[MERGE] base: use ir.model.access on TransientModels

Before this commit, models with the `_transient` flag were ignored in
ir.model.access verifications. Only an implicit ir.rule with the
domain (create_uid=user.id) was applied to avoid most side effects.

The problem is that, often, the security does not lie in side-effects
of abusing of somebody else's wizard record but in the fact that the
wizard methods blindly trust only the right users are creating these
records. Too often, too many sudo were used and creating wizard with
chosen values could lead to an abuse scenario.

Instead, explicitly require the developer to declare security rules
the same way as on any other model.

closes odoo/odoo#43306

Task-id: 1863044
Pad: https://pad.odoo.com/p/r.c1befa51103ed3b955a427971eb19719
Signed-off-by: Martin Trigaux (mat) <mat@odoo.com>

addons/account/security/ir.model.access.csv

@@ -123,3 +123,19 @@ access_account_payment_method_readonly,account.payment.method,model_account_paym
 access_account_payment_method,account.payment.method,model_account_payment_method,account.group_account_invoice,1,1,1,1
 access_account_payment_readonly,account.payment,model_account_payment,account.group_account_readonly,1,0,0,0
 access_account_payment,account.payment,model_account_payment,account.group_account_invoice,1,1,1,1
+
+access_account_payment_register,access.account.payment.register,model_account_payment_register,account.group_account_invoice,1,1,1,0
+access_account_bank_statement_closebalance,access.account.bank.statement.closebalance,model_account_bank_statement_closebalance,account.group_account_user,1,1,1,0
+access_account_accrual_accounting_wizard,access.account.accrual.accounting.wizard,model_account_accrual_accounting_wizard,account.group_account_user,1,1,1,0
+access_account_unreconcile,access.account.unreconcile,model_account_unreconcile,account.group_account_user,1,1,1,0
+access_validate_account_move,access.validate.account.move,model_validate_account_move,account.group_account_invoice,1,1,1,0
+access_cash_box_out,access.cash.box.out,model_cash_box_out,account.group_account_user,1,1,1,0
+access_account_move_reversal,access.account.move.reversal,model_account_move_reversal,account.group_account_invoice,1,1,1,0
+access_account_common_report,access.account.common.report,model_account_common_report,account.group_account_user,1,1,1,0
+access_account_common_journal_report,access.account.common.journal.report,model_account_common_journal_report,account.group_account_user,1,1,1,0
+access_account_print_journal,access.account.print.journal,model_account_print_journal,account.group_account_user,1,1,1,0
+access_account_financial_year_op,access.account.financial.year.op,model_account_financial_year_op,account.group_account_manager,1,1,1,0
+access_account_setup_bank_manual_config,access.account.setup.bank.manual.config,model_account_setup_bank_manual_config,account.group_account_user,1,1,1,0
+access_tax_adjustments_wizard,access.tax.adjustments.wizard,model_tax_adjustments_wizard,account.group_account_user,1,1,1,0
+access_account_invoice_send,access.account.invoice.send,model_account_invoice_send,account.group_account_invoice,1,1,1,0
+access_account_transfer_wizard,access.account.transfer.wizard,model_account_transfer_wizard,account.group_account_user,1,1,1,0

addons/account/wizard/account_invoice_send_views.xml

@@ -86,8 +86,7 @@
             context="{
                 'default_template_id': ref('account.email_template_edi_invoice'),
                 'mark_invoice_as_sent': True,
-            }"
-            groups="account.group_account_invoice"/>
+            }"/>
 
     </data>
 

addons/account_check_printing/__manifest__.py

@@ -13,6 +13,7 @@ The check settings are located in the accounting journals configuration page.
     """,
     'depends': ['account'],
     'data': [
+        'security/ir.model.access.csv',
         'data/account_check_printing_data.xml',
         'views/account_journal_views.xml',
         'views/account_payment_views.xml',

addons/account_check_printing/security/ir.model.access.csv

@@ -0,0 +1,2 @@
+"id","name","model_id:id","group_id:id","perm_read","perm_write","perm_create","perm_unlink"
+"access_print_prenumbered_checks","access.print.prenumbered.checks","model_print_prenumbered_checks","account.group_account_user",1,1,1,0

addons/base_gengo/__manifest__.py

@@ -16,6 +16,7 @@ This wizard will activate the CRON job and the Scheduler and will start the auto
     """,
     'depends': ['base_setup'],
     'data': [
+        'security/ir.model.access.csv',
         'data/ir_cron_data.xml',
         'views/ir_translation_views.xml',
         'views/res_config_settings_views.xml',

addons/base_gengo/security/ir.model.access.csv

@@ -0,0 +1,2 @@
+"id","name","model_id:id","group_id:id","perm_read","perm_write","perm_create","perm_unlink"
+"access_base_gengo_translations","access.base.gengo.translations","model_base_gengo_translations","base.group_system",1,1,1,0

addons/base_import/security/ir.model.access.csv

@@ -15,3 +15,4 @@ access_base_import_tests_models_float,base.import.tests.models.float,model_base_
 access_base_import_tests_models_preview,base.import.tests.models.preview,model_base_import_tests_models_preview,base.group_user,1,1,1,1
 access_base_import_mapping,base.import.mapping,model_base_import_mapping,base.group_user,1,1,1,1
 access_base_import_tests_models_complex,access_base_import_tests_models_complex,model_base_import_tests_models_complex,base.group_user,1,0,0,0
+access_base_import_import,access.base_import.import,model_base_import_import,base.group_user,1,1,1,0

addons/base_import_module/__manifest__.py

@@ -13,5 +13,8 @@ for customization purpose.
     'depends': ['web'],
     'installable': True,
     'auto_install': False,
-    'data': ['views/base_import_module_view.xml'],
+    'data': [
+        'security/ir.model.access.csv',
+        'views/base_import_module_view.xml'
+    ],
 }

addons/base_import_module/security/ir.model.access.csv

@@ -0,0 +1,2 @@
+"id","name","model_id:id","group_id:id","perm_read","perm_write","perm_create","perm_unlink"
+"access_base_import_module","access.base.import.module","model_base_import_module","base.group_system",1,1,1,0

addons/base_sparse_field/__manifest__.py

@@ -12,6 +12,7 @@
     'version': '1.0',
     'depends': ['base'],
     'data': [
+        'security/ir.model.access.csv',
         'views/views.xml',
     ],
 }

addons/base_sparse_field/security/ir.model.access.csv

@@ -0,0 +1,2 @@
+"id","name","model_id:id","group_id:id","perm_read","perm_write","perm_create","perm_unlink"
+"access_sparse_fields_test","access.sparse_fields.test","model_sparse_fields_test","base.group_system",1,1,1,0

addons/crm/security/ir.model.access.csv

@@ -23,3 +23,8 @@ access_calendar_event_type_sale_salesman,calendar.event.type.salesman,calendar.m
 access_mail_activity_type_sale_manager,mail.activity.type.sale.manager,mail.model_mail_activity_type,sales_team.group_sale_manager,1,1,1,1
 access_crm_lead_scoring_frequency,access_crm_lead_scoring_frequency,model_crm_lead_scoring_frequency,sales_team.group_sale_salesman,1,0,0,0
 access_crm_lead_scoring_frequency_field,access_crm_lead_scoring_frequency_field,model_crm_lead_scoring_frequency_field,sales_team.group_sale_salesman,1,0,0,0
+access_crm_lead_lost,access.crm.lead.lost,model_crm_lead_lost,sales_team.group_sale_salesman,1,1,1,0
+access_crm_partner_binding,access.crm.partner.binding,model_crm_partner_binding,base.group_partner_manager,1,1,1,0
+access_crm_lead2opportunity_partner,access.crm.lead2opportunity.partner,model_crm_lead2opportunity_partner,sales_team.group_sale_salesman,1,1,1,0
+access_crm_lead2opportunity_partner_mass,access.crm.lead2opportunity.partner.mass,model_crm_lead2opportunity_partner_mass,sales_team.group_sale_salesman,1,1,1,0
+access_crm_merge_opportunity,access.crm.merge.opportunity,model_crm_merge_opportunity,sales_team.group_sale_salesman,1,1,1,0

addons/crm/tests/test_crm_lead_lost.py

@@ -28,9 +28,10 @@ class TestLeadConvert(crm_common.TestCrmCommon):
 
         lost_wizard = self.env['crm.lead.lost'].with_context({
             'active_ids': lead.ids,
-        }).create({})
+        }).create({
+            'lost_reason_id': self.lost_reason.id
+        })
 
