From 6d8688bb124df311648f65f6d43608ee22d5f63b Mon Sep 17 00:00:00 2001 From: Martin Trigaux Date: Mon, 13 Jan 2020 15:18:36 +0100 Subject: [PATCH 1/3] [IMP] base: use ir.model.access on transient models Before this commit models with the `_transient` flag were ignored in ir.model.access verifications. Only an implicit ir.rule with the domain (create_uid=user.id) was applied to avoid most side effects. The problem is that, often, the security does not lie in side-effects of abusing of somebody else's wizard record but in the fact that the wizard methods blindly trust only the right users are creating these records. Too often, too many sudo were used and creating wizard with chosen values could lead to an abuse scenario. Instead, explicitly require the developer to declare security rules the same way as on any other model. --- odoo/addons/base/models/ir_model.py | 4 +--- odoo/addons/base/models/ir_rule.py | 5 ----- odoo/models.py | 14 +------------- odoo/modules/loading.py | 9 +-------- 4 files changed, 3 insertions(+), 29 deletions(-) diff --git a/odoo/addons/base/models/ir_model.py b/odoo/addons/base/models/ir_model.py index 9c69d8057df..ae4ee63f335 100644 --- a/odoo/addons/base/models/ir_model.py +++ b/odoo/addons/base/models/ir_model.py @@ -1455,7 +1455,7 @@ class IrModelAccess(models.Model): name = fields.Char(required=True, index=True) active = fields.Boolean(default=True, help='If you uncheck the active field, it will disable the ACL without deleting it (if you delete a native ACL, it will be re-created when you reload the module).') - model_id = fields.Many2one('ir.model', string='Object', required=True, domain=[('transient', '=', False)], index=True, ondelete='cascade') + model_id = fields.Many2one('ir.model', string='Object', required=True, index=True, ondelete='cascade') group_id = fields.Many2one('res.groups', string='Group', ondelete='cascade', index=True) perm_read = fields.Boolean(string='Read Access') perm_write = fields.Boolean(string='Write Access') @@ -1533,8 +1533,6 @@ class IrModelAccess(models.Model): # TransientModel records have no access rights, only an implicit access rule if model not in self.env: _logger.error('Missing model %s', model) - elif self.env[model].is_transient(): - return True # We check if a specific rule exists self._cr.execute("""SELECT MAX(CASE WHEN perm_{mode} THEN 1 ELSE 0 END) diff --git a/odoo/addons/base/models/ir_rule.py b/odoo/addons/base/models/ir_rule.py index 7566a867384..e2703b36bd9 100644 --- a/odoo/addons/base/models/ir_rule.py +++ b/odoo/addons/base/models/ir_rule.py @@ -62,11 +62,6 @@ class IrRule(models.Model): for rule in self: rule['global'] = not rule.groups - @api.constrains('model_id') - def _check_model_transience(self): - if any(self.env[rule.model_id.model].is_transient() for rule in self): - raise ValidationError(_('Rules can not be applied on Transient models.')) - @api.constrains('model_id') def _check_model_name(self): # Don't allow rules on rules records (this model). diff --git a/odoo/models.py b/odoo/models.py index 77ba7c8eaa3..db725cdff98 100644 --- a/odoo/models.py +++ b/odoo/models.py @@ -557,7 +557,7 @@ class BaseModel(MetaModel('DummyModel', (object,), {'_register': False})): if ModelClass._transient: assert ModelClass._log_access, \ "TransientModels must have log_access turned on, " \ - "in order to implement their access rights policy" + "in order to implement their vacuum policy" # link the class to the registry, and update the registry ModelClass.pool = pool @@ -3241,9 +3241,6 @@ Record ids: %(records)s forbidden = invalid.exists() if forbidden: # the invalid records are (partially) hidden by access rules - if self.is_transient(): - raise AccessError(_('For this kind of document, you may only access records you created yourself.\n\n(Document type: %s)') % (self._description,)) - raise self.env['ir.rule']._make_access_error(operation, forbidden) # If we get here, the invalid records are not in the database. @@ -4166,15 +4163,6 @@ Record ids: %(records)s if table not in query.tables: query.tables.append(table) - if self._transient: - # One single implicit access rule for transient models: owner only! - # This is ok because we assert that TransientModels always have - # log_access enabled, so that 'create_uid' is always there. - domain = [('create_uid', '=', self._uid)] - tquery = self._where_calc(domain, active_test=False) - apply_rule(tquery.where_clause, tquery.where_clause_params, tquery.tables) - return - # apply main rules on the object Rule = self.env['ir.rule'] where_clause, where_params, tables = Rule.domain_get(self._name, mode) diff --git a/odoo/modules/loading.py b/odoo/modules/loading.py index b5cde25115c..9b1efca7cc4 100644 --- a/odoo/modules/loading.py +++ b/odoo/modules/loading.py @@ -443,17 +443,10 @@ def load_modules(db, force_demo=False, status=None, update_module=False): env = api.Environment(cr, SUPERUSER_ID, {}) cr.execute("""select model,name from ir_model where id NOT IN (select distinct model_id from ir_model_access)""") for (model, name) in cr.fetchall(): - if model in registry and not registry[model]._abstract and not registry[model]._transient: + if model in registry and not registry[model]._abstract: _logger.warning('The model %s has no access rules, consider adding one. E.g. access_%s,access_%s,model_%s,base.group_user,1,0,0,0', model, model.replace('.', '_'), model.replace('.', '_'), model.replace('.', '_')) - # Temporary warning while we remove access rights on osv_memory objects, as they have - # been replaced by owner-only access rights - cr.execute("""select distinct mod.model, mod.name from ir_model_access acc, ir_model mod where acc.model_id = mod.id""") - for (model, name) in cr.fetchall(): - if model in registry and registry[model]._transient: - _logger.warning('The transient model %s (%s) should not have explicit access rules!', model, name) - cr.execute("SELECT model from ir_model") for (model,) in cr.fetchall(): if model in registry: From c6f24da3f27cd715cc1e8fec9070db71ce5885c5 Mon Sep 17 00:00:00 2001 From: Martin Trigaux Date: Tue, 14 Jan 2020 10:47:08 +0100 Subject: [PATCH 2/3] [IMP] base: do not load actions when can not read target models As neither fields_view_get, nor default_get actually verify you have access to a specific model (this is likely to be changed in the future), it was possible to execute an action to a model, even if the user does not have access to the corresponding model. Before this commit, launching an action to a wizard with no access was opening a new record view with all fields in readonly and clicking on any button raised an access error. To avoid the frustrating of seeing an action but getting an unusable screen when clicking on it, just hide the action in the first place. --- odoo/addons/base/models/ir_actions.py | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/odoo/addons/base/models/ir_actions.py b/odoo/addons/base/models/ir_actions.py index 8f2d289fbed..1b3916c8d56 100644 --- a/odoo/addons/base/models/ir_actions.py +++ b/odoo/addons/base/models/ir_actions.py @@ -109,6 +109,7 @@ class IrActions(models.Model): WHERE a.binding_model_id=m.id AND m.model=%s ORDER BY a.id """ cr.execute(query, [model_name]) + IrModelAccess = self.env['ir.model.access'] # discard unauthorized actions, and read action definitions result = defaultdict(list) @@ -117,9 +118,13 @@ class IrActions(models.Model): try: action = self.env[action_model].browse(action_id) action_groups = getattr(action, 'groups_id', ()) + action_model = getattr(action, 'res_model', False) if action_groups and not action_groups & user_groups: # the user may not perform this action continue + if action_model and not IrModelAccess.check(action_model, mode='read', raise_exception=False): + # the user won't be able to read records + continue result[binding_type].append(action.read()[0]) except (AccessError, MissingError): continue From 65530dfd6a0486f44134917f5cc42a2c30b95762 Mon Sep 17 00:00:00 2001 From: Martin Trigaux Date: Tue, 14 Jan 2020 13:49:55 +0100 Subject: [PATCH 3/3] [ADD] *: add ir.model.access on all transient models MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Following changes needing ir.model.access on transient models too. Remove groups declaration on the action to move it to ir.model.access when possible. Rules are strict by default with no unlink access by default and high priviledge asked. Adaptations may be needed later. Write access is given as a wizard may need to be modified in case the action triggers an error and the user has to correct a value account*: use account.group_account_user for all transient by default remove account.print.journal relic stock*: use stock.group_stock_user by default survey: survey user can send invitations mail: allow any employee to execute wizards additional verifications are made to ensure they are executed only on the documents the user has access to you give portal access to mail.compose.message as portal still does some actions like posting messages on the forum add ir.rule to avoid reading somebody else messages increase the query count because of undeterminist count crm: saleman for lead2opp, manager for massmailing partner manager for actions linked to partners avoid a write in test_lead_lost sms: any employee can send sms mrp: mrp user can execute wizards give unlink access as making write during do_produce operation base_import: employees can import files delivery: stock user can deliver event_sale: sale user can configure the wizards event user inherit from sale rights gamification: employee can give badge google_service: resolve FIXME hr: add specific rights manager can set a plan according to group on button anyone who can write on an employee can register a departure hr_expense: set rights based on buttons hr_holidays: an approver can make a summary report hr_recruitment: recruiter can refuse a candidate hr_timesheet: can use the wizard if can create a timesheet l10n_eu_service: managers can create fiscal positions mass_mailing: same group as on mass.mailing.list membership: accountant can create invoice from membership payment: accountant can create a link as the source is an account.move keep the payment.acquirer.onboarding.wizard to system user only as it is called during company configuration point_of_sale: PoS manager only can use wizards never create closing_balance_confirm_wizard records product_expiry: stock user has rights on stock.picking product_margin: access from accounting menus repair: same rules as for above models sale: set ir.rule for self wizard only add rule from model introduced in payment to add salesman group sale_crm: saleman can create a quotation from a lead sale_coupon: any saleman can generate coupon add self ir.rule sale_product_configurator: salesman can select product variants snailmail: employee can send letters website: designers can write on website website_crm_partner_assign: same rule as group on action website_sale: sale ACL as for payment.acquirer.onboarding.wizard website_slides: anyone can send invitation base: base.language.*: allow employee (cf lang_install) change.password.user: can not read change password wizard of other users test.*: no access is needed Courtesy of Damien Bouvy, William Andre and Antoine Prieëls for review of acl --- addons/account/security/ir.model.access.csv | 16 ++++++++++++++ .../wizard/account_invoice_send_views.xml | 3 +-- addons/account_check_printing/__manifest__.py | 1 + .../security/ir.model.access.csv | 2 ++ addons/base_gengo/__manifest__.py | 1 + .../base_gengo/security/ir.model.access.csv | 2 ++ .../base_import/security/ir.model.access.csv | 1 + addons/base_import_module/__manifest__.py | 5 ++++- .../security/ir.model.access.csv | 2 ++ addons/base_sparse_field/__manifest__.py | 1 + .../security/ir.model.access.csv | 2 ++ addons/crm/security/ir.model.access.csv | 5 +++++ addons/crm/tests/test_crm_lead_lost.py | 10 +++++---- addons/crm/views/crm_lead_views.xml | 1 - .../crm_lead_to_opportunity_mass_views.xml | 1 - .../wizard/crm_merge_opportunities_views.xml | 3 +-- addons/delivery/security/ir.model.access.csv | 2 ++ .../event_sale/security/ir.model.access.csv | 3 +++ .../gamification/security/ir.model.access.csv | 3 +++ .../google_account/models/google_service.py | 3 +-- addons/hr/security/ir.model.access.csv | 2 ++ .../hr_expense/security/ir.model.access.csv | 2 ++ .../hr_holidays/security/ir.model.access.csv | 1 + .../security/ir.model.access.csv | 1 + .../hr_timesheet/security/ir.model.access.csv | 1 + .../security/ir.model.access.csv | 1 + addons/mail/security/ir.model.access.csv | 7 ++++++ addons/mail/security/mail_security.xml | 11 ++++++++++ .../mass_mailing/security/ir.model.access.csv | 3 +++ .../security/ir.model.access.csv | 3 ++- .../membership/security/ir.model.access.csv | 1 + addons/mrp/security/ir.model.access.csv | 4 ++++ addons/payment/security/ir.model.access.csv | 4 +++- .../security/ir.model.access.csv | 3 +++ addons/portal/__manifest__.py | 1 + addons/portal/security/ir.model.access.csv | 4 ++++ addons/portal/wizard/portal_wizard_views.xml | 3 +-- addons/product_expiry/__manifest__.py | 3 ++- .../security/ir.model.access.csv | 2 ++ .../security/ir.model.access.csv | 3 ++- addons/repair/security/ir.model.access.csv | 3 +++ addons/sale/security/ir.model.access.csv | 4 ++++ addons/sale/security/sale_security.xml | 22 +++++++++++++++++++ .../sale_make_invoice_advance_views.xml | 1 - addons/sale_coupon/__manifest__.py | 1 + .../sale_coupon/security/ir.model.access.csv | 2 ++ .../security/sale_coupon_security.xml | 19 ++++++++++++++++ addons/sale_crm/security/ir.model.access.csv | 4 ++-- .../sale_product_configurator/__manifest__.py | 1 + .../security/ir.model.access.csv | 2 ++ .../security/ir.model.access.csv | 4 ++++ .../wizard/project_create_invoice_views.xml | 1 - .../project_create_sale_order_views.xml | 1 - .../project_task_create_sale_order_views.xml | 1 - addons/sms/security/ir.model.access.csv | 5 +++++ addons/snailmail/security/ir.model.access.csv | 5 ++++- addons/stock/security/ir.model.access.csv | 17 ++++++++++++++ .../security/ir.model.access.csv | 1 + addons/stock_sms/security/ir.model.access.csv | 1 + addons/survey/security/ir.model.access.csv | 1 + addons/test_mail/tests/test_performance.py | 8 +++---- addons/website/security/ir.model.access.csv | 1 + .../security/ir.model.access.csv | 2 ++ .../wizard/crm_forward_to_partner_view.xml | 1 - .../website_sale/security/ir.model.access.csv | 1 + .../security/ir.model.access.csv | 1 + odoo/addons/base/security/base_security.xml | 6 +++++ odoo/addons/base/security/ir.model.access.csv | 20 +++++++++++++++++ odoo/addons/base/views/ir_ui_view_views.xml | 3 +-- odoo/addons/base/views/res_users_views.xml | 3 +-- .../test_new_api/security/ir.model.access.csv | 1 + .../test_translation_import/__manifest__.py | 5 ++++- .../security/ir.model.access.csv | 2 ++ 73 files changed, 241 insertions(+), 36 deletions(-) create mode 100644 addons/account_check_printing/security/ir.model.access.csv create mode 100644 addons/base_gengo/security/ir.model.access.csv create mode 100644 addons/base_import_module/security/ir.model.access.csv create mode 100644 addons/base_sparse_field/security/ir.model.access.csv create mode 100644 addons/portal/security/ir.model.access.csv create mode 100644 addons/product_expiry/security/ir.model.access.csv create mode 100644 addons/sale_coupon/security/sale_coupon_security.xml create mode 100644 addons/sale_product_configurator/security/ir.model.access.csv create mode 100644 odoo/addons/test_translation_import/security/ir.model.access.csv diff --git a/addons/account/security/ir.model.access.csv b/addons/account/security/ir.model.access.csv index bc5f6536810..90962c9c44a 100644 --- a/addons/account/security/ir.model.access.csv +++ b/addons/account/security/ir.model.access.csv @@ -123,3 +123,19 @@ access_account_payment_method_readonly,account.payment.method,model_account_paym access_account_payment_method,account.payment.method,model_account_payment_method,account.group_account_invoice,1,1,1,1 access_account_payment_readonly,account.payment,model_account_payment,account.group_account_readonly,1,0,0,0 access_account_payment,account.payment,model_account_payment,account.group_account_invoice,1,1,1,1 + +access_account_payment_register,access.account.payment.register,model_account_payment_register,account.group_account_invoice,1,1,1,0 +access_account_bank_statement_closebalance,access.account.bank.statement.closebalance,model_account_bank_statement_closebalance,account.group_account_user,1,1,1,0 +access_account_accrual_accounting_wizard,access.account.accrual.accounting.wizard,model_account_accrual_accounting_wizard,account.group_account_user,1,1,1,0 +access_account_unreconcile,access.account.unreconcile,model_account_unreconcile,account.group_account_user,1,1,1,0 +access_validate_account_move,access.validate.account.move,model_validate_account_move,account.group_account_invoice,1,1,1,0 +access_cash_box_out,access.cash.box.out,model_cash_box_out,account.group_account_user,1,1,1,0 +access_account_move_reversal,access.account.move.reversal,model_account_move_reversal,account.group_account_invoice,1,1,1,0 +access_account_common_report,access.account.common.report,model_account_common_report,account.group_account_user,1,1,1,0 +access_account_common_journal_report,access.account.common.journal.report,model_account_common_journal_report,account.group_account_user,1,1,1,0 +access_account_print_journal,access.account.print.journal,model_account_print_journal,account.group_account_user,1,1,1,0 +access_account_financial_year_op,access.account.financial.year.op,model_account_financial_year_op,account.group_account_manager,1,1,1,0 +access_account_setup_bank_manual_config,access.account.setup.bank.manual.config,model_account_setup_bank_manual_config,account.group_account_user,1,1,1,0 +access_tax_adjustments_wizard,access.tax.adjustments.wizard,model_tax_adjustments_wizard,account.group_account_user,1,1,1,0 +access_account_invoice_send,access.account.invoice.send,model_account_invoice_send,account.group_account_invoice,1,1,1,0 +access_account_transfer_wizard,access.account.transfer.wizard,model_account_transfer_wizard,account.group_account_user,1,1,1,0 diff --git a/addons/account/wizard/account_invoice_send_views.xml b/addons/account/wizard/account_invoice_send_views.xml index 4db286a1ca8..3ec9db79a9b 100644 --- a/addons/account/wizard/account_invoice_send_views.xml +++ b/addons/account/wizard/account_invoice_send_views.xml @@ -86,8 +86,7 @@ context="{ 'default_template_id': ref('account.email_template_edi_invoice'), 'mark_invoice_as_sent': True, - }" - groups="account.group_account_invoice"/> + }"/> diff --git a/addons/account_check_printing/__manifest__.py b/addons/account_check_printing/__manifest__.py index fbcd0bb7d39..4882c5ee815 100644 --- a/addons/account_check_printing/__manifest__.py +++ b/addons/account_check_printing/__manifest__.py @@ -13,6 +13,7 @@ The check settings are located in the accounting journals configuration page. """, 'depends': ['account'], 'data': [ + 'security/ir.model.access.csv', 'data/account_check_printing_data.xml', 'views/account_journal_views.xml', 'views/account_payment_views.xml', diff --git a/addons/account_check_printing/security/ir.model.access.csv b/addons/account_check_printing/security/ir.model.access.csv new file mode 100644 index 00000000000..4009faf214b --- /dev/null +++ b/addons/account_check_printing/security/ir.model.access.csv @@ -0,0 +1,2 @@ +"id","name","model_id:id","group_id:id","perm_read","perm_write","perm_create","perm_unlink" +"access_print_prenumbered_checks","access.print.prenumbered.checks","model_print_prenumbered_checks","account.group_account_user",1,1,1,0 diff --git a/addons/base_gengo/__manifest__.py b/addons/base_gengo/__manifest__.py index 55e2355511f..b2bda792a01 100644 --- a/addons/base_gengo/__manifest__.py +++ b/addons/base_gengo/__manifest__.py @@ -16,6 +16,7 @@ This wizard will activate the CRON job and the Scheduler and will start the auto """, 'depends': ['base_setup'], 'data': [ + 'security/ir.model.access.csv', 'data/ir_cron_data.xml', 'views/ir_translation_views.xml', 'views/res_config_settings_views.xml', diff --git a/addons/base_gengo/security/ir.model.access.csv b/addons/base_gengo/security/ir.model.access.csv new file mode 100644 index 00000000000..b123cc2587f --- /dev/null +++ b/addons/base_gengo/security/ir.model.access.csv @@ -0,0 +1,2 @@ +"id","name","model_id:id","group_id:id","perm_read","perm_write","perm_create","perm_unlink" +"access_base_gengo_translations","access.base.gengo.translations","model_base_gengo_translations","base.group_system",1,1,1,0 diff --git a/addons/base_import/security/ir.model.access.csv b/addons/base_import/security/ir.model.access.csv index 06a166c91c9..f6105333408 100644 --- a/addons/base_import/security/ir.model.access.csv +++ b/addons/base_import/security/ir.model.access.csv @@ -15,3 +15,4 @@ access_base_import_tests_models_float,base.import.tests.models.float,model_base_ access_base_import_tests_models_preview,base.import.tests.models.preview,model_base_import_tests_models_preview,base.group_user,1,1,1,1 access_base_import_mapping,base.import.mapping,model_base_import_mapping,base.group_user,1,1,1,1 access_base_import_tests_models_complex,access_base_import_tests_models_complex,model_base_import_tests_models_complex,base.group_user,1,0,0,0 +access_base_import_import,access.base_import.import,model_base_import_import,base.group_user,1,1,1,0 diff --git a/addons/base_import_module/__manifest__.py b/addons/base_import_module/__manifest__.py index 0504bcfd6b3..e5b45d6337c 100644 --- a/addons/base_import_module/__manifest__.py +++ b/addons/base_import_module/__manifest__.py @@ -13,5 +13,8 @@ for customization purpose. 