From e580c1ac878b49cef41fe2c953442bf9eb726c94 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Krier?= <ced@b2ck.com>
Date: Mon, 5 Apr 2021 15:15:38 +0200
Subject: [PATCH] Enforce access rights when searching in wizard

If there are no constraint based on the records on the search domain, we must
enforce the access rights to limit the execution to the user accesses.

issue10229
review335931002
---
 account.py | 7 ++++---
 move.py    | 2 ++
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/account.py b/account.py
index 8e02fad7ea..7074897d70 100644
--- a/account.py
+++ b/account.py
@@ -2825,9 +2825,10 @@ class UpdateChart(Wizard):
         Account = pool.get('account.account')
 
         defaults = {}
-        charts = Account.search([
-                ('parent', '=', None),
-                ], limit=2)
+        with Transaction().set_context(_check_access=True):
+            charts = Account.search([
+                    ('parent', '=', None),
+                    ], limit=2)
         if len(charts) == 1:
             defaults['account'] = charts[0].id
         return defaults
diff --git a/move.py b/move.py
index fd97fcb960..5d0ac66b86 100644
--- a/move.py
+++ b/move.py
@@ -1476,6 +1476,8 @@ class OpenAccount(Wizard):
         if not Transaction().context.get('fiscalyear'):
             fiscalyears = FiscalYear.search([
                     ('state', '=', 'open'),
+                    ('company', '=',
+                        self.record.company.id if self.record else None),
                     ])
         else:
             fiscalyears = [FiscalYear(Transaction().context['fiscalyear'])]