-        lost_wizard.write({'lost_reason_id': self.lost_reason.id})
         lost_wizard.action_lost_reason_apply()
 
         self.assertEqual(lead.probability, 0)
@@ -55,8 +56,9 @@ class TestLeadConvert(crm_common.TestCrmCommon):
 
         lost_wizard = self.env['crm.lead.lost'].with_context({
             'active_ids': lead.ids
-        }).create({})
-        lost_wizard.write({'lost_reason_id': lost_reason.id})
+        }).create({
+            'lost_reason_id': lost_reason.id
+        })
 
         # nice try little salesman, you cannot invoke a wizard to update other people leads
         with self.assertRaises(AccessError):

addons/crm/views/crm_lead_views.xml

@@ -751,7 +751,6 @@
                             'default_use_template': True,
                             'default_template_id': ref('crm.email_template_opportunity_mail'),
                         }"
-                groups="sales_team.group_sale_salesman"
                 />
 
         <!--Update of email_template defined in crm_lead_data, to add ref_ir_act_window

addons/crm/wizard/crm_lead_to_opportunity_mass_views.xml

@@ -58,6 +58,5 @@
         view_mode="form" target="new"
         context="{'mass_convert' : True}"
         view_id="view_crm_lead2opportunity_partner_mass"
-        groups="sales_team.group_sale_salesman"
     />
 </odoo>

addons/crm/wizard/crm_merge_opportunities_views.xml

@@ -40,7 +40,6 @@
             binding_model="crm.lead"
             binding_views="list"
             view_mode="form"
-            target="new"
-            groups="sales_team.group_sale_salesman" />
+            target="new" />
 
 </odoo>

addons/delivery/security/ir.model.access.csv

@@ -7,3 +7,5 @@ access_delivery_carrier_partner_manager,delivery.carrier partner_manager,model_d
 access_delivery_carrier_stock_user,delivery.carrier stock_user,model_delivery_carrier,stock.group_stock_user,1,0,0,0
 access_delivery_carrier_stock_manager,delivery.carrier,model_delivery_carrier,stock.group_stock_manager,1,1,1,1
 access_delivery_price_rule_stock_manager,delivery.price.rule,model_delivery_price_rule,stock.group_stock_manager,1,1,1,1
+access_choose_delivery_package,access.choose.delivery.package,model_choose_delivery_package,stock.group_stock_user,1,1,1,0
+access_choose_delivery_carrier,access.choose.delivery.carrier,model_choose_delivery_carrier,stock.group_stock_user,1,1,1,0

addons/event_sale/security/ir.model.access.csv

@@ -1,3 +1,6 @@
 id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink
 access_product_template_event_manager,product.template.event.manager,product.model_product_template,event.group_event_manager,1,1,1,1
 access_product_product_event_manager,product.product.event.manager,product.model_product_product,event.group_event_manager,1,1,1,1
+access_registration_editor,access.registration.editor,model_registration_editor,sales_team.group_sale_salesman,1,1,1,0
+access_registration_editor_line,access.registration.editor.line,model_registration_editor_line,sales_team.group_sale_salesman,1,1,1,1
+access_event_event_configurator,access.event.event.configurator,model_event_event_configurator,sales_team.group_sale_salesman,1,1,1,0

addons/gamification/security/ir.model.access.csv

@@ -30,3 +30,6 @@ gamification_karma_rank_access_all,gamification.karma.rank.access.all,gamificati
 gamification_karma_rank_access_user_manager,gamification.karma.rank.access.user.manager,gamification.model_gamification_karma_rank,base.group_system,1,1,1,1
 gamification_karma_tracking_access_all,gamification.karma.tracking.access.all,gamification.model_gamification_karma_tracking,,0,0,0,0
 gamification_karma_tracking_access_user_manager,gamification.karma.tracking.access.user.manager,gamification.model_gamification_karma_tracking,base.group_system,1,1,1,1
+
+access_gamification_goal_wizard,access.gamification.goal.wizard,model_gamification_goal_wizard,base.group_user,1,1,1,0
+access_gamification_badge_user_wizard,access.gamification.badge.user.wizard,model_gamification_badge_user_wizard,base.group_user,1,1,1,0

addons/google_account/models/google_service.py

@@ -22,8 +22,7 @@ GOOGLE_TOKEN_ENDPOINT = 'https://accounts.google.com/o/oauth2/token'
 GOOGLE_API_BASE_URL = 'https://www.googleapis.com'
 
 
-# FIXME : this needs to become an AbstractModel, to be inhereted by google_calendar_service and google_drive_service
-class GoogleService(models.TransientModel):
+class GoogleService(models.AbstractModel):
     _name = 'google.service'
     _description = 'Google Service'
 

addons/hr/security/ir.model.access.csv

@@ -13,3 +13,5 @@ access_hr_plan_activity_type_employee,access_hr_plan_activity_type,model_hr_plan
 access_hr_plan_employee,access_hr_plan_employee,model_hr_plan,base.group_user,1,0,0,0
 access_hr_plan_activity_type_hr_user,access_hr_plan_activity_type,model_hr_plan_activity_type,group_hr_user,1,1,1,1
 access_hr_plan_hr_user,access_hr_plan_hr_user,model_hr_plan,group_hr_user,1,1,1,1
+access_hr_plan_wizard,access.hr.plan.wizard,model_hr_plan_wizard,hr.group_hr_manager,1,1,1,0
+access_hr_departure_wizard,access.hr.departure.wizard,model_hr_departure_wizard,hr.group_hr_user,1,1,1,0

addons/hr_expense/security/ir.model.access.csv

@@ -16,3 +16,5 @@ access_account_move_user,account.move.user,account.model_account_move,hr_expense
 access_account_move_line_user,account.move.line.user,account.model_account_move_line,hr_expense.group_hr_expense_team_approver,1,0,0,0
 access_account_analytic_line_user,account.analytic.line.user,account.model_account_analytic_line,hr_expense.group_hr_expense_team_approver,1,1,1,1
 access_mail_activity_type_expense_user,mail.activity.type.expense.user,mail.model_mail_activity_type,hr_expense.group_hr_expense_manager,1,1,1,1
+access_hr_expense_refuse_wizard,access.hr.expense.refuse.wizard,model_hr_expense_refuse_wizard,hr_expense.group_hr_expense_team_approver,1,1,1,0
+access_hr_expense_sheet_register_payment_wizard,access.hr.expense.sheet.register.payment.wizard,model_hr_expense_sheet_register_payment_wizard,account.group_account_manager,1,1,1,0

