[FIX] crm: don't bypass access right to find partner:

Problem
-------

Sales people can have restriction on partner they can see
Private addresses, multi company, ....

When they convert a lead to opportunity, it's currently possible
that the wizard will find and link a partner that the current user
cannot see.

Solution
--------
Field that are now computed store field, that were previously
normal field with onchange, should not be computed as sudo
to respect the record rule

closes odoo/odoo#59517

X-original-commit: af9db1d2aa605d46b5b5dae3d63533367c431f33
Signed-off-by: Thibault Delavallee (tde) <tde@openerp.com>

2 files changed, 27 insertions, 1 deletions

diff --git a/addons/crm/tests/test_crm_lead_convert.py b/addons/crm/tests/test_crm_lead_convert.py
index 71532306629..c381afdf30a 100644
--- a/addons/crm/tests/test_crm_lead_convert.py
+++ b/addons/crm/tests/test_crm_lead_convert.py
@@ -1,6 +1,7 @@
 # -*- coding: utf-8 -*-
 # Part of Odoo. See LICENSE file for full copyright and licensing details.
 
+from odoo import SUPERUSER_ID
 from odoo.addons.crm.tests import common as crm_common
 from odoo.fields import Datetime
 from odoo.tests.common import tagged, users
@@ -207,6 +208,31 @@ class TestLeadConvert(crm_common.TestLeadConvertCommon):
         self.assertEqual(self.lead_1.partner_id, self.env['res.partner'])
 
     @users('user_sales_manager')
+    def test_lead_convert_contact_mutlicompany(self):
+        """ Check the wizard convert to opp don't find contact
+        You are not able to see because they belong to another company """
+        # Use superuser_id because creating a company with a user add directly
+        # the company in company_ids of the user.
+        company_2 = self.env['res.company'].with_user(SUPERUSER_ID).create({'name': 'Company 2'})
+        partner_company_2 = self.env['res.partner'].with_user(SUPERUSER_ID).create({
+            'name': 'Contact in other company',
+            'email': 'test@company2.com',
+            'company_id': company_2.id,
+        })
+        lead = self.env['crm.lead'].create({
+            'name': 'LEAD',
+            'type': 'lead',
+            'email_from': 'test@company2.com',
+        })
+        convert = self.env['crm.lead2opportunity.partner'].with_context({
+            'active_model': 'crm.lead',
+            'active_id': lead.id,
+            'active_ids': lead.ids,
+        }).create({'name': 'convert', 'action': 'exist'})
+        self.assertNotEqual(convert.partner_id, partner_company_2,
+            "Conversion wizard should not be able to find the partner from another company")
+
+    @users('user_sales_manager')
     def test_lead_convert_same_partner(self):
         """ Check that we don't erase lead information
         with existing partner info if the partner is already set
diff --git a/addons/crm/tests/test_crm_lead_convert_mass.py b/addons/crm/tests/test_crm_lead_convert_mass.py
index d36878733d6..44d6281cef2 100644
--- a/addons/crm/tests/test_crm_lead_convert_mass.py
+++ b/addons/crm/tests/test_crm_lead_convert_mass.py
@@ -166,7 +166,7 @@ class TestLeadConvertMass(crm_common.TestLeadConvertMassCommon):
         test_leads = self._create_leads_batch(count=50, user_ids=[False])
         user_ids = self.assign_users.ids
 
-        with self.assertQueryCount(user_sales_manager=1347):  # crm only: 1336
+        with self.assertQueryCount(user_sales_manager=1363):  # crm only: 1352
             mass_convert = self.env['crm.lead2opportunity.partner.mass'].with_context({
                 'active_model': 'crm.lead',
                 'active_ids': test_leads.ids,