[FIX] hr: do not show employee users to portal users

When you are connected as a portal user, you can connect to the
backend of Odoo and if you go to your discuss app through the '@' icon,
you can list the employees of the company by mention a employee

This is caused by a SQL request that store in cache the employee
list to minimize requests when mention. The problem
is that those requests don't take into account the rights of a user
to read employees information.

To fix this, we are taking the group 'base.group_user' and read the
information of its users, the 'read' is respecting, the access rights of
the users, and so the employees names, are ont shown anymore to portal
users.

opw-704127

addons/hr/res_partner.py

@@ -1,6 +1,7 @@
 # -*- coding: utf-8 -*-
 
 from openerp import api, models
+from openerp.exceptions import AccessError
 
 class Partner(models.Model):
     _name = "res.partner"
@@ -11,12 +12,10 @@ class Partner(models.Model):
         """ Extend the mail's static mention suggestions by adding the employees. """
         suggestions = super(Partner, self).get_static_mention_suggestions()
 
-        employee_group_id = self.env['ir.model.data'].xmlid_to_res_id('base.group_user')
+        try:
-        self._cr.execute("""
+            employee_group = self.env.ref('base.group_user')
-            SELECT P.id, P.name, P.email
+            for user in employee_group.users:
-            FROM res_users U
+                suggestions.append((user.partner_id.id, user.name, user.email)) 
-                INNER JOIN res_groups_users_rel R ON U.id = R.uid
+            return suggestions
-                INNER JOIN res_partner P ON P.id = U.partner_id
+        except AccessError:
-            WHERE R.gid = %s AND U.active = 't'""", (employee_group_id,))
+            return suggestions
-        suggestions.append(self._cr.dictfetchall())
-        return suggestions