addons/hr_holidays/security/ir.model.access.csv

@@ -14,3 +14,4 @@ access_calendar_event_hr_user,calendar.event.hr.user,calendar.model_calendar_eve
 access_calendar_event_type_manager,calendar.event.type.manager,calendar.model_calendar_event_type,hr_holidays.group_hr_holidays_manager,1,1,1,1
 access_calendar_attendee_hr_user,calendar.attendee.hr.user,calendar.model_calendar_attendee,hr_holidays.group_hr_holidays_user,1,1,1,1
 access_mail_activity_type_holidays_manager,mail.activity.type.holidays.manager,mail.model_mail_activity_type,hr_holidays.group_hr_holidays_manager,1,1,1,1
+access_hr_holidays_summary_employee,access.hr.holidays.summary.employee,model_hr_holidays_summary_employee,hr_holidays.group_hr_holidays_user,1,1,1,0

addons/hr_recruitment/security/ir.model.access.csv

@@ -11,3 +11,4 @@ access_hr_recruitment_source_all,hr.recruitment.source,model_hr_recruitment_sour
 access_hr_applicant_category,hr.applicant_category,model_hr_applicant_category,,1,1,1,0
 access_hr_applicant_category_manager,hr.applicant_category,model_hr_applicant_category,group_hr_recruitment_user,1,1,1,1
 access_calendar_event_type_hr_officer,calendar.event.type.officer,calendar.model_calendar_event_type,group_hr_recruitment_user,1,1,1,0
+access_applicant_get_refuse_reason,access.applicant.get.refuse.reason,model_applicant_get_refuse_reason,hr_recruitment.group_hr_recruitment_user,1,1,1,0

addons/hr_timesheet/security/ir.model.access.csv

@@ -4,3 +4,4 @@ access_account_analytic_user,analytic.account.analytic.timesheet.user,analytic.m
 access_uom_uom_hr_timesheet,uom.uom.timesheet.user,uom.model_uom_uom,hr_timesheet.group_hr_timesheet_user,1,0,0,0
 access_project_project,project.project.timesheet.user,model_project_project,hr_timesheet.group_hr_timesheet_user,1,0,0,0
 access_project_task,project.task.timesheet.user,model_project_task,hr_timesheet.group_hr_timesheet_user,1,1,0,0
+access_project_task_create_timesheet,access.project.task.create.timesheet,model_project_task_create_timesheet,hr_timesheet.group_hr_timesheet_user,1,1,1,0

addons/l10n_eu_service/security/ir.model.access.csv

@@ -1,3 +1,4 @@
 id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink
 access_l10n_eu_service_service_tax_rate_user,access_l10n_eu_service_service_tax_rate,model_l10n_eu_service_service_tax_rate,,1,0,0,0
 access_l10n_eu_service_service_tax_rate_manager,access_l10n_eu_service_service_tax_rate,model_l10n_eu_service_service_tax_rate,account.group_account_manager,1,1,1,1
+access_l10n_eu_service_wizard,access.l10n_eu_service.wizard,model_l10n_eu_service_wizard,account.group_account_manager,1,1,1,0

addons/mail/security/ir.model.access.csv

@@ -38,3 +38,10 @@ access_mail_activity_type_all,mail.activity.type.all,model_mail_activity_type,,0
 access_mail_activity_type_user,mail.activity.type.user,model_mail_activity_type,base.group_user,1,0,0,0
 access_mail_activity_type_system,mail.activity.type.system,model_mail_activity_type,base.group_system,1,1,1,1
 access_mail_blacklist_system,access_mail_blacklist_system,model_mail_blacklist,base.group_system,1,1,1,1
+access_mail_wizard_invite,access.mail.wizard.invite,model_mail_wizard_invite,base.group_user,1,1,1,0
+access_mail_compose_message,access.mail.compose.message,model_mail_compose_message,base.group_user,1,1,1,0
+access_mail_compose_message_portal,access.mail.compose.message.portal,model_mail_compose_message,base.group_portal,1,1,1,0
+access_mail_resend_cancel,access.mail.resend.cancel,model_mail_resend_cancel,base.group_user,1,1,1,0
+access_mail_resend_message,access.mail.resend.message,model_mail_resend_message,base.group_user,1,1,1,0
+access_mail_resend_partner,access.mail.resend.partner,model_mail_resend_partner,base.group_user,1,1,1,0
+access_mail_template_preview,access.mail.template.preview,model_mail_template_preview,base.group_user,1,1,1,0

addons/mail/security/mail_security.xml

@@ -47,5 +47,16 @@
             <field name="model_id" ref="model_mail_moderation"/>
             <field name="domain_force">[('channel_id.moderator_ids', 'in', user.id)]</field>
         </record>
+
+        <record id="mail_compose_message_rule" model="ir.rule">
+            <field name="name">Mail Compose Message Rule</field>
+            <field name="model_id" ref="model_mail_compose_message"/>
+            <field name="domain_force">[('create_uid', '=', user.id)]</field>
+            <field name="global" eval="True"/>
+            <field name="perm_create" eval="False"/>
+            <field name="perm_read" eval="True"/>
+            <field name="perm_write" eval="True"/>
+            <field name="perm_unlink" eval="False"/>
+        </record>
     </data>
 </odoo>

addons/mass_mailing/security/ir.model.access.csv

@@ -14,3 +14,6 @@ access_utm_source,access_utm_source,utm.model_utm_source,mass_mailing.group_mass
 access_ir_mail_server,access_ir_mail_server,base.model_ir_mail_server,mass_mailing.group_mass_mailing_user,1,0,0,0
 access_mail_blacklist_mass_mailing_user,access.mail.blacklist.mass_mailing_user,mail.model_mail_blacklist,mass_mailing.group_mass_mailing_user,1,1,1,1
 access_link_tracker_mailing,access.link.tracker.mailing,link_tracker.model_link_tracker,mass_mailing.group_mass_mailing_user,1,1,1,1
+access_mailing_list_merge,access.mailing.list.merge,model_mailing_list_merge,mass_mailing.group_mass_mailing_user,1,1,1,0
+access_mailing_mailing_schedule_date,access.mailing.mailing.schedule.date,model_mailing_mailing_schedule_date,mass_mailing.group_mass_mailing_user,1,1,1,0
+access_mailing_mailing_test,access.mailing.mailing.test,model_mailing_mailing_test,mass_mailing.group_mass_mailing_user,1,1,1,0

addons/mass_mailing_sms/security/ir.model.access.csv

@@ -1 +1,2 @@
-id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink
+id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink
+access_mailing_sms_test,access.mailing.sms.test,model_mailing_sms_test,mass_mailing.group_mass_mailing_user,1,1,1,0

addons/membership/security/ir.model.access.csv

@@ -2,3 +2,4 @@ id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink
 access_membership_membership_line_partner_manager,membership.membership_line partner_manager,model_membership_membership_line,base.group_partner_manager,1,1,1,1
 access_membership_membership_line,membership.membership_line,model_membership_membership_line,,1,0,0,0
 access_report_membership,report.membership,model_report_membership,base.group_partner_manager,1,0,0,0
+access_membership_invoice,access.membership.invoice,model_membership_invoice,account.group_account_user,1,1,1,0

