[FIX] point_of_sale: session access rules

You should not be able to see a pos.session if its pos (config_id) is not available to you.
2016-07-12 09:22:19 +02:00
parent 3ea1ac7e0d
commit 47bb1cf44d
1 changed files with 6 additions and 0 deletions
@@ -53,6 +53,12 @@
        <field name="name">Point Of Sale Order</field>
        <field name="model_id" ref="model_pos_order" />
        <field name="global" eval="True" />
+        <field name="domain_force">[('config_id.company_id', '=', user.company_id.id)]</field>
+    </record>
+    <record id="rule_pos_session_multi_company" model="ir.rule">
+        <field name="name">Point Of Sale Session</field>
+        <field name="model_id" ref="model_pos_session" />
+        <field name="global" eval="True" />
        <field name="domain_force">[('company_id', '=', user.company_id.id)]</field>
    </record>
    <record id="rule_pos_config_multi_company" model="ir.rule">