'depends': ['web'], 'installable': True, 'auto_install': False, - 'data': ['views/base_import_module_view.xml'], + 'data': [ + 'security/ir.model.access.csv', + 'views/base_import_module_view.xml' + ], } diff --git a/addons/base_import_module/security/ir.model.access.csv b/addons/base_import_module/security/ir.model.access.csv new file mode 100644 index 00000000000..35b8d2bc0d9 --- /dev/null +++ b/addons/base_import_module/security/ir.model.access.csv @@ -0,0 +1,2 @@ +"id","name","model_id:id","group_id:id","perm_read","perm_write","perm_create","perm_unlink" +"access_base_import_module","access.base.import.module","model_base_import_module","base.group_system",1,1,1,0 diff --git a/addons/base_sparse_field/__manifest__.py b/addons/base_sparse_field/__manifest__.py index d98d9cb81a0..a13593b783f 100644 --- a/addons/base_sparse_field/__manifest__.py +++ b/addons/base_sparse_field/__manifest__.py @@ -12,6 +12,7 @@ 'version': '1.0', 'depends': ['base'], 'data': [ + 'security/ir.model.access.csv', 'views/views.xml', ], } diff --git a/addons/base_sparse_field/security/ir.model.access.csv b/addons/base_sparse_field/security/ir.model.access.csv new file mode 100644 index 00000000000..c163e1f2c64 --- /dev/null +++ b/addons/base_sparse_field/security/ir.model.access.csv @@ -0,0 +1,2 @@ +"id","name","model_id:id","group_id:id","perm_read","perm_write","perm_create","perm_unlink" +"access_sparse_fields_test","access.sparse_fields.test","model_sparse_fields_test","base.group_system",1,1,1,0 diff --git a/addons/crm/security/ir.model.access.csv b/addons/crm/security/ir.model.access.csv index 7269054d25b..95308da62b1 100644 --- a/addons/crm/security/ir.model.access.csv +++ b/addons/crm/security/ir.model.access.csv @@ -23,3 +23,8 @@ access_calendar_event_type_sale_salesman,calendar.event.type.salesman,calendar.m access_mail_activity_type_sale_manager,mail.activity.type.sale.manager,mail.model_mail_activity_type,sales_team.group_sale_manager,1,1,1,1 access_crm_lead_scoring_frequency,access_crm_lead_scoring_frequency,model_crm_lead_scoring_frequency,sales_team.group_sale_salesman,1,0,0,0 access_crm_lead_scoring_frequency_field,access_crm_lead_scoring_frequency_field,model_crm_lead_scoring_frequency_field,sales_team.group_sale_salesman,1,0,0,0 +access_crm_lead_lost,access.crm.lead.lost,model_crm_lead_lost,sales_team.group_sale_salesman,1,1,1,0 +access_crm_partner_binding,access.crm.partner.binding,model_crm_partner_binding,base.group_partner_manager,1,1,1,0 +access_crm_lead2opportunity_partner,access.crm.lead2opportunity.partner,model_crm_lead2opportunity_partner,sales_team.group_sale_salesman,1,1,1,0 +access_crm_lead2opportunity_partner_mass,access.crm.lead2opportunity.partner.mass,model_crm_lead2opportunity_partner_mass,sales_team.group_sale_salesman,1,1,1,0 +access_crm_merge_opportunity,access.crm.merge.opportunity,model_crm_merge_opportunity,sales_team.group_sale_salesman,1,1,1,0 diff --git a/addons/crm/tests/test_crm_lead_lost.py b/addons/crm/tests/test_crm_lead_lost.py index 1cc0defab98..7f2819f7825 100644 --- a/addons/crm/tests/test_crm_lead_lost.py +++ b/addons/crm/tests/test_crm_lead_lost.py @@ -28,9 +28,10 @@ class TestLeadConvert(crm_common.TestCrmCommon): lost_wizard = self.env['crm.lead.lost'].with_context({ 'active_ids': lead.ids, - }).create({}) + }).create({ + 'lost_reason_id': self.lost_reason.id + }) - lost_wizard.write({'lost_reason_id': self.lost_reason.id}) lost_wizard.action_lost_reason_apply() self.assertEqual(lead.probability, 0) @@ -55,8 +56,9 @@ class TestLeadConvert(crm_common.TestCrmCommon): lost_wizard = self.env['crm.lead.lost'].with_context({ 'active_ids': lead.ids - }).create({}) - lost_wizard.write({'lost_reason_id': lost_reason.id}) + }).create({ + 'lost_reason_id': lost_reason.id + }) # nice try little salesman, you cannot invoke a wizard to update other people leads with self.assertRaises(AccessError): diff --git a/addons/crm/views/crm_lead_views.xml b/addons/crm/views/crm_lead_views.xml index bdb2cbaf82c..0f364c4df71 100644 --- a/addons/crm/views/crm_lead_views.xml +++ b/addons/crm/views/crm_lead_views.xml @@ -751,7 +751,6 @@ 'default_use_template': True, 'default_template_id': ref('crm.email_template_opportunity_mail'), }" - groups="sales_team.group_sale_salesman" /> diff --git a/addons/product_expiry/__manifest__.py b/addons/product_expiry/__manifest__.py index 4cb792f72f1..88356340cac 100644 --- a/addons/product_expiry/__manifest__.py +++ b/addons/product_expiry/__manifest__.py @@ -17,7 +17,8 @@ Following dates can be tracked: Also implements the removal strategy First Expiry First Out (FEFO) widely used, for example, in food industries. """, - 'data': ['views/production_lot_views.xml', + 'data': ['security/ir.model.access.csv', + 'views/production_lot_views.xml', 'views/product_template_views.xml', 'views/stock_move_views.xml', 'views/stock_quant_views.xml', diff --git a/addons/product_expiry/security/ir.model.access.csv b/addons/product_expiry/security/ir.model.access.csv new file mode 100644 index 00000000000..3996979a446 --- /dev/null +++ b/addons/product_expiry/security/ir.model.access.csv @@ -0,0 +1,2 @@ +"id","name","model_id:id","group_id:id","perm_read","perm_write","perm_create","perm_unlink" +"access_expiry_picking_confirmation","access.expiry.picking.confirmation","model_expiry_picking_confirmation","stock.group_stock_user",1,1,1,0 diff --git a/addons/product_margin/security/ir.model.access.csv b/addons/product_margin/security/ir.model.access.csv index 4a08a4aa60d..81faf868345 100644 --- a/addons/product_margin/security/ir.model.access.csv +++ b/addons/product_margin/security/ir.model.access.csv @@ -1 +1,2 @@ -id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink +id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink +access_product_margin,access.product.margin,model_product_margin,account.group_account_user,1,1,1,0 diff --git a/addons/repair/security/ir.model.access.csv b/addons/repair/security/ir.model.access.csv index eca832db8d3..71d03880f13 100644 --- a/addons/repair/security/ir.model.access.csv +++ b/addons/repair/security/ir.model.access.csv @@ -5,3 +5,6 @@ access_repair_tag_user,Repair