diff --git a/CHANGELOG b/CHANGELOG index 18a3490d3a..bbb662032e 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -1,3 +1,4 @@ +* Enable check_access context when checking wizard access (issue9108) * Add editable on calendar view * Add xalign and yalign to group * Add MultiSelection entry to Dict field diff --git a/trytond/wizard/wizard.py b/trytond/wizard/wizard.py index 4c594b2519..ec5c89623c 100644 --- a/trytond/wizard/wizard.py +++ b/trytond/wizard/wizard.py @@ -230,18 +230,19 @@ class Wizard(URLMixin, PoolBase): if Transaction().user == 0: return - model = context.get('active_model') - if model: - ModelAccess.check(model, 'read') - groups = set(User.get_groups()) - wizard_groups = ActionWizard.get_groups(cls.__name__, - action_id=context.get('action_id')) - if wizard_groups: - if not groups & wizard_groups: - raise UserError('Calling wizard %s is not allowed!' - % cls.__name__) - elif model: - ModelAccess.check(model, 'write') + with Transaction().set_context(_check_access=True): + model = context.get('active_model') + if model: + ModelAccess.check(model, 'read') + groups = set(User.get_groups()) + wizard_groups = ActionWizard.get_groups(cls.__name__, + action_id=context.get('action_id')) + if wizard_groups: + if not groups & wizard_groups: + raise UserError('Calling wizard %s is not allowed!' + % cls.__name__) + elif model: + ModelAccess.check(model, 'write') @classmethod def create(cls):