From 892e79da1e77dc407d4c17bce55b190c0916a9a6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Krier?= <ced@b2ck.com>
Date: Tue, 27 Sep 2016 12:06:11 +0200
Subject: [PATCH] Do not check write access on model for wizard with groups

issue5884
review33371002
---
 CHANGELOG                    |  1 +
 doc/topics/access_rights.rst | 10 +++++++++-
 trytond/wizard/wizard.py     |  9 ++++++---
 3 files changed, 16 insertions(+), 4 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index 3ae7ba3e79..5f5bfa528d 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -1,3 +1,4 @@
+* Do not check write access on model for wizard with groups
 * Add user application
 * Add sequence_ordered
 * Remove most country specific code in languages
diff --git a/doc/topics/access_rights.rst b/doc/topics/access_rights.rst
index 0e69bbab64..3e37ca8844 100644
--- a/doc/topics/access_rights.rst
+++ b/doc/topics/access_rights.rst
@@ -4,7 +4,7 @@
 Access Rights
 =============
 
-There are 4 levels of access rights: model, field, button and record.
+There are 5 levels of access rights: model, actions, field, button and record.
 Every access right is based on the groups of the user.
 The model and field access rights are checked for every RPC call for which
 :attr:`trytond.rpc.RPC.check_access` is set. The others are always enforced.
@@ -17,6 +17,14 @@ of model and group, the read, write, create and delete permission. If any group
 of the user has the permission activated, then the user is granted this
 permission.
 
+Actions Access
+==============
+
+Each action define a list of groups that are allowed to use it.
+There is a special case for ref:`wizard <topics-wizard>` for which the read
+access on the model is also checked and also the write access if there is no
+groups linked.
+
 Field Access
 ============
 
diff --git a/trytond/wizard/wizard.py b/trytond/wizard/wizard.py
index 8d53790819..fc8f430e2a 100644
--- a/trytond/wizard/wizard.py
+++ b/trytond/wizard/wizard.py
@@ -233,12 +233,15 @@ class Wizard(WarningErrorMixin, URLMixin, PoolBase):
         model = context.get('active_model')
         if model:
             ModelAccess.check(model, 'read')
-            ModelAccess.check(model, 'write')
         groups = set(User.get_groups())
         wizard_groups = ActionWizard.get_groups(cls.__name__,
             action_id=context.get('action_id'))
-        if wizard_groups and not groups & wizard_groups:
-            raise UserError('Calling wizard %s is not allowed!' % cls.__name__)
+        if wizard_groups:
+            if not groups & wizard_groups:
+                raise UserError('Calling wizard %s is not allowed!'
+                    % cls.__name__)
+        elif model:
+            ModelAccess.check(model, 'write')
 
     @classmethod
     def create(cls):