Merge lp:~openerp-dev/openobject-server/trunk-bug-1021378-aja into lp:openobject-server

[ajay javiya (OpenERP)]

Bug fix

[Alexandre Fayolle - camptocamp (alexandre-fayolle-c2c)]

hello,

I agree this needs to be fixed in trunk, but more importantly it needs to be fixed in the 7.0 branch.
Could you resubmit the MP against that branch please ?

[Yannick Vaucher @ Camptocamp (yvaucher-c2c)]

Preparation:
With admin
- Create a user test

Case 1:
With admin
- Set right Administration / Access Rights on user test
With test
- create a user test111

Result: user test111 is created -> OK

Case 2:
With admin
- Set right Administration / Settings on user test
With test
- create a user test222

Result: user test222 is created -> OK

Case 3: (No rights)
With test
- Open a user creation form and define name field test

With admin
- Remove right Administration on user test

With test
- Press save button

Result: Error Access denied -> OK

review: Approve (tests)

[Olivier Dony (Odoo) (odo-openerp)]

Marking as merged because it was merged in 7.0 at rev 4894 revision-id: <email address hidden>, and will be forward-ported to trunk soon. Thanks for the reviews!

review: Approve

[Nicholas Riegel (nriegel)]

These bugs are still not fixed. After creating a new user and assigning them to the Access Rights group, the following error occurs when that new user tries to add a user:

Access Denied

The requested operation cannot be completed due to security restrictions. Please contact your system administrator.

(Document type: Note Stage, Operation: read)

The same error occurs when Note Stage read access is enabled in the Groups / Administration / Access Rights settings.

review: Needs Fixing

=== modified file 'openerp/osv/orm.py'
--- openerp/osv/orm.py	2012-08-14 13:06:56 +0000
+++ openerp/osv/orm.py	2012-08-30 07:01:18 +0000
@@ -4276,7 +4276,6 @@
             upd1 += ",%s,(now() at time zone 'UTC')"
             upd2.append(user)
         cr.execute('insert into "'+self._table+'" (id'+upd0+") values ("+str(id_new)+upd1+')', tuple(upd2))
-        self.check_access_rule(cr, user, [id_new], 'create', context=context)
         upd_todo.sort(lambda x, y: self._columns[x].priority-self._columns[y].priority)
 
         if self._parent_store and not context.get('defer_parent_store_computation'):
@@ -4329,6 +4328,7 @@
                 self.name_get(cr, user, [id_new], context=context)[0][1] + \
                 "' " + _("created.")
             self.log(cr, user, id_new, message, True, context=context)
+        self.check_access_rule(cr, user, [id_new], 'create', context=context)
         self._workflow_trigger(cr, user, [id_new], 'trg_create', context=context)
         return id_new