From ac099b0e0713986d6bcab978134fce41a10bbc57 Mon Sep 17 00:00:00 2001 From: Yannick Tivisse Date: Tue, 14 Jun 2016 09:50:09 +0200 Subject: [PATCH] [IMP] subscription: Remove write,create,unlink right on ir_cron Use a sudo on a ir_cron creation instead of giving full access rights to employee on a technical field --- addons/subscription/models/subscription.py | 2 +- addons/subscription/security/ir.model.access.csv | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/addons/subscription/models/subscription.py b/addons/subscription/models/subscription.py index 83381822645..be3d24e00f4 100644 --- a/addons/subscription/models/subscription.py +++ b/addons/subscription/models/subscription.py @@ -78,7 +78,7 @@ class Subscription(models.Model): 'priority': 6, 'user_id': subscription.user_id.id } - cron = self.env['ir.cron'].create(cron_data) + cron = self.env['ir.cron'].sudo().create(cron_data) subscription.write({'cron_id': cron.id, 'state': 'running'}) @api.multi diff --git a/addons/subscription/security/ir.model.access.csv b/addons/subscription/security/ir.model.access.csv index ee7a762d125..a40962b46d5 100644 --- a/addons/subscription/security/ir.model.access.csv +++ b/addons/subscription/security/ir.model.access.csv @@ -4,4 +4,4 @@ access_subscription_subscription_user,subscription.subscription user,model_subsc access_subscription_subscription_history_user,subscription.subscription.history user,model_subscription_subscription_history,base.group_user,1,1,1,1 access_subscription_document_user,subscription.document user,model_subscription_document,base.group_user,1,1,1,1 access_res_partner_user,res.partner.user,base.model_res_partner,base.group_user,1,1,1,1 -access_ir_cron_user,ir.cron.user,base.model_ir_cron,base.group_user,1,1,1,1 +access_ir_cron_user,ir.cron.user,base.model_ir_cron,base.group_user,1,0,0,0