From 0b8010a4e613da99ce1abd0640e9877a8d26a9c6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?V=C3=ADctor=20Mart=C3=ADnez?=
 <victor.martinez@tecnativa.com>
Date: Thu, 7 Mar 2024 09:40:15 +0100
Subject: [PATCH] [FIX] hr_expense: restrict account move domain for Expense
 Team Approver

There is a ir.model.access rule that allows `hr_expense_team_approver`
group members to read account moves and account move lines. Another
existing rule forces the domain to only read account move lines that
have an associated expense_id. This rule however is not repeated for
account moves, and thus an `hr_expense_team_approver` group user is able
to access unrelated Customer Invoices / Vendor Bills on the portal at
`/my`.

To fix this, this commit adds a rule to prevent the
hr_expense_team_approver from reading any move that does not have at
least one line with an associated expense_id.

TT48242

closes odoo/odoo#158323

X-original-commit: 869fb231deaa986e687749ba639123988ceebc66
Signed-off-by: Florian Gilbert (flg) <flg@odoo.com>
---
 addons/hr_expense/security/ir_rule.xml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/addons/hr_expense/security/ir_rule.xml b/addons/hr_expense/security/ir_rule.xml
index 70e2fe2dd77..6d0f4a0b46c 100644
--- a/addons/hr_expense/security/ir_rule.xml
+++ b/addons/hr_expense/security/ir_rule.xml
@@ -75,6 +75,12 @@
             <field name="domain_force">['|',('company_id', '=', False), ('company_id', 'in', company_ids)]</field>
         </record>
 
+        <record id="hr_expense_team_approver_account_move_rule" model="ir.rule">
+            <field name="name">Expense Team Approver Account Move</field>
+            <field name="model_id" ref="account.model_account_move"/>
+            <field name="domain_force">[('line_ids.expense_id', '!=', False)]</field>
+            <field name="groups" eval="[(4, ref('hr_expense.group_hr_expense_team_approver'))]"/>
+        </record>
         <record id="hr_expense_team_approver_account_move_line_rule" model="ir.rule">
             <field name="name">Expense Team Approver Account Move Line</field>
             <field name="model_id" ref="account.model_account_move_line"/>