addons/mrp/security/ir.model.access.csv

@@ -60,3 +60,7 @@ access_mrp_unbuild,mrp.unbuild,model_mrp_unbuild,group_mrp_user,1,1,1,1
 access_mrp_unbuild_manager,mrp.unbuild manager,model_mrp_unbuild,group_mrp_manager,1,1,1,1
 access_mrp_document_mrp_manager,mrp.document group_user,model_mrp_document,group_mrp_manager,1,1,1,1
 access_mrp_document_mrp_user,mrp.document group_user,model_mrp_document,group_mrp_user,1,1,1,1
+access_mrp_product_produce,access.mrp.product.produce,model_mrp_product_produce,mrp.group_mrp_user,1,1,1,0
+access_mrp_product_produce_line,access.mrp.product.produce.line,model_mrp_product_produce_line,mrp.group_mrp_user,1,1,1,1
+access_change_production_qty,access.change.production.qty,model_change_production_qty,mrp.group_mrp_user,1,1,1,0
+access_stock_warn_insufficient_qty_unbuild,access.stock.warn.insufficient.qty.unbuild,model_stock_warn_insufficient_qty_unbuild,mrp.group_mrp_user,1,1,1,0

addons/payment/security/ir.model.access.csv

@@ -10,4 +10,6 @@ payment_method_portal,payment.token.portal,model_payment_token,base.group_portal
 payment_method_system,payment.token.system,model_payment_token,base.group_system,1,1,1,1
 payment_icon_all,payment.icon.all,model_payment_icon,,1,0,0,0
 payment_icon_user,payment.icon.user,model_payment_icon,base.group_user,1,1,1,0
-payment_icon_system,payment.icon.system,model_payment_icon,base.group_system,1,1,1,1
+payment_icon_system,payment.icon.system,model_payment_icon,base.group_system,1,1,1,1
+access_payment_acquirer_onboarding_wizard,access.payment.acquirer.onboarding.wizard,model_payment_acquirer_onboarding_wizard,base.group_system,1,1,1,0
+access_payment_link_wizard,access.payment.link.wizard,model_payment_link_wizard,account.group_account_user,1,1,1,0

addons/point_of_sale/security/ir.model.access.csv

@@ -40,3 +40,6 @@ access_decimal_precision_user,decimal.precision,base.model_decimal_precision,gro
 access_pos_payment_user,pos.payment user,model_pos_payment,group_pos_user,1,1,1,1
 access_pos_payment_method_user,pos.payment.method user,model_pos_payment_method,group_pos_user,1,0,0,0
 access_pos_payment_method_manager,pos.payment.method manager,model_pos_payment_method,group_pos_manager,1,1,1,1
+access_closing_balance_confirm_wizard,access.closing.balance.confirm.wizard,model_closing_balance_confirm_wizard,point_of_sale.group_pos_manager,0,0,0,0
+access_pos_details_wizard,access.pos.details.wizard,model_pos_details_wizard,point_of_sale.group_pos_manager,1,1,1,0
+access_pos_make_payment,access.pos.make.payment,model_pos_make_payment,point_of_sale.group_pos_manager,1,1,1,0

addons/portal/__manifest__.py

@@ -17,6 +17,7 @@ of this module is to allow the display of a customer portal without having
 a dependency towards website edition and customization capabilities.""",
     'depends': ['web', 'web_editor', 'http_routing', 'mail', 'auth_signup'],
     'data': [
+        'security/ir.model.access.csv',
         'data/portal_data.xml',
         'views/assets.xml',
         'views/portal_templates.xml',

addons/portal/security/ir.model.access.csv

@@ -0,0 +1,4 @@
+"id","name","model_id:id","group_id:id","perm_read","perm_write","perm_create","perm_unlink"
+"access_portal_share","access.portal.share","model_portal_share","base.group_partner_manager",1,1,1,0
+"access_portal_wizard","access.portal.wizard","model_portal_wizard","base.group_partner_manager",1,1,1,0
+"access_portal_wizard_user","access.portal.wizard.user","model_portal_wizard_user","base.group_partner_manager",1,1,1,0

addons/portal/wizard/portal_wizard_views.xml

@@ -5,8 +5,7 @@
             name="Grant portal access"
             binding_model="res.partner"
             res_model="portal.wizard"
-            view_mode="form" target="new"
-            groups="base.group_partner_manager"/>
+            view_mode="form" target="new"/>
 
         <!-- wizard view -->
         <record id="wizard_view" model="ir.ui.view">

addons/product_expiry/__manifest__.py

@@ -17,7 +17,8 @@ Following dates can be tracked:
 
 Also implements the removal strategy First Expiry First Out (FEFO) widely used, for example, in food industries.
 """,
-    'data': ['views/production_lot_views.xml',
+    'data': ['security/ir.model.access.csv',
+             'views/production_lot_views.xml',
              'views/product_template_views.xml',
              'views/stock_move_views.xml',
              'views/stock_quant_views.xml',

addons/product_expiry/security/ir.model.access.csv

@@ -0,0 +1,2 @@
+"id","name","model_id:id","group_id:id","perm_read","perm_write","perm_create","perm_unlink"
+"access_expiry_picking_confirmation","access.expiry.picking.confirmation","model_expiry_picking_confirmation","stock.group_stock_user",1,1,1,0

addons/product_margin/security/ir.model.access.csv

@@ -1 +1,2 @@
-id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink
+id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink
+access_product_margin,access.product.margin,model_product_margin,account.group_account_user,1,1,1,0

addons/repair/security/ir.model.access.csv

@@ -5,3 +5,6 @@ access_repair_tag_user,Repair Tags user,model_repair_tags,stock.group_stock_user
 access_stock_production_lot_user,stock.production.lot user,stock.model_stock_production_lot,stock.group_stock_user,1,1,1,1
 access_repair_line_user,repair.line user,model_repair_line,stock.group_stock_user,1,1,1,1
 access_account_tax_user,account.tax,account.model_account_tax,stock.group_stock_user,1,1,1,1
+access_repair_cancel,access.repair.cancel,model_repair_cancel,stock.group_stock_user,1,1,1,0
+access_repair_order_make_invoice,access.repair.order.make_invoice,model_repair_order_make_invoice,stock.group_stock_user,1,1,1,0
+access_stock_warn_insufficient_qty_repair,access.stock.warn.insufficient.qty.repair,model_stock_warn_insufficient_qty_repair,stock.group_stock_user,1,1,1,0

addons/sale/security/ir.model.access.csv

@@ -55,3 +55,7 @@ access_account_tax_group_sale_manager,account.tax.group sale manager,account.mod
 access_account_account_sale_manager,account.account sale manager,account.model_account_account,sales_team.group_sale_manager,1,0,0,0
 access_mail_activity_type_sale_manager,mail.activity.type.sale.manager,mail.model_mail_activity_type,sales_team.group_sale_manager,1,1,1,1
 access_report_all_channels_sales,access_report_all_channels_sales,model_report_all_channels_sales,sales_team.group_sale_manager,1,0,0,0
+access_sale_payment_acquirer_onboarding_wizard,access.sale.payment.acquirer.onboarding.wizard,model_sale_payment_acquirer_onboarding_wizard,base.group_system,1,1,1,0
+access_sale_advance_payment_inv,access.sale.advance.payment.inv,model_sale_advance_payment_inv,sales_team.group_sale_salesman,1,1,1,0
+access_sale_order_cancel,access.sale.order.cancel,model_sale_order_cancel,sales_team.group_sale_salesman,1,1,1,0
+access_payment_link_wizard_sale,access.payment.link.wizard.sale,model_payment_link_wizard,sales_team.group_sale_salesman,1,1,1,0