Tags user,model_repair_tags,stock.group_stock_user access_stock_production_lot_user,stock.production.lot user,stock.model_stock_production_lot,stock.group_stock_user,1,1,1,1 access_repair_line_user,repair.line user,model_repair_line,stock.group_stock_user,1,1,1,1 access_account_tax_user,account.tax,account.model_account_tax,stock.group_stock_user,1,1,1,1 +access_repair_cancel,access.repair.cancel,model_repair_cancel,stock.group_stock_user,1,1,1,0 +access_repair_order_make_invoice,access.repair.order.make_invoice,model_repair_order_make_invoice,stock.group_stock_user,1,1,1,0 +access_stock_warn_insufficient_qty_repair,access.stock.warn.insufficient.qty.repair,model_stock_warn_insufficient_qty_repair,stock.group_stock_user,1,1,1,0 diff --git a/addons/sale/security/ir.model.access.csv b/addons/sale/security/ir.model.access.csv index 3dec3d9c007..d3bc9376ed8 100644 --- a/addons/sale/security/ir.model.access.csv +++ b/addons/sale/security/ir.model.access.csv @@ -55,3 +55,7 @@ access_account_tax_group_sale_manager,account.tax.group sale manager,account.mod access_account_account_sale_manager,account.account sale manager,account.model_account_account,sales_team.group_sale_manager,1,0,0,0 access_mail_activity_type_sale_manager,mail.activity.type.sale.manager,mail.model_mail_activity_type,sales_team.group_sale_manager,1,1,1,1 access_report_all_channels_sales,access_report_all_channels_sales,model_report_all_channels_sales,sales_team.group_sale_manager,1,0,0,0 +access_sale_payment_acquirer_onboarding_wizard,access.sale.payment.acquirer.onboarding.wizard,model_sale_payment_acquirer_onboarding_wizard,base.group_system,1,1,1,0 +access_sale_advance_payment_inv,access.sale.advance.payment.inv,model_sale_advance_payment_inv,sales_team.group_sale_salesman,1,1,1,0 +access_sale_order_cancel,access.sale.order.cancel,model_sale_order_cancel,sales_team.group_sale_salesman,1,1,1,0 +access_payment_link_wizard_sale,access.payment.link.wizard.sale,model_payment_link_wizard,sales_team.group_sale_salesman,1,1,1,0 diff --git a/addons/sale/security/sale_security.xml b/addons/sale/security/sale_security.xml index bd0508e1ef7..942844709e1 100644 --- a/addons/sale/security/sale_security.xml +++ b/addons/sale/security/sale_security.xml @@ -187,5 +187,27 @@ [('move_id.type', 'in', ('out_invoice', 'out_refund', 'in_invoice', 'in_refund'))] + + + + Payment Acquier Onboarding Wizard Rule + + + [('create_uid', '=', user.id)] + + + + Sales Advance Payment Invoice Rule + + + [('create_uid', '=', user.id)] + + + + Sales Order Cancel Rule + + + [('create_uid', '=', user.id)] + diff --git a/addons/sale/wizard/sale_make_invoice_advance_views.xml b/addons/sale/wizard/sale_make_invoice_advance_views.xml index 5af37ef6a24..3dd0a99cec0 100644 --- a/addons/sale/wizard/sale_make_invoice_advance_views.xml +++ b/addons/sale/wizard/sale_make_invoice_advance_views.xml @@ -56,7 +56,6 @@ sale.advance.payment.inv form new - list diff --git a/addons/sale_coupon/__manifest__.py b/addons/sale_coupon/__manifest__.py index 59e0d22d6f5..c731a4d1b0b 100644 --- a/addons/sale_coupon/__manifest__.py +++ b/addons/sale_coupon/__manifest__.py @@ -8,6 +8,7 @@ 'version': '1.0', 'depends': ['sale_management'], 'data': [ + 'security/sale_coupon_security.xml', 'security/ir.model.access.csv', 'wizard/sale_coupon_apply_code_views.xml', 'wizard/sale_coupon_generate_views.xml', diff --git a/addons/sale_coupon/security/ir.model.access.csv b/addons/sale_coupon/security/ir.model.access.csv index 18ec5bda7ae..265de7613e9 100644 --- a/addons/sale_coupon/security/ir.model.access.csv +++ b/addons/sale_coupon/security/ir.model.access.csv @@ -7,3 +7,5 @@ access_coupon_salesman,salesman,model_sale_coupon,sales_team.group_sale_salesman access_coupon_manager,program manager,model_sale_coupon,sales_team.group_sale_manager,1,1,1,0 access_reward_salesman,salesman,model_sale_coupon_reward,sales_team.group_sale_salesman,1,0,0,0 access_reward_manager,program manager,model_sale_coupon_reward,sales_team.group_sale_manager,1,1,1,0 +access_sale_coupon_apply_code,access.sale.coupon.apply.code,model_sale_coupon_apply_code,sales_team.group_sale_salesman,1,1,1,0 +access_sale_coupon_generate,access.sale.coupon.generate,model_sale_coupon_generate,sales_team.group_sale_salesman,1,1,1,0 diff --git a/addons/sale_coupon/security/sale_coupon_security.xml b/addons/sale_coupon/security/sale_coupon_security.xml new file mode 100644 index 00000000000..fa5b89ef5ef --- /dev/null +++ b/addons/sale_coupon/security/sale_coupon_security.xml @@ -0,0 +1,19 @@ + + + + + + Sale Coupon Apply Code Rule + + + [('create_uid', '=', user.id)] + + + Generate Sales Coupon Rule + + + [('create_uid', '=', user.id)] + + + + diff --git a/addons/sale_crm/security/ir.model.access.csv b/addons/sale_crm/security/ir.model.access.csv index 75317a244ad..7751d54565c 100644 --- a/addons/sale_crm/security/ir.model.access.csv +++ b/addons/sale_crm/security/ir.model.access.csv @@ -1,2 +1,2 @@ -id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink - +id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink +access_crm_quotation_partner,access.crm.quotation.partner,model_crm_quotation_partner,sales_team.group_sale_salesman,1,1,1,0 diff --git a/addons/sale_product_configurator/__manifest__.py b/addons/sale_product_configurator/__manifest__.py index 5211fcaf4e7..c24fa65c12a 100644 --- a/addons/sale_product_configurator/__manifest__.py +++ b/addons/sale_product_configurator/__manifest__.py @@ -15,6 +15,7 @@ It also enables the "optional products" feature. 'depends': ['sale'], 'data': [ + 'security/ir.model.access.csv', 'views/assets.xml', 'views/templates.xml', 'views/sale_views.xml', diff --git a/addons/sale_product_configurator/security/ir.model.access.csv b/addons/sale_product_configurator/security/ir.model.access.csv new file mode 100644 index 00000000000..1c8e002cafd --- /dev/null +++ b/addons/sale_product_configurator/security/ir.model.access.csv @@ -0,0 +1,2 @@ +"id","name","model_id:id","group_id:id","perm_read","perm_write","perm_create","perm_unlink" +"access_sale_product_configurator","access.sale.product.configurator","model_sale_product_configurator","sales_team.group_sale_salesman",1,1,1,0 diff --git a/addons/sale_timesheet/security/ir.model.access.csv b/addons/sale_timesheet/security/ir.model.access.csv index 371bd9a61e3..74e49f82654 100644 --- a/addons/sale_timesheet/security/ir.model.access.csv +++ b/addons/sale_timesheet/security/ir.model.access.csv @@ -2,3 +2,7 @@ id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink access_project_profitability_report_analysis_manager,project.profitability.report.analysis,model_project_profitability_report,project.group_project_manager,1,1,1,1 access_project_sale_line_employee_map,access_project_sale_line_employee_map,model_project_sale_line_employee_map,base.group_user,1,0,0,0 access_project_sale_line_employee_map_manager,access_project_sale_line_employee_map_project_manager,model_project_sale_line_employee_map,project.group_project_manager,1,1,1,1 +access_project_create_sale_order,access.project.create.sale.order,model_project_create_sale_order,sales_team.group_sale_salesman,1,1,1,0 +access_project_create_sale_order_line,access.project.create.sale.order.line,model_project_create_sale_order_line,sales_team.group_sale_salesman,1,1,1,0 +access_project_create_invoice,access.project.create.invoice,model_project_create_invoice,sales_team.group_sale_salesman_all_leads,1,1,1,0 +access_project_task_create_sale_order,access.project.task.create.sale.order,model_project_task_create_sale_order,sales_team.group_sale_salesman,1,1,1,0 diff --git a/addons/sale_timesheet/wizard/project_create_invoice_views.xml b/addons/sale_timesheet/wizard/project_create_invoice_views.xml index 191cab2c0c4..55e2bdff034 100644 --- a/addons/sale_timesheet/wizard/project_create_invoice_views.xml +++ b/addons/sale_timesheet/wizard/project_create_invoice_views.xml @@ -26,7 +26,6 @@ form new - diff --git a/addons/sale_timesheet/wizard/project_create_sale_order_views.xml b/addons/sale_timesheet/wizard/project_create_sale_order_views.xml index db90b4b5402..a4a01bf2efa 100644 --- a/addons/sale_timesheet/wizard/project_create_sale_order_views.xml +++ b/addons/sale_timesheet/wizard/project_create_sale_order_views.xml @@ -49,7 +49,6 @@ form new - diff --git a/addons/sale_timesheet/wizard/project_task_create_sale_order_views.xml b/addons/sale_timesheet/wizard/project_task_create_sale_order_views.xml index ec580dda564..7723545d87f 100644 --- a/addons/sale_timesheet/wizard/project_task_create_sale_order_views.xml +++ b/addons/sale_timesheet/wizard/project_task_create_sale_order_views.xml @@ -31,7 +31,6 @@ form new - diff --git a/addons/sms/security/ir.model.access.csv b/addons/sms/security/ir.model.access.csv index b5c75f2433f..bf54348054c 100644 --- a/addons/sms/security/ir.model.access.csv +++ b/addons/sms/security/ir.model.access.csv @@ -4,3 +4,8 @@ access_sms_sms_system,access.sms.sms.system,model_sms_sms,base.group_system,1,1, access_sms_template_all,access.sms.template.all,model_sms_template,,0,0,0,0 access_sms_template_user,access.sms.template.user,model_sms_template,base.group_user,1,0,0,0 access_sms_template_system,access.sms.template.system,model_sms_template,base.group_system,1,1,1,1 +access_sms_cancel,access.sms.cancel,model_sms_cancel,base.group_user,1,1,1,0 +access_sms_composer,access.sms.composer,model_sms_composer,base.group_user,1,1,1,0 +access_sms_resend_recipient,access.sms.resend.recipient,model_sms_resend_recipient,base.group_user,1,1,1,0 +access_sms_resend,access.sms.resend,model_sms_resend,base.group_user,1,1,1,0 +access_sms_template_preview,access.sms.template.preview,model_sms_template_preview,base.group_user,1,1,1,0 diff --git a/addons/snailmail/security/ir.model.access.csv b/addons/snailmail/security/ir.model.access.csv index 3c111854063..c0bf2882c6d 100644 --- a/addons/snailmail/security/ir.model.access.csv +++ b/addons/snailmail/security/ir.model.access.csv @@ -2,4 +2,7 @@ id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink access_snailmail_letter_all,snailmail.letter.all,model_snailmail_letter,,1,0,0,0 access_snailmail_letter_portal,snailmail.letter.portal,model_snailmail_letter,base.group_portal,1,0,1,0 access_snailmail_letter_user,snailmail.letter.user,model_snailmail_letter,base.group_user,1,1,1,0 -access_snailmail_letter_system,snailmail.letter.system,model_snailmail_letter,base.group_system,1,1,1,1 \ No newline at end of file +access_snailmail_letter_system,snailmail.letter.system,model_snailmail_letter,base.group_system,1,1,1,1 +access_snailmail_letter_cancel,access.snailmail.letter.cancel,model_snailmail_letter_cancel,base.group_user,1,1,1,0 +access_snailmail_letter_format_error,access.snailmail.letter.format.error,model_snailmail_letter_format_error,base.group_user,1,1,1,0 +access_snailmail_letter_missing_required_fields,access.snailmail.letter.missing.required.fields,model_snailmail_letter_missing_required_fields,base.group_user,1,1,1,0 diff --git a/addons/stock/security/ir.model.access.csv b/addons/stock/security/ir.model.access.csv index 596ac22548c..3b177eb51a0 100644 --- a/addons/stock/security/ir.model.access.csv +++ b/addons/stock/security/ir.model.access.csv @@ -72,3 +72,20 @@ access_product_product_attribute_manager,product.product.attribute manager value access_product_template_attribute_exclusion_manager,product.attribute manager filter line,product.model_product_template_attribute_exclusion,stock.group_stock_manager,1,1,1,1 access_product_template_attribute_line_manager,product.attribute manager line,product.model_product_template_attribute_line,stock.group_stock_manager,1,1,1,1 access_report_stock_quantity,access_report_stock_quantity,model_report_stock_quantity,base.group_user,1,0,0,0 +access_stock_traceability_report,access.stock.traceability.report,model_stock_traceability_report,stock.group_stock_user,1,1,1,0 +access_stock_assign_serial,access.stock.assign.serial,model_stock_assign_serial,stock.group_stock_user,1,1,1,0 +access_stock_return_picking_line,access.stock.return.picking.line,model_stock_return_picking_line,stock.group_stock_user,1,1,1,0 +access_stock_return_picking,access.stock.return.picking,model_stock_return_picking,stock.group_stock_user,1,1,1,0 +access_stock_change_product_qty,access.stock.change.product.qty,model_stock_change_product_qty,stock.group_stock_user,1,1,1,0 +access_stock_scheduler_compute,access.stock.scheduler.compute,model_stock_scheduler_compute,stock.group_stock_user,1,1,1,0 +access_stock_immediate_transfer_line,access.stock.immediate.transfer.line,model_stock_immediate_transfer_line,stock.group_stock_user,1,1,1,0 +access_stock_immediate_transfer,access.stock.immediate.transfer,model_stock_immediate_transfer,stock.group_stock_user,1,1,1,0 +access_stock_backorder_confirmation_line,access.stock.backorder.confirmation.line,model_stock_backorder_confirmation_line,stock.group_stock_user,1,1,1,0 +access_stock_backorder_confirmation,access.stock.backorder.confirmation,model_stock_backorder_confirmation,stock.group_stock_user,1,1,1,0 +access_stock_quantity_history,access.stock.quantity.history,model_stock_quantity_history,stock.group_stock_user,1,1,1,0 +access_stock_rules_report,access.stock.rules.report,model_stock_rules_report,stock.group_stock_user,1,1,1,0 +access_stock_warn_insufficient_qty_scrap,access.stock.warn.insufficient.qty.scrap,model_stock_warn_insufficient_qty_scrap,stock.group_stock_user,1,1,1,0 +access_product_replenish,access.product.replenish,model_product_replenish,stock.group_stock_user,1,1,1,0 +access_stock_track_confirmation,access.stock.track.confirmation,model_stock_track_confirmation,stock.group_stock_user,1,1,1,0 +access_stock_track_line,access.stock.track.line,model_stock_track_line,stock.group_stock_user,1,1,1,0 +access_stock_package_destination,access.stock.package.destination,model_stock_package_destination,stock.group_stock_user,1,1,1,0 diff --git a/addons/stock_picking_batch/security/ir.model.access.csv