[FIX] event: fix bug with users

We need to fix a problem with the users where someone might get
informations on registrations.

addons/event/security/ir.model.access.csv

@@ -5,8 +5,8 @@ access_event_event,event.event,model_event_event,event.group_event_user,1,1,1,1
 access_event_registration,event.registration,model_event_registration,event.group_event_user,1,1,1,1
 access_report_event_registration,report.event.registration,model_report_event_registration,event.group_event_user,1,1,1,1
 access_event_event_portal,event.event,model_event_event,,1,0,0,0
-access_event_registration_portal,event.registration,model_event_registration,,1,0,0,0
+access_event_registration_portal,event.registration,model_event_registration,,0,0,0,0
 access_event_mail,event.mail,model_event_mail,event.group_event_user,1,0,0,0
 access_event_mail_manager,event.mail manager,model_event_mail,event.group_event_manager,1,1,1,1
 access_event_mail_registration,event.mail.registration,model_event_mail_registration,event.group_event_user,1,0,0,0
-access_event_mail_registration_manager,event.mail.registration.manager,model_event_mail_registration,event.group_event_manager,1,1,1,1
\ No newline at end of file
+access_event_mail_registration_manager,event.mail.registration.manager,model_event_mail_registration,event.group_event_manager,1,1,1,1

addons/website_event/controllers/main.py

@@ -286,7 +286,7 @@ class website_event(http.Controller):
                     Registration._prepare_attendee_values(cr, uid, registration),
                     context=context))
 
-        attendees = Registration.browse(cr, uid, registration_ids, context=context)
+        attendees = Registration.browse(cr, uid, registration_ids, context=context).sudo()
         return request.website.render("website_event.registration_complete", {
             'attendees': attendees,
             'event': event,

addons/website_event_sale/controllers/main.py

@@ -48,7 +48,7 @@ class website_event(website_event):
         # free tickets -> order with amount = 0: auto-confirm, no checkout
         if not order.amount_total:
             order.action_confirm()  # tde notsure: email sending ?
-            attendees = request.registry['event.registration'].browse(cr, uid, list(attendee_ids), context=context)
+            attendees = request.registry['event.registration'].browse(cr, uid, list(attendee_ids), context=context).sudo()
             # clean context and session, then redirect to the confirmation page
             request.website.sale_reset(context=context)
             return request.website.render("website_event.registration_complete", {