addons/sale/security/sale_security.xml

@@ -187,5 +187,27 @@
         <field name="domain_force">[('move_id.type', 'in', ('out_invoice', 'out_refund', 'in_invoice', 'in_refund'))]</field>
         <field name="groups" eval="[(4, ref('sales_team.group_sale_salesman_all_leads'))]"/>
     </record>
+    
+    <!-- Wizard access rules -->
+    <record id="sale_payment_acquirer_onboarding_wizard_rule" model="ir.rule">
+        <field name="name">Payment Acquier Onboarding Wizard Rule</field>
+        <field name="model_id" ref="model_sale_payment_acquirer_onboarding_wizard"/>
+        <field name="global" eval="True"/>
+        <field name="domain_force">[('create_uid', '=', user.id)]</field>
+    </record>
+
+    <record id="sale_advance_payment_inv_rule" model="ir.rule">
+        <field name="name">Sales Advance Payment Invoice Rule</field>
+        <field name="model_id" ref="model_sale_advance_payment_inv"/>
+        <field name="global" eval="True"/>
+        <field name="domain_force">[('create_uid', '=', user.id)]</field>
+    </record>
+
+    <record id="sale_order_cancel_rule" model="ir.rule">
+        <field name="name">Sales Order Cancel Rule</field>
+        <field name="model_id" ref="model_sale_order_cancel"/>
+        <field name="global" eval="True"/>
+        <field name="domain_force">[('create_uid', '=', user.id)]</field>
+    </record>
 </data>
 </odoo>

addons/sale/wizard/sale_make_invoice_advance_views.xml

@@ -56,7 +56,6 @@
             <field name="res_model">sale.advance.payment.inv</field>
             <field name="view_mode">form</field>
             <field name="target">new</field>
-            <field name="groups_id" eval="[(4,ref('sales_team.group_sale_salesman'))]"/>
             <!-- TODO: check if we need this -->
             <field name="binding_model_id" ref="sale.model_sale_order" />
             <field name="binding_view_types">list</field>

addons/sale_coupon/__manifest__.py

@@ -8,6 +8,7 @@
     'version': '1.0',
     'depends': ['sale_management'],
     'data': [
+        'security/sale_coupon_security.xml',
         'security/ir.model.access.csv',
         'wizard/sale_coupon_apply_code_views.xml',
         'wizard/sale_coupon_generate_views.xml',

addons/sale_coupon/security/ir.model.access.csv

@@ -7,3 +7,5 @@ access_coupon_salesman,salesman,model_sale_coupon,sales_team.group_sale_salesman
 access_coupon_manager,program manager,model_sale_coupon,sales_team.group_sale_manager,1,1,1,0
 access_reward_salesman,salesman,model_sale_coupon_reward,sales_team.group_sale_salesman,1,0,0,0
 access_reward_manager,program manager,model_sale_coupon_reward,sales_team.group_sale_manager,1,1,1,0
+access_sale_coupon_apply_code,access.sale.coupon.apply.code,model_sale_coupon_apply_code,sales_team.group_sale_salesman,1,1,1,0
+access_sale_coupon_generate,access.sale.coupon.generate,model_sale_coupon_generate,sales_team.group_sale_salesman,1,1,1,0

addons/sale_coupon/security/sale_coupon_security.xml

@@ -0,0 +1,19 @@
+<?xml version="1.0" encoding="utf-8"?>
+<odoo>
+<data noupdate="1">
+
+    <record id="sale_coupon_apply_code_rule" model="ir.rule">
+        <field name="name">Sale Coupon Apply Code Rule</field>
+        <field name="model_id" ref="model_sale_coupon_apply_code"/>
+        <field name="global" eval="True"/>
+        <field name="domain_force">[('create_uid', '=', user.id)]</field>
+    </record>
+    <record id="sale_coupon_generate_rule" model="ir.rule">
+        <field name="name">Generate Sales Coupon Rule</field>
+        <field name="model_id" ref="model_sale_coupon_generate"/>
+        <field name="global" eval="True"/>
+        <field name="domain_force">[('create_uid', '=', user.id)]</field>
+    </record>
+
+</data>
+</odoo>

addons/sale_crm/security/ir.model.access.csv

@@ -1,2 +1,2 @@
-id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink
-
+id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink
+access_crm_quotation_partner,access.crm.quotation.partner,model_crm_quotation_partner,sales_team.group_sale_salesman,1,1,1,0

addons/sale_product_configurator/__manifest__.py

@@ -15,6 +15,7 @@ It also enables the "optional products" feature.
 
     'depends': ['sale'],
     'data': [
+        'security/ir.model.access.csv',
         'views/assets.xml',
         'views/templates.xml',
         'views/sale_views.xml',

addons/sale_product_configurator/security/ir.model.access.csv

@@ -0,0 +1,2 @@
+"id","name","model_id:id","group_id:id","perm_read","perm_write","perm_create","perm_unlink"
+"access_sale_product_configurator","access.sale.product.configurator","model_sale_product_configurator","sales_team.group_sale_salesman",1,1,1,0

addons/sale_timesheet/security/ir.model.access.csv

@@ -2,3 +2,7 @@ id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink
 access_project_profitability_report_analysis_manager,project.profitability.report.analysis,model_project_profitability_report,project.group_project_manager,1,1,1,1
 access_project_sale_line_employee_map,access_project_sale_line_employee_map,model_project_sale_line_employee_map,base.group_user,1,0,0,0
 access_project_sale_line_employee_map_manager,access_project_sale_line_employee_map_project_manager,model_project_sale_line_employee_map,project.group_project_manager,1,1,1,1
+access_project_create_sale_order,access.project.create.sale.order,model_project_create_sale_order,sales_team.group_sale_salesman,1,1,1,0
+access_project_create_sale_order_line,access.project.create.sale.order.line,model_project_create_sale_order_line,sales_team.group_sale_salesman,1,1,1,0
+access_project_create_invoice,access.project.create.invoice,model_project_create_invoice,sales_team.group_sale_salesman_all_leads,1,1,1,0
+access_project_task_create_sale_order,access.project.task.create.sale.order,model_project_task_create_sale_order,sales_team.group_sale_salesman,1,1,1,0

addons/sale_timesheet/wizard/project_create_invoice_views.xml

@@ -26,7 +26,6 @@
         <field name="view_mode">form</field>
         <field name="view_id" ref="project_create_invoice_view_form"/>
         <field name="target">new</field>
-        <field name="groups_id" eval="[(4, ref('sales_team.group_sale_salesman_all_leads'))]"/>
     </record>
 
 </odoo>

addons/sale_timesheet/wizard/project_create_sale_order_views.xml

@@ -49,7 +49,6 @@
         <field name="view_mode">form</field>
         <field name="view_id" ref="project_create_sale_order_view_form"/>
         <field name="target">new</field>
-        <field name="groups_id" eval="[(4, ref('sales_team.group_sale_salesman'))]"/>
     </record>
 
 </odoo>

addons/sale_timesheet/wizard/project_task_create_sale_order_views.xml

@@ -31,7 +31,6 @@
         <field name="view_mode">form</field>
         <field name="view_id" ref="project_task_create_sale_order_view_form"/>
         <field name="target">new</field>
-        <field name="groups_id" eval="[(4, ref('sales_team.group_sale_salesman'))]"/>
     </record>
 
