From 57ea939edac7ae4fa19306bf827231027f3c245c Mon Sep 17 00:00:00 2001
From: Nicolas Martinelli <nim@odoo.com>
Date: Mon, 16 Jul 2018 14:35:20 +0200
Subject: [PATCH] [IMP] auth_signup: hide unusable field from users

The token field is a technical data that the other users are not able to
use.
It may be confusing for users to see token on the user interface.
Still show it to administrator for debug reasons.
---
 addons/auth_signup/res_users.py | 27 ++++++++++++++++++++-------
 1 file changed, 20 insertions(+), 7 deletions(-)

diff --git a/addons/auth_signup/res_users.py b/addons/auth_signup/res_users.py
index 4d3babfb988..e05acde7266 100644
--- a/addons/auth_signup/res_users.py
+++ b/addons/auth_signup/res_users.py
@@ -5,6 +5,7 @@ import random
 from urlparse import urljoin
 import werkzeug
 
+from openerp import SUPERUSER_ID
 from openerp.addons.base.ir.ir_mail_server import MailDeliveryException
 from openerp.osv import osv, fields
 from openerp.tools.misc import DEFAULT_SERVER_DATETIME_FORMAT, ustr
@@ -31,7 +32,7 @@ class res_partner(osv.Model):
     def _get_signup_valid(self, cr, uid, ids, name, arg, context=None):
         dt = now()
         res = {}
-        for partner in self.browse(cr, uid, ids, context):
+        for partner in self.browse(cr, SUPERUSER_ID, ids, context):
             res[partner.id] = bool(partner.signup_token) and \
                                 (not partner.signup_expiration or dt <= partner.signup_expiration)
         return res
@@ -43,7 +44,10 @@ class res_partner(osv.Model):
             context= {}
         res = dict.fromkeys(ids, False)
         base_url = self.pool.get('ir.config_parameter').get_param(cr, uid, 'web.base.url')
-        for partner in self.browse(cr, uid, ids, context):
+        for partner in self.browse(cr, SUPERUSER_ID, ids, context):
+            if any(self.user_has_groups(cr, u.id, 'base.group_user') for u in partner.user_ids if u.id != uid):
+                self.pool['res.users'].check_access_rights(cr, uid, 'write')
+
             # when required, make sure the partner has a valid signup token
             if context.get('signup_valid') and not partner.user_ids:
                 self.signup_prepare(cr, uid, [partner.id], context=context)
@@ -89,9 +93,9 @@ class res_partner(osv.Model):
         return self._get_signup_url_for_action(cr, uid, ids, context=context)
 
     _columns = {
-        'signup_token': fields.char('Signup Token', copy=False),
-        'signup_type': fields.char('Signup Token Type', copy=False),
-        'signup_expiration': fields.datetime('Signup Expiration', copy=False),
+        'signup_token': fields.char('Signup Token', copy=False, groups="base.group_erp_manager"),
+        'signup_type': fields.char('Signup Token Type', copy=False, groups="base.group_erp_manager"),
+        'signup_expiration': fields.datetime('Signup Expiration', copy=False, groups="base.group_erp_manager"),
         'signup_valid': fields.function(_get_signup_valid, type='boolean', string='Signup Token is Valid'),
         'signup_url': fields.function(_get_signup_url, type='char', string='Signup URL'),
     }
@@ -281,11 +285,20 @@ class res_users(osv.Model):
             template = self.pool.get('ir.model.data').get_object(cr, uid, 'auth_signup', 'reset_password_email')
         assert template._name == 'mail.template'
 
+        template_values = {
+            'email_to': '${object.email|safe}',
+            'email_cc': False,
+            'auto_delete': True,
+            'partner_to': False,
+        }
+        template.write(template_values)
+
         for user in self.browse(cr, uid, ids, context):
             if not user.email:
                 raise UserError(_("Cannot send email: user %s has no email address.") % user.name)
-            context['lang'] = user.lang                
-            self.pool.get('mail.template').send_mail(cr, uid, template.id, user.id, force_send=True, raise_exception=True, context=context)
+            context['lang'] = user.lang
+            with cr.savepoint():
+                self.pool.get('mail.template').send_mail(cr, uid, template.id, user.id, force_send=True, raise_exception=True, context=context)
 
     def create(self, cr, uid, values, context=None):
         if context is None: