Permission of ir.config_paramenter in odoo 12

Question

I got this problem. Why i get this access error and how can i fix it?

Odoo Server Error - Access Error
Sorry, you are not allowed to access this document. Only users with the following access level are currently allowed to do that:

• Administration/Settings

(Document model: ir.config_parameter) - (Operation: read, User: 21)

Here is my code:

Button submit:

    <button string="Confirm" name="button_submit" states="draft" type="object" class="oe_highlight"/>

My python code:

    def send_email(self, subject, message_body, email_from, email_to): 
        template_obj = self.env['mail.mail']
        template_data = { 
            'subject': subject,
            'body_html': message_body,
            'email_from': email_from, 
            'email_to': email_to 
        } 
        template_id = template_obj.create(template_data)
        template_obj.send(template_id)
        template_id.send()

    @api.multi
    def request_recuitment_send_mail(self):
        """ Send mail with wizard """
         base_url = request.env['ir.config_parameter'].get_param('web.base.url')
        base_url += '/web#id=%d&view_type=form&model=%s' % (self.id, self._name)
        subject = '''Request recuitment for {}'''.format(self.job_id.name)
        message_body = '''
            <div style="font-size: medium;">
                Dear {},
                Please check this link for more information <a href="{}">Click here</a>
            '''.format(
            self.user_id.name,
            base_url,
        )
        email_from = '''HR Recruiment <{}>'''.format(self.approver_id.work_email)
        email_to = self.user_id.email
        self.send_email(subject, message_body, email_from, email_to)

    @api.multi
    def button_approve(self):
        subject = "Request recruitment for {self.job_id.name} has been approved "
        body = '''
            Position Request: {}
            Quantity of Position: {}
            Department: {}
            Expected Gross Salary: {}
        '''.format(
            self.job_id.name,
            self.quantity,
            self.department_id.name,
            self.salary_cross_expected
        )
        self.env['mail.message'].create({'message_type': "notification",
                                         "subtype": self.env.ref("mail.mt_comment").id,
                                         'body': body,
                                         'subject': subject,
                                         'needaction_partner_ids': [(4, self.user_id.partner_id.id,)],
                                         'model': self._name,
                                         'res_id': self.id,
                                         })
        self.request_recuitment_approved_send_mail()
        self.write({'state': 'approved'})

Answer 1

It should be safe to use sudo() in this case:

request.env['ir.config_parameter'].sudo().get_param('web.base.url')

"Normal" Users don't have any rights on model ir.config_parameter (System parameters). Only the admin (one of its default access groups) or the superuser can read such parameters.

About sudo([flag=True]) from the current documentation (Odoo 15):

Returns a new version of this recordset with superuser mode enabled or disabled, depending on flag. The superuser mode does not change the current user, and simply bypasses access rights checks.

IMPORTANT: I'm not completely sure when it was changed, but IIRC the "current user change" was removed since Odoo 13. So for Odoo 12 sudo will change the current user, which for example will have impacts on default values on creation, created message authors, and so on.

In your case that's irrelevant, because you're only getting the base url or the parameter value, and that's it.