Use context to check model and field access

issue4081
review8481002

move.py

@@ -571,10 +571,9 @@ class Move(Workflow, ModelSQL, ModelView):
         new_cost_price = new_cost_price.quantize(
             Decimal(str(10.0 ** -digits[1])))
 
-        with Transaction().set_user(0, set_context=True):
-            write({
-                    'cost_price': new_cost_price,
-                    })
+        write({
+                'cost_price': new_cost_price,
+                })
 
     @staticmethod
     def _get_internal_quantity(quantity, uom, product):
@@ -997,11 +996,10 @@ class Move(Workflow, ModelSQL, ModelView):
                         )
                     )
         elif PeriodCache:
-            with Transaction().set_user(0, set_context=True):
-                periods = Period.search([
-                        ('date', '<', context['stock_date_end']),
-                        ('state', '=', 'closed'),
-                        ], order=[('date', 'DESC')], limit=1)
+            periods = Period.search([
+                    ('date', '<', context['stock_date_end']),
+                    ('state', '=', 'closed'),
+                    ], order=[('date', 'DESC')], limit=1)
             if periods:
                 period, = periods
                 state_date_clause &= (

product.py

@@ -70,7 +70,8 @@ class Template:
 
     @classmethod
     def write(cls, *args):
-        if Transaction().user != 0:
+        if (Transaction().user != 0
+                and Transaction().context.get('_check_access')):
             actions = iter(args)
             for templates, values in zip(actions, actions):
                 for field, error in cls._modify_no_move:

shipment.py

@@ -356,14 +356,9 @@ class ShipmentIn(Workflow, ModelSQL, ModelView):
                     'planned_date': inventory_date,
                     })
 
-    @classmethod
-    def get_origins(cls, shipments, name):
-        origins = {}
-        with Transaction().set_user(0, set_context=True):
-            for shipment in cls.browse(shipments):
-                origins[shipment.id] = ', '.join(set(itertools.ifilter(None,
-                            (m.origin_name for m in shipment.moves))))
-        return origins
+    def get_origins(self, name):
+        return ', '.join(set(itertools.ifilter(None,
+                    (m.origin_name for m in self.moves))))
 
     @classmethod
     def create(cls, vlist):
@@ -655,14 +650,9 @@ class ShipmentInReturn(Workflow, ModelSQL, ModelView):
                     'planned_date': shipment._move_planned_date,
                     })
 
-    @classmethod
-    def get_origins(cls, shipments, name):
-        origins = {}
-        with Transaction().set_user(0, set_context=True):
-            for shipment in cls.browse(shipments):
-                origins[shipment.id] = ', '.join(set(itertools.ifilter(None,
-                            (m.origin_name for m in shipment.moves))))
-        return origins
+    def get_origins(self, name):
+        return ', '.join(set(itertools.ifilter(None,
+                    (m.origin_name for m in self.moves))))
 
     @classmethod
     def create(cls, vlist):
@@ -1038,15 +1028,9 @@ class ShipmentOut(Workflow, ModelSQL, ModelView):
                 'moves': value,
                 })
 
-    @classmethod
-    def get_origins(cls, shipments, name):
-        origins = {}
-        with Transaction().set_user(0, set_context=True):
-            for shipment in cls.browse(shipments):
-                origins[shipment.id] = ', '.join(set(itertools.ifilter(None,
-                            (m.origin_name for m in shipment.moves))))
-        return origins
-
+    def get_origins(self, name):
+        return ', '.join(set(itertools.ifilter(None,
+                    (m.origin_name for m in self.moves))))
     @classmethod
     @ModelView.button
     @Workflow.transition('draft')
@@ -1588,14 +1572,9 @@ class ShipmentOutReturn(Workflow, ModelSQL, ModelView):
                     'planned_date': inventory_date,
                     })
 
-    @classmethod
-    def get_origins(cls, shipments, name):
-        origins = {}
-        with Transaction().set_user(0, set_context=True):
-            for shipment in cls.browse(shipments):
-                origins[shipment.id] = ', '.join(set(itertools.ifilter(None,
-                            (m.origin_name for m in shipment.moves))))
-        return origins
+    def get_origins(self, name):
+        return ', '.join(set(itertools.ifilter(None,
+                    (m.origin_name for m in self.moves))))
 
     @classmethod
     def create(cls, vlist):