From 36b9899ec6883d1e007a50fcdc86a0596576b217 Mon Sep 17 00:00:00 2001
From: jem-odoo <jem@openerp.com>
Date: Mon, 30 Apr 2018 14:22:32 +0200
Subject: [PATCH] [FIX] sale_timesheet: overview access

On sales order form view, we display a "project overview"
stat button. It redirects to the overview of the only
billable project of the SO.
To avoid access error, and because this dahsboard is usefull
only for project manager, only those ones will have access to
this overview. So, stat button (Sales order) and label on
project kanban are aonly visible for manager.
---
 addons/sale_timesheet/models/sale_order.py         | 2 +-
 addons/sale_timesheet/views/project_task_views.xml | 2 +-
 addons/sale_timesheet/views/sale_order_views.xml   | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/addons/sale_timesheet/models/sale_order.py b/addons/sale_timesheet/models/sale_order.py
index 3e6077fbd66..6e9822f645b 100644
--- a/addons/sale_timesheet/models/sale_order.py
+++ b/addons/sale_timesheet/models/sale_order.py
@@ -88,7 +88,7 @@ class SaleOrder(models.Model):
         self.ensure_one()
         # redirect to form or kanban view
         billable_projects = self.project_ids.filtered(lambda project: project.sale_line_id)
-        if len(billable_projects) == 1:
+        if len(billable_projects) == 1 and self.env.user.has_group('project.group_project_manager'):
             action = billable_projects[0].action_view_timesheet_plan()
         else:
             view_form_id = self.env.ref('project.edit_project').id
diff --git a/addons/sale_timesheet/views/project_task_views.xml b/addons/sale_timesheet/views/project_task_views.xml
index 1ea95b50ad2..1ebdc46cbfa 100644
--- a/addons/sale_timesheet/views/project_task_views.xml
+++ b/addons/sale_timesheet/views/project_task_views.xml
@@ -7,7 +7,7 @@
         <field name="inherit_id" ref="hr_timesheet.view_project_kanban_inherited"/>
         <field name="arch" type="xml">
             <xpath expr="//a[@t-if='record.allow_timesheets.raw_value']" position="replace">
-                <a t-if="record.allow_timesheets.raw_value" name="action_view_timesheet" type="object" class="o_project_kanban_box o_project_timesheet_box" groups="hr_timesheet.group_hr_timesheet_user">
+                <a t-if="record.allow_timesheets.raw_value" name="action_view_timesheet" type="object" class="o_project_kanban_box o_project_timesheet_box" groups="project.group_project_manager">
                     <div>
                         <span class="o_label">Overview</span>
                     </div>
diff --git a/addons/sale_timesheet/views/sale_order_views.xml b/addons/sale_timesheet/views/sale_order_views.xml
index ea4f103ada3..50d2233ee39 100644
--- a/addons/sale_timesheet/views/sale_order_views.xml
+++ b/addons/sale_timesheet/views/sale_order_views.xml
@@ -23,7 +23,7 @@
                            icon="fa-puzzle-piece"
                            string="Project(s) Overview"
                            attrs="{'invisible': [('project_ids', '=', [])]}"
-                           groups="project.group_project_user">
+                           groups="project.group_project_manager">
                           <field name="project_ids" invisible="1"/>
                        </button>
                     </xpath>