 </odoo>

addons/sms/security/ir.model.access.csv

@@ -4,3 +4,8 @@ access_sms_sms_system,access.sms.sms.system,model_sms_sms,base.group_system,1,1,
 access_sms_template_all,access.sms.template.all,model_sms_template,,0,0,0,0
 access_sms_template_user,access.sms.template.user,model_sms_template,base.group_user,1,0,0,0
 access_sms_template_system,access.sms.template.system,model_sms_template,base.group_system,1,1,1,1
+access_sms_cancel,access.sms.cancel,model_sms_cancel,base.group_user,1,1,1,0
+access_sms_composer,access.sms.composer,model_sms_composer,base.group_user,1,1,1,0
+access_sms_resend_recipient,access.sms.resend.recipient,model_sms_resend_recipient,base.group_user,1,1,1,0
+access_sms_resend,access.sms.resend,model_sms_resend,base.group_user,1,1,1,0
+access_sms_template_preview,access.sms.template.preview,model_sms_template_preview,base.group_user,1,1,1,0

addons/snailmail/security/ir.model.access.csv

@@ -2,4 +2,7 @@ id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink
 access_snailmail_letter_all,snailmail.letter.all,model_snailmail_letter,,1,0,0,0
 access_snailmail_letter_portal,snailmail.letter.portal,model_snailmail_letter,base.group_portal,1,0,1,0
 access_snailmail_letter_user,snailmail.letter.user,model_snailmail_letter,base.group_user,1,1,1,0
-access_snailmail_letter_system,snailmail.letter.system,model_snailmail_letter,base.group_system,1,1,1,1
+access_snailmail_letter_system,snailmail.letter.system,model_snailmail_letter,base.group_system,1,1,1,1
+access_snailmail_letter_cancel,access.snailmail.letter.cancel,model_snailmail_letter_cancel,base.group_user,1,1,1,0
+access_snailmail_letter_format_error,access.snailmail.letter.format.error,model_snailmail_letter_format_error,base.group_user,1,1,1,0
+access_snailmail_letter_missing_required_fields,access.snailmail.letter.missing.required.fields,model_snailmail_letter_missing_required_fields,base.group_user,1,1,1,0

addons/stock/security/ir.model.access.csv

@@ -72,3 +72,20 @@ access_product_product_attribute_manager,product.product.attribute manager value
 access_product_template_attribute_exclusion_manager,product.attribute manager filter line,product.model_product_template_attribute_exclusion,stock.group_stock_manager,1,1,1,1
 access_product_template_attribute_line_manager,product.attribute manager line,product.model_product_template_attribute_line,stock.group_stock_manager,1,1,1,1
 access_report_stock_quantity,access_report_stock_quantity,model_report_stock_quantity,base.group_user,1,0,0,0
+access_stock_traceability_report,access.stock.traceability.report,model_stock_traceability_report,stock.group_stock_user,1,1,1,0
+access_stock_assign_serial,access.stock.assign.serial,model_stock_assign_serial,stock.group_stock_user,1,1,1,0
+access_stock_return_picking_line,access.stock.return.picking.line,model_stock_return_picking_line,stock.group_stock_user,1,1,1,0
+access_stock_return_picking,access.stock.return.picking,model_stock_return_picking,stock.group_stock_user,1,1,1,0
+access_stock_change_product_qty,access.stock.change.product.qty,model_stock_change_product_qty,stock.group_stock_user,1,1,1,0
+access_stock_scheduler_compute,access.stock.scheduler.compute,model_stock_scheduler_compute,stock.group_stock_user,1,1,1,0
+access_stock_immediate_transfer_line,access.stock.immediate.transfer.line,model_stock_immediate_transfer_line,stock.group_stock_user,1,1,1,0
+access_stock_immediate_transfer,access.stock.immediate.transfer,model_stock_immediate_transfer,stock.group_stock_user,1,1,1,0
+access_stock_backorder_confirmation_line,access.stock.backorder.confirmation.line,model_stock_backorder_confirmation_line,stock.group_stock_user,1,1,1,0
+access_stock_backorder_confirmation,access.stock.backorder.confirmation,model_stock_backorder_confirmation,stock.group_stock_user,1,1,1,0
+access_stock_quantity_history,access.stock.quantity.history,model_stock_quantity_history,stock.group_stock_user,1,1,1,0
+access_stock_rules_report,access.stock.rules.report,model_stock_rules_report,stock.group_stock_user,1,1,1,0
+access_stock_warn_insufficient_qty_scrap,access.stock.warn.insufficient.qty.scrap,model_stock_warn_insufficient_qty_scrap,stock.group_stock_user,1,1,1,0
+access_product_replenish,access.product.replenish,model_product_replenish,stock.group_stock_user,1,1,1,0
+access_stock_track_confirmation,access.stock.track.confirmation,model_stock_track_confirmation,stock.group_stock_user,1,1,1,0
+access_stock_track_line,access.stock.track.line,model_stock_track_line,stock.group_stock_user,1,1,1,0
+access_stock_package_destination,access.stock.package.destination,model_stock_package_destination,stock.group_stock_user,1,1,1,0

addons/stock_picking_batch/security/ir.model.access.csv

@@ -1,2 +1,3 @@
 id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink
 access_stock_picking_batch,stock.picking.batch stock users,model_stock_picking_batch,stock.group_stock_user,1,1,1,1
+access_stock_picking_to_batch,access.stock.picking.to.batch,model_stock_picking_to_batch,stock.group_stock_user,1,1,1,0

addons/stock_sms/security/ir.model.access.csv

@@ -1,2 +1,3 @@
 id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink
 access_sms_template_stock_manager,access.sms.template.stock.manager,sms.model_sms_template,stock.group_stock_manager,1,1,1,1
+access_confirm_stock_sms,access.confirm.stock.sms,model_confirm_stock_sms,stock.group_stock_user,1,1,1,0

addons/survey/security/ir.model.access.csv

@@ -20,3 +20,4 @@ access_survey_user_input_line_user,survey.user_input.line.user,model_survey_user
 access_survey_user_input_line_survey_user,survey.user_input.line.survey.user,model_survey_user_input_line,group_survey_user,1,1,1,1
 access_survey_user_input_line_survey_manager,survey.user_input.line.survey.manager,model_survey_user_input_line,group_survey_manager,1,1,1,1
 access_gamification_badge_survey_user,gamification.badge.survey.user,model_gamification_badge,group_survey_user,1,1,1,1
+access_survey_invite,access.survey.invite,model_survey_invite,survey.group_survey_user,1,1,1,0

addons/test_mail/tests/test_performance.py

@@ -277,8 +277,8 @@ class TestMailAPIPerformance(BaseMailPerformance):
     def test_mail_composer_w_template(self):
         test_record = self.env['mail.test.full'].browse(self.test_record_full.id)
         test_template = self.env['mail.template'].browse(self.test_template_full.id)
-        # TODO XDO/TDE FIXME non deterministic between 25 and 28 queries
-        with self.assertQueryCount(__system__=28, emp=28):
+        # TODO XDO/TDE/MAT FIXME non deterministic between 25 and 29 queries
+        with self.assertQueryCount(__system__=28, emp=29):
             composer = self.env['mail.compose.message'].with_context({
                 'default_composition_mode': 'comment',
                 'default_model': test_record._name,
@@ -489,7 +489,7 @@ class TestMailComplexPerformance(BaseMailPerformance):
         record = self.umbrella.with_user(self.env.user)
         template_id = self.env.ref('test_mail.mail_test_tpl').id
 
