Enforce access rights when searching in wizard

If there are no constraint based on the records on the search domain, we must
enforce the access rights to limit the execution to the user accesses.

issue10229
review335931002

account.py

@@ -2825,9 +2825,10 @@ class UpdateChart(Wizard):
         Account = pool.get('account.account')
 
         defaults = {}
-        charts = Account.search([
-                ('parent', '=', None),
-                ], limit=2)
+        with Transaction().set_context(_check_access=True):
+            charts = Account.search([
+                    ('parent', '=', None),
+                    ], limit=2)
         if len(charts) == 1:
             defaults['account'] = charts[0].id
         return defaults

move.py

@@ -1476,6 +1476,8 @@ class OpenAccount(Wizard):
         if not Transaction().context.get('fiscalyear'):
             fiscalyears = FiscalYear.search([
                     ('state', '=', 'open'),
+                    ('company', '=',
+                        self.record.company.id if self.record else None),
                     ])
         else:
             fiscalyears = [FiscalYear(Transaction().context['fiscalyear'])]