[FIX] portal: avoid users sharing non-portal groups

2016-07-25 13:06:31 +02:00
parent 7e162e8993
commit 8596a4ccaa
1 changed files with 3 additions and 0 deletions
@@ -158,12 +158,15 @@ class wizard_user(osv.osv_memory):
        return error_msg

    def action_apply(self, cr, uid, ids, context=None):
+        self.pool['res.partner'].check_access_rights(cr, uid, 'write')
        error_msg = self.get_error_messages(cr, uid, ids, context=context)
        if error_msg:
            raise osv.except_osv(_('Contacts Error'), "\n\n".join(error_msg))

        for wizard_user in self.browse(cr, SUPERUSER_ID, ids, context):
            portal = wizard_user.wizard_id.portal_id
+            if not portal.is_portal:
+               raise osv.except_osv("Error", "Not a portal: " + portal.name)
            user = self._retrieve_user(cr, SUPERUSER_ID, wizard_user, context)
            if wizard_user.partner_id.email != wizard_user.email:
                wizard_user.partner_id.write({'email': wizard_user.email})