From acc531a9d750874a3bdc8663054b21ef9252fc04 Mon Sep 17 00:00:00 2001 From: Olivier Dony Date: Wed, 20 Jul 2016 22:14:23 +0200 Subject: [PATCH] [FIX] portal: avoid users sharing non-portal groups --- addons/portal/wizard/portal_wizard.py | 3 +++ 1 file changed, 3 insertions(+) diff --git a/addons/portal/wizard/portal_wizard.py b/addons/portal/wizard/portal_wizard.py index 0f9ad7a7073..9d5b7d54127 100644 --- a/addons/portal/wizard/portal_wizard.py +++ b/addons/portal/wizard/portal_wizard.py @@ -131,8 +131,11 @@ class wizard_user(osv.osv_memory): return id def action_apply(self, cr, uid, ids, context=None): + self.pool['res.partner'].check_access_rights(cr, uid, 'write') for wizard_user in self.browse(cr, SUPERUSER_ID, ids, context): portal = wizard_user.wizard_id.portal_id + if not portal.is_portal: + raise osv.except_osv("Error", "Not a portal: " + portal.name) user = self._retrieve_user(cr, SUPERUSER_ID, wizard_user, context) if wizard_user.in_portal: # create a user if necessary, and make sure it is in the portal group