-        with self.assertQueryCount(__system__=84, emp=85):
+        with self.assertQueryCount(__system__=84, emp=86):
             record.message_post_with_template(template_id, message_type='comment', composition_mode='comment')
 
         self.assertEqual(record.message_ids[0].body, '<p>Adding stuff on %s</p>' % record.name)
@@ -680,7 +680,7 @@ class TestMailComplexPerformance(BaseMailPerformance):
         rec1 = rec.with_context(active_test=False)      # to see inactive records
         self.assertEqual(rec1.message_partner_ids, self.partners | self.env.user.partner_id | self.user_portal.partner_id)
 
-        with self.assertQueryCount(__system__=34, emp=35):
+        with self.assertQueryCount(__system__=34, emp=36):
             rec.write({
                 'name': 'Test2',
                 'customer_id': customer_id,

addons/website/security/ir.model.access.csv

@@ -21,3 +21,4 @@ access_theme_ir_ui_view,access_theme_ir_ui_view,model_theme_ir_ui_view,base.grou
 access_theme_ir_attachment,access_theme_ir_attachment,model_theme_ir_attachment,base.group_system,1,1,1,1
 access_theme_website_menu,access_theme_website_menu,model_theme_website_menu,base.group_system,1,1,1,1
 access_theme_website_page,access_theme_website_page,model_theme_website_page,base.group_system,1,1,1,1
+access_website_robots,access.website.robots,model_website_robots,website.group_website_designer,1,1,1,0

addons/website_crm_partner_assign/security/ir.model.access.csv

@@ -10,3 +10,5 @@ access_partner_activation_manager,res.partner.activation.manager,model_res_partn
 partner_access_crm_lead,crm.lead,crm.model_crm_lead,base.group_portal,1,1,0,0
 access_res_partner_grade_invoicing_payment_readonly,res.partner.grade,model_res_partner_grade,account.group_account_readonly,1,0,0,0
 access_res_partner_grade_invoicing_payment,res.partner.grade,model_res_partner_grade,account.group_account_invoice,1,0,0,0
+access_crm_lead_forward_to_partner,access.crm.lead.forward.to.partner,model_crm_lead_forward_to_partner,sales_team.group_sale_manager,1,1,1,0
+access_crm_lead_assignation,access.crm.lead.assignation,model_crm_lead_assignation,sales_team.group_sale_manager,1,1,1,0

addons/website_crm_partner_assign/wizard/crm_forward_to_partner_view.xml

@@ -48,7 +48,6 @@
             name="Forward to partner" res_model="crm.lead.forward.to.partner"
             binding_model="crm.lead"
             view_mode="form" target="new"
-            groups="sales_team.group_sale_manager"
             context="{'default_composition_mode' : 'mass_mail'}" view_id="crm_lead_forward_to_partner_form" />
 
 </odoo>

addons/website_sale/security/ir.model.access.csv

@@ -21,3 +21,4 @@ access_account_tax_user,account.tax,account.model_account_tax,base.group_public,
 access_product_image_public,product.image public,model_product_image,,1,0,0,0
 access_product_image_publisher,product.image wbesite publisher,model_product_image,website.group_website_publisher,1,1,1,1
 access_product_image_sale,product.image sale,model_product_image,sales_team.group_sale_manager,1,1,1,1
+access_website_sale_payment_acquirer_onboarding_wizard,access.website.sale.payment.acquirer.onboarding.wizard,model_website_sale_payment_acquirer_onboarding_wizard,base.group_system,1,1,1,0

addons/website_slides/security/ir.model.access.csv

@@ -26,3 +26,4 @@ access_slide_slide_link_officer,slide.slide.link.officer,model_slide_slide_link,
 access_slide_slide_resource_all,slide.slide.resource.all,model_slide_slide_resource,,1,0,0,0
 access_slide_slide_resource_public,slide.slide.resource.public,model_slide_slide_resource,base.group_public,0,0,0,0
 access_slide_slide_resource_publisher,slide.slide.resource.publisher,model_slide_slide_resource,website_slides.group_website_slides_officer,1,1,1,1
+access_slide_channel_invite,access.slide.channel.invite,model_slide_channel_invite,base.group_user,1,1,1,0

odoo/addons/base/models/ir_actions.py

@@ -109,6 +109,7 @@ class IrActions(models.Model):
                     WHERE a.binding_model_id=m.id AND m.model=%s
                     ORDER BY a.id """
         cr.execute(query, [model_name])
+        IrModelAccess = self.env['ir.model.access']
 
         # discard unauthorized actions, and read action definitions
         result = defaultdict(list)
@@ -117,9 +118,13 @@ class IrActions(models.Model):
             try:
                 action = self.env[action_model].browse(action_id)
                 action_groups = getattr(action, 'groups_id', ())
+                action_model = getattr(action, 'res_model', False)
                 if action_groups and not action_groups & user_groups:
                     # the user may not perform this action
                     continue
+                if action_model and not IrModelAccess.check(action_model, mode='read', raise_exception=False):
+                    # the user won't be able to read records
+                    continue
                 result[binding_type].append(action.read()[0])
             except (AccessError, MissingError):
                 continue

odoo/addons/base/models/ir_model.py

@@ -1455,7 +1455,7 @@ class IrModelAccess(models.Model):
 
     name = fields.Char(required=True, index=True)
     active = fields.Boolean(default=True, help='If you uncheck the active field, it will disable the ACL without deleting it (if you delete a native ACL, it will be re-created when you reload the module).')
-    model_id = fields.Many2one('ir.model', string='Object', required=True, domain=[('transient', '=', False)], index=True, ondelete='cascade')
+    model_id = fields.Many2one('ir.model', string='Object', required=True, index=True, ondelete='cascade')
     group_id = fields.Many2one('res.groups', string='Group', ondelete='cascade', index=True)
     perm_read = fields.Boolean(string='Read Access')
     perm_write = fields.Boolean(string='Write Access')
@@ -1533,8 +1533,6 @@ class IrModelAccess(models.Model):
         # TransientModel records have no access rights, only an implicit access rule
         if model not in self.env:
             _logger.error('Missing model %s', model)
-        elif self.env[model].is_transient():
-            return True
 
         # We check if a specific rule exists
         self._cr.execute("""SELECT MAX(CASE WHEN perm_{mode} THEN 1 ELSE 0 END)

odoo/addons/base/models/ir_rule.py

@@ -62,11 +62,6 @@ class IrRule(models.Model):
         for rule in self:
             rule['global'] = not rule.groups
 
-    @api.constrains('model_id')
-    def _check_model_transience(self):
-        if any(self.env[rule.model_id.model].is_transient() for rule in self):
-            raise ValidationError(_('Rules can not be applied on Transient models.'))
-
     @api.constrains('model_id')
     def _check_model_name(self):
         # Don't allow rules on rules records (this model).

odoo/addons/base/security/base_security.xml

@@ -68,6 +68,12 @@
             <field name="domain_force">['|',('company_id','=',False),('company_id', 'in', company_ids)]</field>
         </record>
 
