From 494e481b6eaf7e0ff48d217c6948b85a3bdbb08c Mon Sep 17 00:00:00 2001 From: Richard Mathot Date: Sat, 28 Nov 2015 14:05:53 +0100 Subject: [PATCH] [FIX] website_sale_delivery: use sudo mode for reading carrier info The "delivery" module restricts the access to delivery.carrier objects. There is no reason to relax this in website_sale_delivery. Furthermore, nearly all the code of website_sale_delivery accesses delivery.carrier in sudo mode already. Closes odoo/odoo#9812 --- addons/website_sale_delivery/__openerp__.py | 1 - addons/website_sale_delivery/models/sale_order.py | 2 +- addons/website_sale_delivery/security/ir.model.access.csv | 2 -- 3 files changed, 1 insertion(+), 4 deletions(-) delete mode 100644 addons/website_sale_delivery/security/ir.model.access.csv diff --git a/addons/website_sale_delivery/__openerp__.py b/addons/website_sale_delivery/__openerp__.py index 6c160778ee0..b73b7f2ef12 100644 --- a/addons/website_sale_delivery/__openerp__.py +++ b/addons/website_sale_delivery/__openerp__.py @@ -13,7 +13,6 @@ Delivery Costs 'data': [ 'views/website_sale_delivery.xml', 'views/website_sale_delivery_view.xml', - 'security/ir.model.access.csv', ], 'demo': [ 'data/website_sale_delivery_demo.xml' diff --git a/addons/website_sale_delivery/models/sale_order.py b/addons/website_sale_delivery/models/sale_order.py index 5099cefc75c..d2e1d3d768f 100644 --- a/addons/website_sale_delivery/models/sale_order.py +++ b/addons/website_sale_delivery/models/sale_order.py @@ -98,7 +98,7 @@ class SaleOrder(orm.Model): def _get_delivery_methods(self, cr, uid, order, context=None): carrier_obj = self.pool.get('delivery.carrier') - carrier_ids = carrier_obj.search(cr, uid, [('website_published', '=', True)], context=context) + carrier_ids = carrier_obj.search(cr, SUPERUSER_ID, [('website_published', '=', True)], context=context) available_carrier_ids = [] # Following loop is done to avoid displaying delivery methods who are not available for this order # This can surely be done in a more efficient way, but at the moment, it mimics the way it's diff --git a/addons/website_sale_delivery/security/ir.model.access.csv b/addons/website_sale_delivery/security/ir.model.access.csv deleted file mode 100644 index 69e804cfd28..00000000000 --- a/addons/website_sale_delivery/security/ir.model.access.csv +++ /dev/null @@ -1,2 +0,0 @@ -id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink -access_delivery_carrier_public,delivery.carrier.public,delivery.model_delivery_carrier,,1,0,0,0