From 23b2bba925c6bf2aac37c49bd2bdb3463f47e8a6 Mon Sep 17 00:00:00 2001
From: Nicolas Martinelli <nim@odoo.com>
Date: Wed, 18 Jan 2017 13:31:02 +0100
Subject: [PATCH] [FIX] calendar: private events

By default, an event can be modified by any employee. This is also the
case for private events, displayed as "Busy" to other users. However,
since any user can modify an event, nothing prevents him to change the
privacy setting in order to be able to see the content.

This commit introduces a global record rule which only allows the
followers of an event to modify it.

opw-705079
---
 addons/calendar/security/calendar_security.xml | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/addons/calendar/security/calendar_security.xml b/addons/calendar/security/calendar_security.xml
index 80eb79553a0..4636ec94bc8 100644
--- a/addons/calendar/security/calendar_security.xml
+++ b/addons/calendar/security/calendar_security.xml
@@ -23,5 +23,15 @@
             <field name="groups" eval="[(4, ref('base.group_portal'))]"/>            
         </record>
 
+        <record id="calendar_event_rule_private" model="ir.rule">
+            <field ref="model_calendar_event" name="model_id"/>
+            <field name="name">Private events</field>
+            <field name="domain_force">['|', ('class', '!=', 'private'), '&amp;', ('class', '=', 'private'), ('partner_ids', 'in', user.partner_id.id)]</field>
+            <field name="perm_read" eval="False"/>
+            <field name="perm_write" eval="True"/>
+            <field name="perm_create" eval="True"/>
+            <field name="perm_unlink" eval="True"/>
+        </record>
+
     </data>
 </openerp>