From 57cf6f814bf89918118fcdefd420187e7bdfeaf4 Mon Sep 17 00:00:00 2001 From: Denis Ledoux Date: Fri, 30 Jan 2015 15:30:25 +0100 Subject: [PATCH] [FIX] base: attachment security for SUPERUSER If the superuser is not in the group employee, we should nevertheless give him the access rights to attachments --- openerp/addons/base/ir/ir_attachment.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/openerp/addons/base/ir/ir_attachment.py b/openerp/addons/base/ir/ir_attachment.py index ab1e91ea77c..1c9703e8e60 100644 --- a/openerp/addons/base/ir/ir_attachment.py +++ b/openerp/addons/base/ir/ir_attachment.py @@ -253,7 +253,7 @@ class ir_attachment(osv.osv): ima.check(cr, uid, model, mode) self.pool[model].check_access_rule(cr, uid, existing_ids, mode, context=context) if require_employee: - if not self.pool['res.users'].has_group(cr, uid, 'base.group_user'): + if not uid == SUPERUSER_ID and not self.pool['res.users'].has_group(cr, uid, 'base.group_user'): raise except_orm(_('Access Denied'), _("Sorry, you are not allowed to access this document.")) def _search(self, cr, uid, args, offset=0, limit=None, order=None, context=None, count=False, access_rights_uid=None):