From abc4bd5a9673950c5f33cd4345a2839bf77cea4c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Krier?= <ced@b2ck.com>
Date: Wed, 17 Sep 2014 21:45:58 +0200
Subject: [PATCH] Use context to check model and field access

issue4081
review8481002
---
 move.py     | 16 +++++++---------
 product.py  |  3 ++-
 shipment.py | 45 ++++++++++++---------------------------------
 3 files changed, 21 insertions(+), 43 deletions(-)

diff --git a/move.py b/move.py
index e206c9df25..ee7a483249 100644
--- a/move.py
+++ b/move.py
@@ -571,10 +571,9 @@ class Move(Workflow, ModelSQL, ModelView):
         new_cost_price = new_cost_price.quantize(
             Decimal(str(10.0 ** -digits[1])))
 
-        with Transaction().set_user(0, set_context=True):
-            write({
-                    'cost_price': new_cost_price,
-                    })
+        write({
+                'cost_price': new_cost_price,
+                })
 
     @staticmethod
     def _get_internal_quantity(quantity, uom, product):
@@ -997,11 +996,10 @@ class Move(Workflow, ModelSQL, ModelView):
                         )
                     )
         elif PeriodCache:
-            with Transaction().set_user(0, set_context=True):
-                periods = Period.search([
-                        ('date', '<', context['stock_date_end']),
-                        ('state', '=', 'closed'),
-                        ], order=[('date', 'DESC')], limit=1)
+            periods = Period.search([
+                    ('date', '<', context['stock_date_end']),
+                    ('state', '=', 'closed'),
+                    ], order=[('date', 'DESC')], limit=1)
             if periods:
                 period, = periods
                 state_date_clause &= (
diff --git a/product.py b/product.py
index 690a49a1b4..f0e8fdfc17 100644
--- a/product.py
+++ b/product.py
@@ -70,7 +70,8 @@ class Template:
 
     @classmethod
     def write(cls, *args):
-        if Transaction().user != 0:
+        if (Transaction().user != 0
+                and Transaction().context.get('_check_access')):
             actions = iter(args)
             for templates, values in zip(actions, actions):
                 for field, error in cls._modify_no_move:
diff --git a/shipment.py b/shipment.py
index 25d181a17d..1b839f286c 100644
--- a/shipment.py
+++ b/shipment.py
@@ -356,14 +356,9 @@ class ShipmentIn(Workflow, ModelSQL, ModelView):
                     'planned_date': inventory_date,
                     })
 
-    @classmethod
-    def get_origins(cls, shipments, name):
-        origins = {}
-        with Transaction().set_user(0, set_context=True):
-            for shipment in cls.browse(shipments):
-                origins[shipment.id] = ', '.join(set(itertools.ifilter(None,
-                            (m.origin_name for m in shipment.moves))))
-        return origins
+    def get_origins(self, name):
+        return ', '.join(set(itertools.ifilter(None,
+                    (m.origin_name for m in self.moves))))
 
     @classmethod
     def create(cls, vlist):
@@ -655,14 +650,9 @@ class ShipmentInReturn(Workflow, ModelSQL, ModelView):
                     'planned_date': shipment._move_planned_date,
                     })
 
-    @classmethod
-    def get_origins(cls, shipments, name):
-        origins = {}
-        with Transaction().set_user(0, set_context=True):
-            for shipment in cls.browse(shipments):
-                origins[shipment.id] = ', '.join(set(itertools.ifilter(None,
-                            (m.origin_name for m in shipment.moves))))
-        return origins
+    def get_origins(self, name):
+        return ', '.join(set(itertools.ifilter(None,
+                    (m.origin_name for m in self.moves))))
 
     @classmethod
     def create(cls, vlist):
@@ -1038,15 +1028,9 @@ class ShipmentOut(Workflow, ModelSQL, ModelView):
                 'moves': value,
                 })
 
-    @classmethod
-    def get_origins(cls, shipments, name):
-        origins = {}
-        with Transaction().set_user(0, set_context=True):
-            for shipment in cls.browse(shipments):
-                origins[shipment.id] = ', '.join(set(itertools.ifilter(None,
-                            (m.origin_name for m in shipment.moves))))
-        return origins
-
+    def get_origins(self, name):
+        return ', '.join(set(itertools.ifilter(None,
+                    (m.origin_name for m in self.moves))))
     @classmethod
     @ModelView.button
     @Workflow.transition('draft')
@@ -1588,14 +1572,9 @@ class ShipmentOutReturn(Workflow, ModelSQL, ModelView):
                     'planned_date': inventory_date,
                     })
 
-    @classmethod
-    def get_origins(cls, shipments, name):
-        origins = {}
-        with Transaction().set_user(0, set_context=True):
-            for shipment in cls.browse(shipments):
-                origins[shipment.id] = ', '.join(set(itertools.ifilter(None,
-                            (m.origin_name for m in shipment.moves))))
-        return origins
+    def get_origins(self, name):
+        return ', '.join(set(itertools.ifilter(None,
+                    (m.origin_name for m in self.moves))))
 
     @classmethod
     def create(cls, vlist):