From 3ff242ec0c48125c958d5c512e942cce73effe76 Mon Sep 17 00:00:00 2001 From: Olivier Dony Date: Wed, 20 Jul 2016 21:19:04 +0200 Subject: [PATCH] [FIX] portal: avoid users sharing non-portal groups --- addons/portal/wizard/portal_wizard.py | 3 +++ 1 file changed, 3 insertions(+) diff --git a/addons/portal/wizard/portal_wizard.py b/addons/portal/wizard/portal_wizard.py index 670b563d99f..13e2d4830a2 100644 --- a/addons/portal/wizard/portal_wizard.py +++ b/addons/portal/wizard/portal_wizard.py @@ -123,12 +123,15 @@ class wizard_user(osv.osv_memory): return error_msg def action_apply(self, cr, uid, ids, context=None): + self.pool['res.partner'].check_access_rights(cr, uid, 'write') error_msg = self.get_error_messages(cr, uid, ids, context=context) if error_msg: raise UserError( "\n\n".join(error_msg)) for wizard_user in self.browse(cr, SUPERUSER_ID, ids, dict(context, active_test=False)): portal = wizard_user.wizard_id.portal_id + if not portal.is_portal: + raise UserError('Not a portal: ' + portal.name) user = wizard_user.partner_id.user_ids and wizard_user.partner_id.user_ids[0] or False if wizard_user.partner_id.email != wizard_user.email: wizard_user.partner_id.write({'email': wizard_user.email})