b/addons/stock_picking_batch/security/ir.model.access.csv index 615ed649f59..31a6de03836 100644 --- a/addons/stock_picking_batch/security/ir.model.access.csv +++ b/addons/stock_picking_batch/security/ir.model.access.csv @@ -1,2 +1,3 @@ id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink access_stock_picking_batch,stock.picking.batch stock users,model_stock_picking_batch,stock.group_stock_user,1,1,1,1 +access_stock_picking_to_batch,access.stock.picking.to.batch,model_stock_picking_to_batch,stock.group_stock_user,1,1,1,0 diff --git a/addons/stock_sms/security/ir.model.access.csv b/addons/stock_sms/security/ir.model.access.csv index 70870ff6dbf..822806bbe5c 100644 --- a/addons/stock_sms/security/ir.model.access.csv +++ b/addons/stock_sms/security/ir.model.access.csv @@ -1,2 +1,3 @@ id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink access_sms_template_stock_manager,access.sms.template.stock.manager,sms.model_sms_template,stock.group_stock_manager,1,1,1,1 +access_confirm_stock_sms,access.confirm.stock.sms,model_confirm_stock_sms,stock.group_stock_user,1,1,1,0 diff --git a/addons/survey/security/ir.model.access.csv b/addons/survey/security/ir.model.access.csv index 89cce9edfc5..39fec6457fd 100644 --- a/addons/survey/security/ir.model.access.csv +++ b/addons/survey/security/ir.model.access.csv @@ -20,3 +20,4 @@ access_survey_user_input_line_user,survey.user_input.line.user,model_survey_user access_survey_user_input_line_survey_user,survey.user_input.line.survey.user,model_survey_user_input_line,group_survey_user,1,1,1,1 access_survey_user_input_line_survey_manager,survey.user_input.line.survey.manager,model_survey_user_input_line,group_survey_manager,1,1,1,1 access_gamification_badge_survey_user,gamification.badge.survey.user,model_gamification_badge,group_survey_user,1,1,1,1 +access_survey_invite,access.survey.invite,model_survey_invite,survey.group_survey_user,1,1,1,0 diff --git a/addons/test_mail/tests/test_performance.py b/addons/test_mail/tests/test_performance.py index 6cdc637ccf3..31c93f4a0fa 100644 --- a/addons/test_mail/tests/test_performance.py +++ b/addons/test_mail/tests/test_performance.py @@ -277,8 +277,8 @@ class TestMailAPIPerformance(BaseMailPerformance): def test_mail_composer_w_template(self): test_record = self.env['mail.test.full'].browse(self.test_record_full.id) test_template = self.env['mail.template'].browse(self.test_template_full.id) - # TODO XDO/TDE FIXME non deterministic between 25 and 28 queries - with self.assertQueryCount(__system__=28, emp=28): + # TODO XDO/TDE/MAT FIXME non deterministic between 25 and 29 queries + with self.assertQueryCount(__system__=28, emp=29): composer = self.env['mail.compose.message'].with_context({ 'default_composition_mode': 'comment', 'default_model': test_record._name, @@ -489,7 +489,7 @@ class TestMailComplexPerformance(BaseMailPerformance): record = self.umbrella.with_user(self.env.user) template_id = self.env.ref('test_mail.mail_test_tpl').id - with self.assertQueryCount(__system__=84, emp=85): + with self.assertQueryCount(__system__=84, emp=86): record.message_post_with_template(template_id, message_type='comment', composition_mode='comment') self.assertEqual(record.message_ids[0].body, '

Adding stuff on %s

' % record.name) @@ -680,7 +680,7 @@ class TestMailComplexPerformance(BaseMailPerformance): rec1 = rec.with_context(active_test=False) # to see inactive records self.assertEqual(rec1.message_partner_ids, self.partners | self.env.user.partner_id | self.user_portal.partner_id) - with self.assertQueryCount(__system__=34, emp=35): + with self.assertQueryCount(__system__=34, emp=36): rec.write({ 'name': 'Test2', 'customer_id': customer_id, diff --git a/addons/website/security/ir.model.access.csv b/addons/website/security/ir.model.access.csv index 1053d765d0f..daa7630f376 100644 --- a/addons/website/security/ir.model.access.csv +++ b/addons/website/security/ir.model.access.csv @@ -21,3 +21,4 @@ access_theme_ir_ui_view,access_theme_ir_ui_view,model_theme_ir_ui_view,base.grou access_theme_ir_attachment,access_theme_ir_attachment,model_theme_ir_attachment,base.group_system,1,1,1,1 access_theme_website_menu,access_theme_website_menu,model_theme_website_menu,base.group_system,1,1,1,1 access_theme_website_page,access_theme_website_page,model_theme_website_page,base.group_system,1,1,1,1 +access_website_robots,access.website.robots,model_website_robots,website.group_website_designer,1,1,1,0 diff --git a/addons/website_crm_partner_assign/security/ir.model.access.csv b/addons/website_crm_partner_assign/security/ir.model.access.csv index c400f632eee..3e07ee84ae2 100644 --- a/addons/website_crm_partner_assign/security/ir.model.access.csv +++ b/addons/website_crm_partner_assign/security/ir.model.access.csv @@ -10,3 +10,5 @@ access_partner_activation_manager,res.partner.activation.manager,model_res_partn partner_access_crm_lead,crm.lead,crm.model_crm_lead,base.group_portal,1,1,0,0 access_res_partner_grade_invoicing_payment_readonly,res.partner.grade,model_res_partner_grade,account.group_account_readonly,1,0,0,0 access_res_partner_grade_invoicing_payment,res.partner.grade,model_res_partner_grade,account.group_account_invoice,1,0,0,0 +access_crm_lead_forward_to_partner,access.crm.lead.forward.to.partner,model_crm_lead_forward_to_partner,sales_team.group_sale_manager,1,1,1,0 +access_crm_lead_assignation,access.crm.lead.assignation,model_crm_lead_assignation,sales_team.group_sale_manager,1,1,1,0 diff --git a/addons/website_crm_partner_assign/wizard/crm_forward_to_partner_view.xml b/addons/website_crm_partner_assign/wizard/crm_forward_to_partner_view.xml index 20efa652097..a86faea87c7 100644 --- a/addons/website_crm_partner_assign/wizard/crm_forward_to_partner_view.xml +++ b/addons/website_crm_partner_assign/wizard/crm_forward_to_partner_view.xml @@ -48,7 +48,6 @@ name="Forward to partner" res_model="crm.lead.forward.to.partner" binding_model="crm.lead" view_mode="form" target="new" - groups="sales_team.group_sale_manager" context="{'default_composition_mode' : 'mass_mail'}" view_id="crm_lead_forward_to_partner_form" /> diff --git a/addons/website_sale/security/ir.model.access.csv b/addons/website_sale/security/ir.model.access.csv index 6da9fe3be19..625480f9611 100644 --- a/addons/website_sale/security/ir.model.access.csv +++ b/addons/website_sale/security/ir.model.access.csv @@ -21,3 +21,4 @@ access_account_tax_user,account.tax,account.model_account_tax,base.group_public, access_product_image_public,product.image public,model_product_image,,1,0,0,0 access_product_image_publisher,product.image wbesite publisher,model_product_image,website.group_website_publisher,1,1,1,1 access_product_image_sale,product.image sale,model_product_image,sales_team.group_sale_manager,1,1,1,1 +access_website_sale_payment_acquirer_onboarding_wizard,access.website.sale.payment.acquirer.onboarding.wizard,model_website_sale_payment_acquirer_onboarding_wizard,base.group_system,1,1,1,0 diff --git a/addons/website_slides/security/ir.model.access.csv