From 47bb1cf44d3264e721d288b9233a7e4cc72fb646 Mon Sep 17 00:00:00 2001
From: Damien Bouvy <dbo@odoo.com>
Date: Mon, 11 Jul 2016 18:11:52 +0200
Subject: [PATCH] [FIX] point_of_sale: session access rules

You should not be able to see a pos.session if its pos (config_id)
is not available to you.
---
 addons/point_of_sale/security/point_of_sale_security.xml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/addons/point_of_sale/security/point_of_sale_security.xml b/addons/point_of_sale/security/point_of_sale_security.xml
index 1d3e6123eef..463cf3f4e28 100644
--- a/addons/point_of_sale/security/point_of_sale_security.xml
+++ b/addons/point_of_sale/security/point_of_sale_security.xml
@@ -53,6 +53,12 @@
         <field name="name">Point Of Sale Order</field>
         <field name="model_id" ref="model_pos_order" />
         <field name="global" eval="True" />
+        <field name="domain_force">[('config_id.company_id', '=', user.company_id.id)]</field>
+    </record>
+    <record id="rule_pos_session_multi_company" model="ir.rule">
+        <field name="name">Point Of Sale Session</field>
+        <field name="model_id" ref="model_pos_session" />
+        <field name="global" eval="True" />
         <field name="domain_force">[('company_id', '=', user.company_id.id)]</field>
     </record>
     <record id="rule_pos_config_multi_company" model="ir.rule">