span class="o_stat_text">Context Action</span>
                                 </div>
                             </button>
-                            <button name="unlink_action" type="object" 
+                            <button name="unlink_action" type="object"
+                                    groups="base.group_system"
                                     class="oe_stat_button" icon="fa-minus"
                                     attrs="{'invisible':[('ref_ir_act_window','=',False)]}"
                                     help="Remove the contextual action to use this template on related documents" widget="statinfo">