b/addons/website_slides/security/ir.model.access.csv index 43f14a23bbf..355ebc5ade4 100644 --- a/addons/website_slides/security/ir.model.access.csv +++ b/addons/website_slides/security/ir.model.access.csv @@ -26,3 +26,4 @@ access_slide_slide_link_officer,slide.slide.link.officer,model_slide_slide_link, access_slide_slide_resource_all,slide.slide.resource.all,model_slide_slide_resource,,1,0,0,0 access_slide_slide_resource_public,slide.slide.resource.public,model_slide_slide_resource,base.group_public,0,0,0,0 access_slide_slide_resource_publisher,slide.slide.resource.publisher,model_slide_slide_resource,website_slides.group_website_slides_officer,1,1,1,1 +access_slide_channel_invite,access.slide.channel.invite,model_slide_channel_invite,base.group_user,1,1,1,0 diff --git a/odoo/addons/base/security/base_security.xml b/odoo/addons/base/security/base_security.xml index 444f0148ada..f3ee7bb6cbc 100644 --- a/odoo/addons/base/security/base_security.xml +++ b/odoo/addons/base/security/base_security.xml @@ -68,6 +68,12 @@ ['|',('company_id','=',False),('company_id', 'in', company_ids)] + + change user password rule + + [('create_uid', '=', user.id)] + + res.partner.rule.private.employee diff --git a/odoo/addons/base/security/ir.model.access.csv b/odoo/addons/base/security/ir.model.access.csv index e1d6785f006..211e9d5485c 100644 --- a/odoo/addons/base/security/ir.model.access.csv +++ b/odoo/addons/base/security/ir.model.access.csv @@ -99,3 +99,23 @@ "paperformat_access_portal","ir_actions_report_paperformat group_portal","model_report_paperformat",,1,0,0,0 "paperformat_access_employee","ir_actions_report_paperformat group_system","model_report_paperformat",group_system,1,1,1,1 "access_report_layout","access_report_layout","model_report_layout",,1,1,1,1 +"access_wizard_ir_model_menu_create","access.wizard.ir.model.menu.create","model_wizard_ir_model_menu_create","base.group_system",1,1,1,0 +"access_reset_view_arch_wizard","access.reset.view.arch.wizard","model_reset_view_arch_wizard","base.group_erp_manager",1,1,1,0 +"access_ir_demo","access.ir.demo","model_ir_demo","base.group_system",1,1,1,0 +"access_ir_demo_failure","access.ir.demo_failure","model_ir_demo_failure","base.group_system",1,1,1,0 +"access_ir_demo_failure_wizard","access.ir.demo_failure.wizard","model_ir_demo_failure_wizard","base.group_system",1,1,1,0 +"access_res_config","access.res.config","model_res_config","base.group_system",1,1,1,0 +"access_res_config_installer","access.res.config.installer","model_res_config_installer","base.group_system",1,1,1,0 +"access_res_config_settings","access.res.config.settings","model_res_config_settings","base.group_system",1,1,1,0 +"access_change_password_wizard","access.change.password.wizard","model_change_password_wizard","base.group_erp_manager",1,1,1,0 +"access_change_password_user","access.change.password.user","model_change_password_user","base.group_system",1,1,1,0 +"access_base_module_update","access.base.module.update","model_base_module_update","base.group_system",1,1,1,0 +"access_base_language_install","access.base.language.install","model_base_language_install","base.group_system",1,1,1,0 +"access_base_language_import","access.base.language.import","model_base_language_import","base.group_system",1,1,1,0 +"access_base_module_upgrade","access.base.module.upgrade","model_base_module_upgrade","base.group_system",1,1,1,0 +"access_base_module_uninstall","access.base.module.uninstall","model_base_module_uninstall","base.group_system",1,1,1,0 +"access_base_language_export","access.base.language.export","model_base_language_export","base.group_user",1,1,1,0 +"access_base_update_translations","access.base.update.translations","model_base_update_translations","base.group_system",1,1,1,0 +"access_base_partner_merge_line","access.base.partner.merge.line","model_base_partner_merge_line","base.group_system",1,1,1,0 +"access_base_partner_merge_automatic_wizard","access.base.partner.merge.automatic.wizard","model_base_partner_merge_automatic_wizard","base.group_system",1,1,1,0 +"access_base_document_layout","access.base.document.layout","model_base_document_layout","base.group_system",1,1,1,0 diff --git a/odoo/addons/base/views/ir_ui_view_views.xml b/odoo/addons/base/views/ir_ui_view_views.xml index 594561a39f9..45b95be604c 100644 --- a/odoo/addons/base/views/ir_ui_view_views.xml +++ b/odoo/addons/base/views/ir_ui_view_views.xml @@ -129,8 +129,7 @@ binding_model="ir.ui.view" binding_views="form" res_model="reset.view.arch.wizard" view_mode="form" - target="new" - groups="base.group_erp_manager"/> + target="new"/> diff --git a/odoo/addons/base/views/res_users_views.xml b/odoo/addons/base/views/res_users_views.xml index 50008ead434..bc08c1ec562 100644 --- a/odoo/addons/base/views/res_users_views.xml +++ b/odoo/addons/base/views/res_users_views.xml @@ -31,8 +31,7 @@ name="Change Password" binding_model="res.users" res_model="change.password.wizard" - view_mode="form" target="new" - groups="base.group_erp_manager"/> + view_mode="form" target="new"/> diff --git a/odoo/addons/test_new_api/security/ir.model.access.csv b/odoo/addons/test_new_api/security/ir.model.access.csv index 5a4f8ce3239..056be62d064 100644 --- a/odoo/addons/test_new_api/security/ir.model.access.csv +++ b/odoo/addons/test_new_api/security/ir.model.access.csv @@ -48,3 +48,4 @@ access_test_new_api_model_binary,access_test_new_api_model_binary,model_test_new access_test_new_api_model_child_m2o,access_test_new_api_model_child_m2o,model_test_new_api_model_child_m2o,,1,1,1,1 access_test_new_api_model_parent_m2o,access_test_new_api_model_parent_m2o,model_test_new_api_model_parent_m2o,,1,1,1,1 access_test_new_api_model_private_address_onchange,access_test_new_api_model_private_address_onchange,model_test_new_api_model_private_address_onchange,base.group_user,1,1,1,1 +access_test_new_api_req_m2o_transient,access_test_new_api_req_m2o_transient,model_test_new_api_req_m2o_transient,,0,0,0,0 diff --git a/odoo/addons/test_translation_import/__manifest__.py b/odoo/addons/test_translation_import/__manifest__.py index 73a0c450032..c6de7e12509 100644 --- a/odoo/addons/test_translation_import/__manifest__.py +++ b/odoo/addons/test_translation_import/__manifest__.py @@ -5,7 +5,10 @@ 'category': 'Tests', 'description': """A module to test translation import.""", 'depends': ['base'], - 'data': ['view.xml'], + 'data': [ + 'security/ir.model.access.csv', + 'view.xml' + ], 'installable': True, 'auto_install': False, } diff --git a/odoo/addons/test_translation_import/security/ir.model.access.csv b/odoo/addons/test_translation_import/security/ir.model.access.csv new file mode 100644 index 00000000000..ba076d4035f --- /dev/null +++ b/odoo/addons/test_translation_import/security/ir.model.access.csv @@ -0,0 +1,2 @@ +"id","name","model_id:id","group_id:id","perm_read","perm_write","perm_create","perm_unlink" +"access_test_translation_import","access.test.translation.import","model_test_translation_import",,0,0,0,0