[FIX] mail, hr: bypass user_has_groups() in superuser mode

5 files changed, 20 insertions, 10 deletions

diff --git a/addons/hr_holidays/models/hr_leave_allocation.py b/addons/hr_holidays/models/hr_leave_allocation.py
index 109a7aab456..ee6b48266d0 100644
--- a/addons/hr_holidays/models/hr_leave_allocation.py
+++ b/addons/hr_holidays/models/hr_leave_allocation.py
@@ -524,6 +524,8 @@ class HolidaysAllocation(models.Model):
 
     def _check_approval_update(self, state):
         """ Check if target state is achievable. """
+        if self.env.is_superuser():
+            return
         current_employee = self.env['hr.employee'].search([('user_id', '=', self.env.uid)], limit=1)
         if not current_employee:
             return
diff --git a/addons/mail/models/mail_message.py b/addons/mail/models/mail_message.py
index 58f04f63f45..1b9e8b41fa4 100644
--- a/addons/mail/models/mail_message.py
+++ b/addons/mail/models/mail_message.py
@@ -352,7 +352,7 @@ class Message(models.Model):
         tracking_tree = dict.fromkeys(tracking_values.ids, False)
         for tracking in tracking_values:
             groups = tracking.field_groups
-            if not groups or self.user_has_groups(groups):
+            if not groups or self.env.is_superuser() or self.user_has_groups(groups):
                 message_to_tracking.setdefault(tracking.mail_message_id.id, list()).append(tracking.id)
                 tracking_tree[tracking.id] = {
                     'id': tracking.id,
diff --git a/addons/mail/models/mail_thread.py b/addons/mail/models/mail_thread.py
index 3963073402e..ac5bb415ee0 100644
--- a/addons/mail/models/mail_thread.py
+++ b/addons/mail/models/mail_thread.py
@@ -2189,7 +2189,7 @@ class MailThread(models.AbstractModel):
         if msg_vals.get('tracking_value_ids', True) if msg_vals else bool(self): # could be tracking
             for tracking_value in self.env['mail.tracking.value'].sudo().search([('mail_message_id', '=', message.id)]):
                 groups = tracking_value.field_groups
-                if not groups or self.user_has_groups(groups):
+                if not groups or self.env.is_superuser() or self.user_has_groups(groups):
                     tracking.append((tracking_value.field_desc,
                                     tracking_value.get_old_display_value()[0],
                                     tracking_value.get_new_display_value()[0]))
diff --git a/addons/test_mail/tests/test_message_track.py b/addons/test_mail/tests/test_message_track.py
index 9c5c202586f..3b7adafef64 100644
--- a/addons/test_mail/tests/test_message_track.py
+++ b/addons/test_mail/tests/test_message_track.py
@@ -151,22 +151,30 @@ class TestTracking(common.BaseFunctionalTest, common.MockEmails):
         self.assertEqual(tracking_values[2].tracking_sequence, 100)
 
     def test_track_groups(self):
-        self.record._fields['email_from'].groups = 'base.group_erp_manager' # patch the group attribute
+        # patch the group attribute
+        field = self.record._fields['email_from']
+        self.addCleanup(setattr, field, 'groups', field.groups)
+        field.groups = 'base.group_erp_manager'
+
         self.record.sudo().write({'email_from': 'X'})
 
         msg_emp = self.record.message_ids.message_format()
-        msg_admin = self.record.message_ids.with_user(self.user_admin).message_format()
+        msg_sudo = self.record.sudo().message_ids.message_format()
         self.assertFalse(msg_emp[0].get('tracking_value_ids'), "should not have protected tracking values")
-        self.assertTrue(msg_admin[0].get('tracking_value_ids'), "should have protected tracking values")
+        self.assertTrue(msg_sudo[0].get('tracking_value_ids'), "should have protected tracking values")
 
     def test_notify_track_groups(self):
-        self.record._fields['email_from'].groups = 'base.group_erp_manager' # patch the group attribute
+        # patch the group attribute
+        field = self.record._fields['email_from']
+        self.addCleanup(setattr, field, 'groups', field.groups)
+        field.groups = 'base.group_erp_manager'
+
         self.record.sudo().write({'email_from': 'X'})
 
-        msg_emp = self.record.with_user(self.user_employee)._notify_prepare_template_context(self.record.message_ids, {})
-        msg_admin = self.record.with_user(self.user_admin)._notify_prepare_template_context(self.record.message_ids, {})
+        msg_emp = self.record._notify_prepare_template_context(self.record.message_ids, {})
+        msg_sudo = self.record.sudo()._notify_prepare_template_context(self.record.message_ids, {})
         self.assertFalse(msg_emp.get('tracking_values'), "should not have protected tracking values")
-        self.assertTrue(msg_admin.get('tracking_values'), "should have protected tracking values")
+        self.assertTrue(msg_sudo.get('tracking_values'), "should have protected tracking values")
 
     def test_unlinked_field(self):
         record_sudo = self.record.sudo()
diff --git a/odoo/models.py b/odoo/models.py
index 81cbbf4706f..5af3855ea75 100644
--- a/odoo/models.py
+++ b/odoo/models.py
@@ -2703,7 +2703,7 @@ class BaseModel(MetaModel('DummyModel', (object,), {'_register': False})):
         for fname, field in self._fields.items():
             if allfields and fname not in allfields:
                 continue
-            if field.groups and not self.user_has_groups(field.groups):
+            if field.groups and not self.env.su and not self.user_has_groups(field.groups):
                 continue
 
             description = field.get_description(self.env)