Do not check write access on model for wizard with groups

issue5884
review33371002

CHANGELOG

@@ -1,3 +1,4 @@
+* Do not check write access on model for wizard with groups
 * Add user application
 * Add sequence_ordered
 * Remove most country specific code in languages

doc/topics/access_rights.rst

@@ -4,7 +4,7 @@
 Access Rights
 =============
 
-There are 4 levels of access rights: model, field, button and record.
+There are 5 levels of access rights: model, actions, field, button and record.
 Every access right is based on the groups of the user.
 The model and field access rights are checked for every RPC call for which
 :attr:`trytond.rpc.RPC.check_access` is set. The others are always enforced.
@@ -17,6 +17,14 @@ of model and group, the read, write, create and delete permission. If any group
 of the user has the permission activated, then the user is granted this
 permission.
 
+Actions Access
+==============
+
+Each action define a list of groups that are allowed to use it.
+There is a special case for ref:`wizard <topics-wizard>` for which the read
+access on the model is also checked and also the write access if there is no
+groups linked.
+
 Field Access
 ============
 

trytond/wizard/wizard.py

@@ -233,12 +233,15 @@ class Wizard(WarningErrorMixin, URLMixin, PoolBase):
         model = context.get('active_model')
         if model:
             ModelAccess.check(model, 'read')
-            ModelAccess.check(model, 'write')
         groups = set(User.get_groups())
         wizard_groups = ActionWizard.get_groups(cls.__name__,
             action_id=context.get('action_id'))
-        if wizard_groups and not groups & wizard_groups:
-            raise UserError('Calling wizard %s is not allowed!' % cls.__name__)
+        if wizard_groups:
+            if not groups & wizard_groups:
+                raise UserError('Calling wizard %s is not allowed!'
+                    % cls.__name__)
+        elif model:
+            ModelAccess.check(model, 'write')
 
     @classmethod
     def create(cls):