[MERGE] forward port branch saas-11.3 up to af35aea6b0d

2 files changed, 19 insertions, 6 deletions

diff --git a/addons/auth_signup/models/res_partner.py b/addons/auth_signup/models/res_partner.py
index 17171c645f6..c0da1d85f83 100644
--- a/addons/auth_signup/models/res_partner.py
+++ b/addons/auth_signup/models/res_partner.py
@@ -25,9 +25,9 @@ def now(**kwargs):
 class ResPartner(models.Model):
     _inherit = 'res.partner'
 
-    signup_token = fields.Char(copy=False)
-    signup_type = fields.Char(string='Signup Token Type', copy=False)
-    signup_expiration = fields.Datetime(copy=False)
+    signup_token = fields.Char(copy=False, groups="base.group_erp_manager")
+    signup_type = fields.Char(string='Signup Token Type', copy=False, groups="base.group_erp_manager")
+    signup_expiration = fields.Datetime(copy=False, groups="base.group_erp_manager")
     signup_valid = fields.Boolean(compute='_compute_signup_valid', string='Signup Token is Valid')
     signup_url = fields.Char(compute='_compute_signup_url', string='Signup URL')
 
@@ -35,15 +35,17 @@ class ResPartner(models.Model):
     @api.depends('signup_token', 'signup_expiration')
     def _compute_signup_valid(self):
         dt = now()
-        for partner in self:
+        for partner in self.sudo():
             partner.signup_valid = bool(partner.signup_token) and \
             (not partner.signup_expiration or dt <= partner.signup_expiration)
 
     @api.multi
     def _compute_signup_url(self):
         """ proxy for function field towards actual implementation """
-        result = self._get_signup_url_for_action()
+        result = self.sudo()._get_signup_url_for_action()
         for partner in self:
+            if any(u.has_group('base.group_user') for u in partner.user_ids if u != self.env.user):
+                self.env['res.users'].check_access_rights('write')
             partner.signup_url = result.get(partner.id, False)
 
     @api.multi
@@ -106,6 +108,7 @@ class ResPartner(models.Model):
         allow_signup = self.env['ir.config_parameter'].sudo().get_param('auth_signup.invitation_scope', 'b2b') == 'b2c'
         for partner in self:
             if allow_signup and not partner.user_ids:
+                partner = partner.sudo()
                 partner.signup_prepare()
                 res[partner.id]['auth_signup_token'] = partner.signup_token
             elif partner.user_ids:
diff --git a/addons/auth_signup/models/res_users.py b/addons/auth_signup/models/res_users.py
index 598d390dbd5..348bd2699cf 100644
--- a/addons/auth_signup/models/res_users.py
+++ b/addons/auth_signup/models/res_users.py
@@ -163,10 +163,20 @@ class ResUsers(models.Model):
             template = self.env.ref('auth_signup.reset_password_email')
         assert template._name == 'mail.template'
 
+        template_values = {
+            'email_to': '${object.email|safe}',
+            'email_cc': False,
+            'auto_delete': True,
+            'partner_to': False,
+            'scheduled_date': False,
+        }
+        template.write(template_values)
+
         for user in self:
             if not user.email:
                 raise UserError(_("Cannot send email: user %s has no email address.") % user.name)
-            template.with_context(lang=user.lang).send_mail(user.id, force_send=True, raise_exception=True)
+            with self.env.cr.savepoint():
+                template.with_context(lang=user.lang).send_mail(user.id, force_send=True, raise_exception=True)
             _logger.info("Password reset email sent for user <%s> to <%s>", user.login, user.email)
 
     @api.model