From 6c044b3675aa58f4bc5b8ce336dfbe98f7c0d243 Mon Sep 17 00:00:00 2001
From: Florent de Labarre <florent.mirieu@gmail.com>
Date: Tue, 27 Feb 2018 18:02:58 +0100
Subject: [PATCH] [FIX] base : prevent unallowed launch

Do not allow to trigger the cron manually (e.g. via RPC call)

Closes #23157
---
 odoo/addons/base/ir/ir_cron.py | 1 +
 1 file changed, 1 insertion(+)

diff --git a/odoo/addons/base/ir/ir_cron.py b/odoo/addons/base/ir/ir_cron.py
index 58dc0f06fb7..0af75822329 100644
--- a/odoo/addons/base/ir/ir_cron.py
+++ b/odoo/addons/base/ir/ir_cron.py
@@ -71,6 +71,7 @@ class ir_cron(models.Model):
 
     @api.multi
     def method_direct_trigger(self):
+        self.check_access_rights('write')
         for cron in self:
             self.sudo(user=cron.user_id.id).ir_actions_server_id.run()
         return True