From 3ea3be637406905e2d05aff6b753448b6be2a6b1 Mon Sep 17 00:00:00 2001
From: "Adrien Peiffer (ACSONE)" <adrien.peiffer@acsone.eu>
Date: Tue, 18 Apr 2017 14:34:57 +0200
Subject: [PATCH] [IMP] hr_holidays: move security check in separated method.

Closes #16792
Closes #16491
opw-740246
---
 addons/hr_holidays/models/hr_holidays.py | 22 +++++++++++++++++-----
 1 file changed, 17 insertions(+), 5 deletions(-)

diff --git a/addons/hr_holidays/models/hr_holidays.py b/addons/hr_holidays/models/hr_holidays.py
index eff33ce5af3..ca6e4fa9362 100644
--- a/addons/hr_holidays/models/hr_holidays.py
+++ b/addons/hr_holidays/models/hr_holidays.py
@@ -419,12 +419,16 @@ class Holidays(models.Model):
             raise UserError(_('Leave request must be in Draft state ("To Submit") in order to confirm it.'))
         return self.write({'state': 'confirm'})
 
+    @api.multi
+    def _check_security_action_approve(self):
+        if not self.env.user.has_group('hr_holidays.group_hr_holidays_user'):
+            raise UserError(_('Only an HR Officer or Manager can approve leave requests.'))
+
     @api.multi
     def action_approve(self):
         # if double_validation: this method is the first approval approval
         # if not double_validation: this method calls action_validate() below
-        if not self.env.user.has_group('hr_holidays.group_hr_holidays_user'):
-            raise UserError(_('Only an HR Officer or Manager can approve leave requests.'))
+        self._check_security_action_approve()
 
         current_employee = self.env['hr.employee'].search([('user_id', '=', self.env.uid)], limit=1)
         for holiday in self:
@@ -454,10 +458,14 @@ class Holidays(models.Model):
         return values
 
     @api.multi
-    def action_validate(self):
+    def _check_security_action_validate(self):
         if not self.env.user.has_group('hr_holidays.group_hr_holidays_user'):
             raise UserError(_('Only an HR Officer or Manager can approve leave requests.'))
 
+    @api.multi
+    def action_validate(self):
+        self._check_security_action_validate()
+
         current_employee = self.env['hr.employee'].search([('user_id', '=', self.env.uid)], limit=1)
         for holiday in self:
             if holiday.state not in ['confirm', 'validate1']:
@@ -516,8 +524,7 @@ class Holidays(models.Model):
 
     @api.multi
     def action_refuse(self):
-        if not self.env.user.has_group('hr_holidays.group_hr_holidays_user'):
-            raise UserError(_('Only an HR Officer or Manager can refuse leave requests.'))
+        self._check_security_action_refuse()
 
         current_employee = self.env['hr.employee'].search([('user_id', '=', self.env.uid)], limit=1)
         for holiday in self:
@@ -536,6 +543,11 @@ class Holidays(models.Model):
         self._remove_resource_leave()
         return True
 
+    @api.multi
+    def _check_security_action_refuse(self):
+        if not self.env.user.has_group('hr_holidays.group_hr_holidays_user'):
+            raise UserError(_('Only an HR Officer or Manager can refuse leave requests.'))
+
     ####################################################
     # Messaging methods
     ####################################################