[FIX] website_sale_delivery: use sudo mode for reading carrier info
The "delivery" module restricts the access to delivery.carrier objects. There is no reason to relax this in website_sale_delivery. Furthermore, nearly all the code of website_sale_delivery accesses delivery.carrier in sudo mode already. Closes odoo/odoo#9812
This commit is contained in:
committed by
Olivier Dony
parent
61398b2b46
commit
494e481b6e
@@ -13,7 +13,6 @@ Delivery Costs
|
||||
'data': [
|
||||
'views/website_sale_delivery.xml',
|
||||
'views/website_sale_delivery_view.xml',
|
||||
'security/ir.model.access.csv',
|
||||
],
|
||||
'demo': [
|
||||
'data/website_sale_delivery_demo.xml'
|
||||
|
||||
@@ -98,7 +98,7 @@ class SaleOrder(orm.Model):
|
||||
|
||||
def _get_delivery_methods(self, cr, uid, order, context=None):
|
||||
carrier_obj = self.pool.get('delivery.carrier')
|
||||
carrier_ids = carrier_obj.search(cr, uid, [('website_published', '=', True)], context=context)
|
||||
carrier_ids = carrier_obj.search(cr, SUPERUSER_ID, [('website_published', '=', True)], context=context)
|
||||
available_carrier_ids = []
|
||||
# Following loop is done to avoid displaying delivery methods who are not available for this order
|
||||
# This can surely be done in a more efficient way, but at the moment, it mimics the way it's
|
||||
|
||||
@@ -1,2 +0,0 @@
|
||||
id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink
|
||||
access_delivery_carrier_public,delivery.carrier.public,delivery.model_delivery_carrier,,1,0,0,0
|
||||
|
Reference in New Issue
Block a user