From 5c009b5f3149b3221caa088605437b3c4debc726 Mon Sep 17 00:00:00 2001
From: Martin Trigaux <mat@odoo.com>
Date: Mon, 8 May 2017 14:06:26 +0200
Subject: [PATCH] [FIX] product,stock: create a company for non-admin users

The typical multi-company record rule is
['|',('company_id','child_of',[user.company_id.id]),('company_id','=',False)]

As the company is just created, the current user does not belong to the company.
Create first without company (to still check the access rights) and after add
the company in sudo

Can not apply the same patch for stock as locations and sublocations are created
based on the warehouse company.

Fixes #16807
---
 addons/product/models/res_company.py | 5 +++--
 addons/stock/models/res_company.py   | 7 +++++--
 2 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/addons/product/models/res_company.py b/addons/product/models/res_company.py
index 3cebeac4799..ec4df73b8d0 100644
--- a/addons/product/models/res_company.py
+++ b/addons/product/models/res_company.py
@@ -18,12 +18,13 @@ class ResCompany(models.Model):
                 'currency_id': new_company.currency_id.id,
             })
         field = self.env['ir.model.fields'].search([('model', '=', 'res.partner'), ('name', '=', 'property_product_pricelist')])
-        self.env['ir.property'].create({
+        product_property = self.env['ir.property'].create({
             'name': 'property_product_pricelist',
-            'company_id': new_company.id,
             'value_reference': 'product.pricelist,%s' % pricelist.id,
             'fields_id': field.id
         })
+        # multi-company security rules prevents access
+        product_property.sudo().write({'company_id': new_company.id})
         return new_company
 
     @api.multi
diff --git a/addons/stock/models/res_company.py b/addons/stock/models/res_company.py
index c1fd7aff521..9b5602ddbdd 100644
--- a/addons/stock/models/res_company.py
+++ b/addons/stock/models/res_company.py
@@ -23,14 +23,17 @@ class Company(models.Model):
         location = self.env['stock.location'].create({
             'name': _('%s: Transit Location') % self.name,
             'usage': 'transit',
-            'company_id': self.id,
             'location_id': parent_location and parent_location.id or False,
         })
+        location.sudo().write({'company_id': self.id})
         self.write({'internal_transit_location_id': location.id})
 
     @api.model
     def create(self, vals):
         company = super(Company, self).create(vals)
-        self.env['stock.warehouse'].create({'name': company.name, 'code': company.name[:5], 'company_id': company.id})
+
+        # mutli-company rules prevents creating warehouse and sub-locations
+        self.env['stock.warehouse'].check_access_rights('create')
+        self.env['stock.warehouse'].sudo().create({'name': company.name, 'code': company.name[:5], 'company_id': company.id})
         company.create_transit_location()
         return company