[FW][IMP] website_event: avoid issue when registering as portal

A computed field on event may crash if current user is a portal user as it
tries to access registrations to know if current user is already participating
to the event.

We also fix ACL on the registrations as most code already use it as sudo and
do not access it directly. Only the event users or admins should access it
directly.

Task ID-2322411
PR odoo/odoo#68699

closes odoo/odoo#69939

closes odoo/odoo#69965

X-original-commit: odoo/odoo@f7c95d959520675fe11a345c3d9b1b85a675f9fa
Signed-off-by: Thibault Delavallee (tde) <tde@openerp.com>

addons/event/i18n/event.pot

@@ -1478,6 +1478,12 @@ msgstr ""
 msgid "Online events like webinars do not require a specific location and are hosted online."
 msgstr ""
 
+#. module: event
+#: code:addons/event/models/event.py:386
+#, python-format
+msgid "Only event users or managers are allowed to create or update registrations."
+msgstr ""
+
 #. module: event
 #: model_terms:event.event,description:event.event_0
 msgid "OpenElec Applications 23 Rockwell Lane, Los Angeles, CA 90001, United States"

addons/event/models/event.py

@@ -390,6 +390,14 @@ class EventRegistration(models.Model):
             registration.sudo().confirm_registration()
         return registration
 
+    @api.model
+    def check_access_rights(self, operation, raise_exception=True):
+        if not self.env.user._is_admin() and not self.user_has_groups('event.group_event_user'):
+            if raise_exception:
+                raise AccessError(_('Only event users or managers are allowed to create or update registrations.'))
+            return False
+        return super(EventRegistration, self).check_access_rights(operation, raise_exception=raise_exception)
+
     @api.model
     def _prepare_attendee_values(self, registration):
         """ Method preparing the values to create new attendees based on a

addons/website_event/models/event.py

@@ -47,7 +47,7 @@ class Event(models.Model):
             for event in self:
                 domain = ['&','&', '|', ('email', '=', email), ('partner_id', '=', self.env.user.partner_id.id),
                           ('event_id', '=', event.id), ('state', '!=', 'cancel')]
-                event.is_participating = self.env['event.registration'].search_count(domain)
+                event.is_participating = self.env['event.registration'].sudo().search_count(domain)
 
     @api.multi
     @api.depends('name')