From 40a299c580c4608edab8781fda4e66f39611543b Mon Sep 17 00:00:00 2001 From: Martin Trigaux Date: Thu, 24 Mar 2016 16:46:48 +0100 Subject: [PATCH] [FIX] base: mildly privileged user accessing partner form A user in base.group_erp_manager (Access Rights) but NOT in base.group_system (Settings), will try to fetch the list of groups to generate selection fields to represent groups selection. As the method `_is_admin` only verifies the user belongs to group_erp_manager and the model ir.module.category requires group_system for read access rights, `fields_get` method tries to fetch the groups and fails with a security warning. The user fields are fetched when a res.partner form is loaded as the field user_ids (one2many) is present in the form view of partner in invisible. opw-672435 --- openerp/addons/base/res/res_users.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/openerp/addons/base/res/res_users.py b/openerp/addons/base/res/res_users.py index 5ae88f74145..da850eb11ed 100644 --- a/openerp/addons/base/res/res_users.py +++ b/openerp/addons/base/res/res_users.py @@ -945,7 +945,7 @@ class users_view(osv.osv): # add reified groups fields if not self.pool['res.users']._is_admin(cr, uid, [uid]): return res - for app, kind, gs in self.pool['res.groups'].get_groups_by_application(cr, uid, context): + for app, kind, gs in self.pool['res.groups'].get_groups_by_application(cr, SUPERUSER_ID, context): if kind == 'selection': # selection group field tips = ['%s: %s' % (g.name, g.comment) for g in gs if g.comment]