pengyuthon/odoo_source
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[FIX] hr_expense: restrict account move domain for Expense Team Approver

Browse Source 
There is a ir.model.access rule that allows `hr_expense_team_approver`
group members to read account moves and account move lines. Another
existing rule forces the domain to only read account move lines that
have an associated expense_id. This rule however is not repeated for
account moves, and thus an `hr_expense_team_approver` group user is able
to access unrelated Customer Invoices / Vendor Bills on the portal at
`/my`.

To fix this, this commit adds a rule to prevent the
hr_expense_team_approver from reading any move that does not have at
least one line with an associated expense_id.

TT48242

closes odoo/odoo#158323

X-original-commit: 869fb231deaa986e687749ba639123988ceebc66
Signed-off-by: Florian Gilbert (flg) <flg@odoo.com>
This commit is contained in:
Víctor Martínez
2024-03-21 23:02:54 +00:00
parent 0c398c1142
commit 0b8010a4e6
1 changed files with 6 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
addons/hr_expense/security/ir_rule.xml
+6
View File
@@ -75,6 +75,12 @@
<field name="domain_force">['|',('company_id', '=', False), ('company_id', 'in', company_ids)]</field>
</record>
<record id="hr_expense_team_approver_account_move_rule" model="ir.rule">
<field name="name">Expense Team Approver Account Move</field>
<field name="model_id" ref="account.model_account_move"/>
<field name="domain_force">[('line_ids.expense_id', '!=', False)]</field>
<field name="groups" eval="[(4, ref('hr_expense.group_hr_expense_team_approver'))]"/>
</record>
<record id="hr_expense_team_approver_account_move_line_rule" model="ir.rule">
<field name="name">Expense Team Approver Account Move Line</field>
<field name="model_id" ref="account.model_account_move_line"/>