From dc0f0437f5a588176e7ffd4336230d28d194a3e8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Krier?= <ced@b2ck.com>
Date: Mon, 5 Apr 2021 15:15:39 +0200
Subject: [PATCH] Enforce access rights when searching in wizard

If there are no constraint based on the records on the search domain, we must
enforce the access rights to limit the execution to the user accesses.

issue10229
review335931002
---
 stock.py | 49 ++++++++++++++++++++++++++-----------------------
 1 file changed, 26 insertions(+), 23 deletions(-)

diff --git a/stock.py b/stock.py
index 4fd71a2c7d..a5614d5e26 100644
--- a/stock.py
+++ b/stock.py
@@ -3,6 +3,7 @@
 from trytond.i18n import gettext
 from trytond.pool import Pool
 from trytond.model import ModelView
+from trytond.transaction import Transaction
 from trytond.wizard import (Wizard, StateView, StateAction, StateTransition,
     Button)
 
@@ -41,26 +42,27 @@ class Supply(Wizard):
         Date = pool.get('ir.date')
         Warning = pool.get('res.user.warning')
         today = Date.today()
-        if Move.search([
-                    ('from_location.type', '=', 'supplier'),
-                    ('to_location.type', '=', 'storage'),
-                    ('state', '=', 'draft'),
-                    ('planned_date', '<', today),
-                    ], order=[]):
-            name = '%s.supplier@%s' % (self.__name__, today)
-            if Warning.check(name):
-                raise SupplyWarning(name,
-                    gettext('stock_supply.msg_late_supplier_moves'))
-        if Move.search([
-                    ('from_location.type', '=', 'storage'),
-                    ('to_location.type', '=', 'customer'),
-                    ('state', '=', 'draft'),
-                    ('planned_date', '<', today),
-                    ], order=[]):
-            name = '%s..customer@%s' % (self.__name__, today)
-            if Warning.check(name):
-                raise SupplyWarning(name,
-                    gettext('stock_supply.msg_late_customer_moves'))
+        with Transaction().set_context(_check_access=True):
+            if Move.search([
+                        ('from_location.type', '=', 'supplier'),
+                        ('to_location.type', '=', 'storage'),
+                        ('state', '=', 'draft'),
+                        ('planned_date', '<', today),
+                        ], order=[]):
+                name = '%s.supplier@%s' % (self.__name__, today)
+                if Warning.check(name):
+                    raise SupplyWarning(name,
+                        gettext('stock_supply.msg_late_supplier_moves'))
+            if Move.search([
+                        ('from_location.type', '=', 'storage'),
+                        ('to_location.type', '=', 'customer'),
+                        ('state', '=', 'draft'),
+                        ('planned_date', '<', today),
+                        ], order=[]):
+                name = '%s..customer@%s' % (self.__name__, today)
+                if Warning.check(name):
+                    raise SupplyWarning(name,
+                        gettext('stock_supply.msg_late_customer_moves'))
 
         first = True
         created = False
@@ -71,9 +73,10 @@ class Supply(Wizard):
             first = False
 
         # Remove transit split of request
-        shipments = ShipmentInternal.search([
-                ('state', '=', 'request'),
-                ])
+        with Transaction().set_context(_check_access=True):
+            shipments = ShipmentInternal.search([
+                    ('state', '=', 'request'),
+                    ])
         Move.delete([m for s in shipments for m in s.moves
                 if m.from_location == s.transit_location])
         for shipment in shipments: