[FIX] website_sale_delivery: use sudo mode for reading carrier info

The "delivery" module restricts the access to delivery.carrier objects.
There is no reason to relax this in website_sale_delivery.

Furthermore, nearly all the code of website_sale_delivery accesses
delivery.carrier in sudo mode already.

Closes odoo/odoo#9812
This commit is contained in:
Richard Mathot
2015-12-15 16:59:25 +01:00
committed by Olivier Dony
parent 61398b2b46
commit 494e481b6e
3 changed files with 1 additions and 4 deletions
@@ -13,7 +13,6 @@ Delivery Costs
'data': [
'views/website_sale_delivery.xml',
'views/website_sale_delivery_view.xml',
'security/ir.model.access.csv',
],
'demo': [
'data/website_sale_delivery_demo.xml'
@@ -98,7 +98,7 @@ class SaleOrder(orm.Model):
def _get_delivery_methods(self, cr, uid, order, context=None):
carrier_obj = self.pool.get('delivery.carrier')
carrier_ids = carrier_obj.search(cr, uid, [('website_published', '=', True)], context=context)
carrier_ids = carrier_obj.search(cr, SUPERUSER_ID, [('website_published', '=', True)], context=context)
available_carrier_ids = []
# Following loop is done to avoid displaying delivery methods who are not available for this order
# This can surely be done in a more efficient way, but at the moment, it mimics the way it's
@@ -1,2 +0,0 @@
id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink
access_delivery_carrier_public,delivery.carrier.public,delivery.model_delivery_carrier,,1,0,0,0
1 id name model_id:id group_id:id perm_read perm_write perm_create perm_unlink
2 access_delivery_carrier_public delivery.carrier.public delivery.model_delivery_carrier 1 0 0 0