Merge lp:~openerp-dev/openobject-server/7.0-bug-1157839-dharmang into lp:openobject-server/7.0

[Dharmang Soni (OpenERP)]

Hello,

I have fixed the issue of reset password when users with write access on Partners can change any user's password if "Enable password reset from Login page" is enabled.

Thank You,
Dharmang Soni

[Ruchir Shukla(BizzAppDev) (ruchir.shukla)]

What If I am a second level Admin and not a Super user? I think it will not allow me to change any partner data for any user.

Is that mean To change partner data of user, you need to be a SUPER ADMIN ?

review: Needs Fixing

Unmerged revisions

4927. By Dharmang Soni (OpenERP) on 2013-04-09

[FIX] [7.0] users with write access on Partners can change any user's password if 'Enable password reset from Login page' is enabled

=== modified file 'openerp/addons/base/res/res_partner.py'
--- openerp/addons/base/res/res_partner.py	2013-03-29 11:23:17 +0000
+++ openerp/addons/base/res/res_partner.py	2013-04-09 10:47:23 +0000
@@ -365,6 +365,9 @@
         if vals.get('is_company')==False:
             vals.update({'child_ids' : [(5,)]})
         for partner in self.browse(cr, uid, ids, context=context):
+            user = self.pool.get("res.users").search(cr, uid, [("partner_id", "=", partner.id)], context=context);
+            if user and user[0] != uid and uid != SUPERUSER_ID:
+                    raise osv.except_osv(_('Warning!'), _("You are not authorized to update user information."))
             update_ids = []
             if partner.is_company:
                 domain_children = [('parent_id', '=', partner.id), ('use_parent_address', '=', True)]