[FIX] hr_timesheet: allow leaves to be modified

- The HR staff may not be able to accept/refuse/cancel leaves if the
  module `project_timesheet_holidays` is installed.

  This is due to the commit c9da1571498ad1ded6b16d1483b8cb084d71f9de
  introducing a manual check on the current user's group without
  checking if the current environment is in superuser mode.

- Also fix the test verifying the access restriction, which meant to use
  a different user, but did that with sudo(), obviously defeating
  the fix. sudo is not used to switch user anymore, that `with_user`.

closes odoo/odoo#55274

X-original-commit: 75a166f1d115cc712bb39e7711d0fcb173732650
Related: odoo/enterprise#12149
Signed-off-by: Olivier Dony (odo) <odo@openerp.com>

2 files changed, 3 insertions, 4 deletions

diff --git a/addons/hr_timesheet/models/hr_timesheet.py b/addons/hr_timesheet/models/hr_timesheet.py
index 50fd2bce355..bd4338673c1 100644
--- a/addons/hr_timesheet/models/hr_timesheet.py
+++ b/addons/hr_timesheet/models/hr_timesheet.py
@@ -94,7 +94,7 @@ class AccountAnalyticLine(models.Model):
 
     def write(self, values):
         # If it's a basic user then check if the timesheet is his own.
-        if not self.user_has_groups('hr_timesheet.group_hr_timesheet_approver') and any(self.env.user.id != analytic_line.user_id.id for analytic_line in self):
+        if not (self.user_has_groups('hr_timesheet.group_hr_timesheet_approver') or self.env.su) and any(self.env.user.id != analytic_line.user_id.id for analytic_line in self):
             raise AccessError(_("You cannot access timesheets that are not yours."))
 
         values = self._timesheet_preprocess(values)
diff --git a/addons/hr_timesheet/tests/test_timesheet.py b/addons/hr_timesheet/tests/test_timesheet.py
index 64e7f13d2af..4113b052ea0 100644
--- a/addons/hr_timesheet/tests/test_timesheet.py
+++ b/addons/hr_timesheet/tests/test_timesheet.py
@@ -267,10 +267,9 @@ class TestTimesheet(TestCommonTimesheet):
         })
         timesheets = timesheet_1 + timesheet_2
 
-        # increase unit_amount to trigger amount recomputation
         with self.assertRaises(AccessError):
-            # because the employee 1 is the sudo and he doesn't have the access right to update timesheet of employee 2
-            timesheets.sudo().write({
+            # should raise since employee 1 doesn't have the access rights to update employee's 2 timesheet
+            timesheets.with_user(self.empl_employee.user_id).write({
                 'unit_amount': 2,
             })