[FIX] portal: avoid users sharing non-portal groups

2016-07-25 13:05:01 +02:00
parent 4c9a0682b3
commit 3ff242ec0c
1 changed files with 3 additions and 0 deletions
@@ -123,12 +123,15 @@ class wizard_user(osv.osv_memory):
        return error_msg

    def action_apply(self, cr, uid, ids, context=None):
+        self.pool['res.partner'].check_access_rights(cr, uid, 'write')
        error_msg = self.get_error_messages(cr, uid, ids, context=context)
        if error_msg:
            raise UserError( "\n\n".join(error_msg))

        for wizard_user in self.browse(cr, SUPERUSER_ID, ids, dict(context, active_test=False)):
            portal = wizard_user.wizard_id.portal_id
+            if not portal.is_portal:
+                raise UserError('Not a portal: ' + portal.name)
            user = wizard_user.partner_id.user_ids and wizard_user.partner_id.user_ids[0] or False
            if wizard_user.partner_id.email != wizard_user.email:
                wizard_user.partner_id.write({'email': wizard_user.email})