From df216b6bfe43e5667df30e2c43d7e8ed60d1f998 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thibault=20Delavall=C3=A9e?= Date: Fri, 19 Aug 2016 15:11:56 +0200 Subject: [PATCH] [IMP] base: limitate access to config settings to superuser or group_system members Currently members of group_erp_manager (Access Rights) and group_system (Settings) have theoritically access to config settings. However only group_system members have access to the settings through the interface as all menus are restricted to them. Moreover after changing a config settings a check on ir.actions.todo is performed. This model is limited to group_system. It is therefore not possible for group_erp_manager members to execute config settings. This commit therefore change the check performed in config settings to ensure user is superuser or a member of group_system to avoid unwanted access rights errors further in the process. [IMP] sale_stock: remove now unnecessary check --- addons/sale_stock/models/sale_config_settings.py | 7 +------ openerp/addons/base/res/res_config.py | 2 +- 2 files changed, 2 insertions(+), 7 deletions(-) diff --git a/addons/sale_stock/models/sale_config_settings.py b/addons/sale_stock/models/sale_config_settings.py index 32baad15126..8ff323c809e 100644 --- a/addons/sale_stock/models/sale_config_settings.py +++ b/addons/sale_stock/models/sale_config_settings.py @@ -1,8 +1,7 @@ # -*- coding: utf-8 -*- # Part of Odoo. See LICENSE file for full copyright and licensing details. -from odoo import api, fields, models, _ -from odoo.exceptions import AccessError +from odoo import api, fields, models class SaleConfiguration(models.TransientModel): @@ -37,10 +36,6 @@ class SaleConfiguration(models.TransientModel): @api.multi def set_sale_defaults(self): - self.ensure_one() - if not self.env.user._is_admin(): - raise AccessError(_("Only administrators can change the settings")) - default_picking_policy = 'one' if self.default_picking_policy else 'direct' self.env['ir.values'].sudo().set_default('sale.order', 'picking_policy', default_picking_policy) return super(SaleConfiguration, self).set_sale_defaults() diff --git a/openerp/addons/base/res/res_config.py b/openerp/addons/base/res/res_config.py index 22618bf48f5..61986ced93c 100644 --- a/openerp/addons/base/res/res_config.py +++ b/openerp/addons/base/res/res_config.py @@ -512,7 +512,7 @@ class ResConfigSettings(models.TransientModel, ResConfigModuleInstallationMixin) @api.multi def execute(self): self.ensure_one() - if not self.env.user._is_admin(): + if not self.env.user._is_superuser() and not self.env.user.has_group('base.group_system'): raise AccessError(_("Only administrators can change the settings")) self = self.with_context(active_test=False)