[IMP] base: limitate access to config settings to superuser or group_system members

Currently members of group_erp_manager (Access Rights) and group_system
(Settings) have theoritically access to config settings. However only
group_system members have access to the settings through the interface
as all menus are restricted to them. Moreover after changing a config settings
a check on ir.actions.todo is performed. This model is limited to group_system.

It is therefore not possible for group_erp_manager members to execute config
settings. This commit therefore change the check performed in config settings
to ensure user is superuser or a member of group_system to avoid unwanted
access rights errors further in the process.

[IMP] sale_stock: remove now unnecessary check

addons/sale_stock/models/sale_config_settings.py

@@ -1,8 +1,7 @@
 # -*- coding: utf-8 -*-
 # Part of Odoo. See LICENSE file for full copyright and licensing details.
 
-from odoo import api, fields, models, _
-from odoo.exceptions import AccessError
+from odoo import api, fields, models
 
 
 class SaleConfiguration(models.TransientModel):
@@ -37,10 +36,6 @@ class SaleConfiguration(models.TransientModel):
 
     @api.multi
     def set_sale_defaults(self):
-        self.ensure_one()
-        if not self.env.user._is_admin():
-            raise AccessError(_("Only administrators can change the settings"))
-
         default_picking_policy = 'one' if self.default_picking_policy else 'direct'
         self.env['ir.values'].sudo().set_default('sale.order', 'picking_policy', default_picking_policy)
         return super(SaleConfiguration, self).set_sale_defaults()

openerp/addons/base/res/res_config.py

@@ -512,7 +512,7 @@ class ResConfigSettings(models.TransientModel, ResConfigModuleInstallationMixin)
     @api.multi
     def execute(self):
         self.ensure_one()
-        if not self.env.user._is_admin():
+        if not self.env.user._is_superuser() and not self.env.user.has_group('base.group_system'):
             raise AccessError(_("Only administrators can change the settings"))
 
         self = self.with_context(active_test=False)