[FIX] base_import_module: import module in sudo to bypass ACLs

closes odoo/odoo#149243

Signed-off-by: Pierre Masereel (pim) <pim@odoo.com>

addons/base_import_module/i18n/base_import_module.pot

@@ -202,6 +202,13 @@ msgstr ""
 msgid "Official Apps"
 msgstr ""
 
+#. module: base_import_module
+#. odoo-python
+#: code:addons/base_import_module/models/ir_module.py:0
+#, python-format
+msgid "Only administrators can install data modules."
+msgstr ""
+
 #. module: base_import_module
 #. odoo-python
 #: code:addons/base_import_module/controllers/main.py:0

addons/base_import_module/models/ir_module.py

@@ -13,7 +13,7 @@ from io import BytesIO
 from os.path import join as opj
 
 from odoo import api, fields, models, _
-from odoo.exceptions import AccessDenied, UserError
+from odoo.exceptions import AccessDenied, AccessError, UserError
 from odoo.modules.module import adapt_version, MANIFEST_NAMES
 from odoo.osv.expression import is_leaf
 from odoo.release import major_version
@@ -199,6 +199,8 @@ class IrModule(models.Model):
 
     @api.model
     def _import_zipfile(self, module_file, force=False, with_demo=False):
+        if not self.env.is_admin():
+            raise AccessError(_("Only administrators can install data modules."))
         if not module_file:
             raise Exception(_("No file sent."))
         if not zipfile.is_zipfile(module_file):
@@ -249,7 +251,7 @@ class IrModule(models.Model):
                     try:
                         # assert mod_name.startswith('theme_')
                         path = opj(module_dir, mod_name)
-                        if self._import_module(mod_name, path, force=force, with_demo=with_demo):
+                        if self.sudo()._import_module(mod_name, path, force=force, with_demo=with_demo):
                             success.append(mod_name)
                     except Exception as e:
                         _logger.exception('Error while importing module')