+        <record id="change_password_rule" model="ir.rule">
+            <field name="name">change user password rule</field>
+            <field name="model_id" ref="model_change_password_user"/>
+            <field name="domain_force">[('create_uid', '=', user.id)]</field>
+        </record>
+
         <!-- Security restriction for private addresses -->
         <record id="res_partner_rule_private_employee" model="ir.rule">
             <field name="name">res.partner.rule.private.employee</field>

odoo/addons/base/security/ir.model.access.csv

@@ -99,3 +99,23 @@
 "paperformat_access_portal","ir_actions_report_paperformat group_portal","model_report_paperformat",,1,0,0,0
 "paperformat_access_employee","ir_actions_report_paperformat group_system","model_report_paperformat",group_system,1,1,1,1
 "access_report_layout","access_report_layout","model_report_layout",,1,1,1,1
+"access_wizard_ir_model_menu_create","access.wizard.ir.model.menu.create","model_wizard_ir_model_menu_create","base.group_system",1,1,1,0
+"access_reset_view_arch_wizard","access.reset.view.arch.wizard","model_reset_view_arch_wizard","base.group_erp_manager",1,1,1,0
+"access_ir_demo","access.ir.demo","model_ir_demo","base.group_system",1,1,1,0
+"access_ir_demo_failure","access.ir.demo_failure","model_ir_demo_failure","base.group_system",1,1,1,0
+"access_ir_demo_failure_wizard","access.ir.demo_failure.wizard","model_ir_demo_failure_wizard","base.group_system",1,1,1,0
+"access_res_config","access.res.config","model_res_config","base.group_system",1,1,1,0
+"access_res_config_installer","access.res.config.installer","model_res_config_installer","base.group_system",1,1,1,0
+"access_res_config_settings","access.res.config.settings","model_res_config_settings","base.group_system",1,1,1,0
+"access_change_password_wizard","access.change.password.wizard","model_change_password_wizard","base.group_erp_manager",1,1,1,0
+"access_change_password_user","access.change.password.user","model_change_password_user","base.group_system",1,1,1,0
+"access_base_module_update","access.base.module.update","model_base_module_update","base.group_system",1,1,1,0
+"access_base_language_install","access.base.language.install","model_base_language_install","base.group_system",1,1,1,0
+"access_base_language_import","access.base.language.import","model_base_language_import","base.group_system",1,1,1,0
+"access_base_module_upgrade","access.base.module.upgrade","model_base_module_upgrade","base.group_system",1,1,1,0
+"access_base_module_uninstall","access.base.module.uninstall","model_base_module_uninstall","base.group_system",1,1,1,0
+"access_base_language_export","access.base.language.export","model_base_language_export","base.group_user",1,1,1,0
+"access_base_update_translations","access.base.update.translations","model_base_update_translations","base.group_system",1,1,1,0
+"access_base_partner_merge_line","access.base.partner.merge.line","model_base_partner_merge_line","base.group_system",1,1,1,0
+"access_base_partner_merge_automatic_wizard","access.base.partner.merge.automatic.wizard","model_base_partner_merge_automatic_wizard","base.group_system",1,1,1,0
+"access_base_document_layout","access.base.document.layout","model_base_document_layout","base.group_system",1,1,1,0

odoo/addons/base/views/ir_ui_view_views.xml

@@ -129,8 +129,7 @@
             binding_model="ir.ui.view" binding_views="form"
             res_model="reset.view.arch.wizard"
             view_mode="form"
-            target="new"
-            groups="base.group_erp_manager"/>
+            target="new"/>
 
         <!-- View customizations -->
         <record id="view_view_custom_form" model="ir.ui.view">

odoo/addons/base/views/res_users_views.xml

@@ -31,8 +31,7 @@
             name="Change Password"
             binding_model="res.users"
             res_model="change.password.wizard"
-            view_mode="form" target="new"
-            groups="base.group_erp_manager"/>
+            view_mode="form" target="new"/>
 
         <!-- res.groups -->
         <record id="view_groups_search" model="ir.ui.view">

odoo/addons/test_new_api/security/ir.model.access.csv

@@ -48,3 +48,4 @@ access_test_new_api_model_binary,access_test_new_api_model_binary,model_test_new
 access_test_new_api_model_child_m2o,access_test_new_api_model_child_m2o,model_test_new_api_model_child_m2o,,1,1,1,1
 access_test_new_api_model_parent_m2o,access_test_new_api_model_parent_m2o,model_test_new_api_model_parent_m2o,,1,1,1,1
 access_test_new_api_model_private_address_onchange,access_test_new_api_model_private_address_onchange,model_test_new_api_model_private_address_onchange,base.group_user,1,1,1,1
+access_test_new_api_req_m2o_transient,access_test_new_api_req_m2o_transient,model_test_new_api_req_m2o_transient,,0,0,0,0

odoo/addons/test_translation_import/__manifest__.py

@@ -5,7 +5,10 @@
     'category': 'Tests',
     'description': """A module to test translation import.""",
     'depends': ['base'],
-    'data': ['view.xml'],
+    'data': [
+        'security/ir.model.access.csv',
+        'view.xml'
+    ],
     'installable': True,
     'auto_install': False,
 }

odoo/addons/test_translation_import/security/ir.model.access.csv

@@ -0,0 +1,2 @@
+"id","name","model_id:id","group_id:id","perm_read","perm_write","perm_create","perm_unlink"
+"access_test_translation_import","access.test.translation.import","model_test_translation_import",,0,0,0,0

odoo/models.py

@@ -557,7 +557,7 @@ class BaseModel(MetaModel('DummyModel', (object,), {'_register': False})):
         if ModelClass._transient:
             assert ModelClass._log_access, \
                 "TransientModels must have log_access turned on, " \
-                "in order to implement their access rights policy"
+                "in order to implement their vacuum policy"
 
         # link the class to the registry, and update the registry
         ModelClass.pool = pool
@@ -3241,9 +3241,6 @@ Record ids: %(records)s
         forbidden = invalid.exists()
         if forbidden:
             # the invalid records are (partially) hidden by access rules
-            if self.is_transient():
-                raise AccessError(_('For this kind of document, you may only access records you created yourself.\n\n(Document type: %s)') % (self._description,))
-
             raise self.env['ir.rule']._make_access_error(operation, forbidden)
 
         # If we get here, the invalid records are not in the database.
@@ -4166,15 +4163,6 @@ Record ids: %(records)s
                     if table not in query.tables:
                         query.tables.append(table)
 
-        if self._transient:
-            # One single implicit access rule for transient models: owner only!
-            # This is ok because we assert that TransientModels always have
-            # log_access enabled, so that 'create_uid' is always there.
-            domain = [('create_uid', '=', self._uid)]
-            tquery = self._where_calc(domain, active_test=False)
-            apply_rule(tquery.where_clause, tquery.where_clause_params, tquery.tables)
-            return
-
         # apply main rules on the object
         Rule = self.env['ir.rule']
         where_clause, where_params, tables = Rule.domain_get(self._name, mode)

odoo/modules/loading.py

@@ -443,17 +443,10 @@ def load_modules(db, force_demo=False, status=None, update_module=False):
             env = api.Environment(cr, SUPERUSER_ID, {})
             cr.execute("""select model,name from ir_model where id NOT IN (select distinct model_id from ir_model_access)""")
             for (model, name) in cr.fetchall():
-                if model in registry and not registry[model]._abstract and not registry[model]._transient:
+                if model in registry and not registry[model]._abstract:
                     _logger.warning('The model %s has no access rules, consider adding one. E.g. access_%s,access_%s,model_%s,base.group_user,1,0,0,0',
                         model, model.replace('.', '_'), model.replace('.', '_'), model.replace('.', '_'))
 
-            # Temporary warning while we remove access rights on osv_memory objects, as they have
-            # been replaced by owner-only access rights
-            cr.execute("""select distinct mod.model, mod.name from ir_model_access acc, ir_model mod where acc.model_id = mod.id""")
-            for (model, name) in cr.fetchall():
-                if model in registry and registry[model]._transient:
-                    _logger.warning('The transient model %s (%s) should not have explicit access rules!', model, name)
-
             cr.execute("SELECT model from ir_model")
             for (model,) in cr.fetchall():
                 if model in registry: