From 49eb24a46771792bec454f6c4693c19d2b5b05b6 Mon Sep 17 00:00:00 2001
From: Alex Tuyls <alt@odoo.com>
Date: Thu, 7 Mar 2019 12:18:23 +0000
Subject: [PATCH] [FIX] account, sale_timesheet: access rights when validating
 invoice

When validate an invoice, if the user is member of the timesheet user
group and the billing user group, it is forbidden to create an analytic
line without a project set. The previous commit (81218a8) allow the user
to create an analytic account line by adding a record rule in the
sale_timesheet module.

If only the account and timesheet modules' are installed, before this
commit, an error was raised when trying to validate an invoice in the
account module. This issue occurs because the record rule to allow the
user to create an analytic account line is found in sale_timesheet
module, and this one is not installed.
As an invoice can be validated without the need of the sales module's,
from the purchase module, or directly in the account module.
In this commit, the record rule was move to the account module.

opw-1948132

closes odoo/odoo#31661

Signed-off-by: Nicolas Martinelli (nim) <nim@odoo.com>
---
 addons/account/security/account_security.xml          | 11 +++++++++++
 .../security/sale_timesheet_security.xml              | 11 -----------
 2 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/addons/account/security/account_security.xml b/addons/account/security/account_security.xml
index b7ec99e56c0..648dc59f1c3 100644
--- a/addons/account/security/account_security.xml
+++ b/addons/account/security/account_security.xml
@@ -59,6 +59,17 @@
         <field name="category_id" ref="base.module_category_hidden"/>
     </record>
 
+    <record id="account_analytic_line_rule_billing_user" model="ir.rule">
+        <field name="name">account.analytic.line.billing.user</field>
+        <field name="model_id" ref="analytic.model_account_analytic_line"/>
+        <field name="domain_force">[(1, '=', 1)]</field>
+        <field name="groups" eval="[(4, ref('account.group_account_invoice'))]"/>
+        <field name="perm_create" eval="1"/>
+        <field name="perm_write" eval="1"/>
+        <field name="perm_unlink" eval="1"/>
+        <field name="perm_read" eval="0"/>
+    </record>
+
 </data>
 
 
diff --git a/addons/sale_timesheet/security/sale_timesheet_security.xml b/addons/sale_timesheet/security/sale_timesheet_security.xml
index f0f1f070eda..3f108758e60 100644
--- a/addons/sale_timesheet/security/sale_timesheet_security.xml
+++ b/addons/sale_timesheet/security/sale_timesheet_security.xml
@@ -3,17 +3,6 @@
 
     <data noupdate="1">
 
-        <record id="account_analytic_line_rule_billing_user" model="ir.rule">
-            <field name="name">account.analytic.line.billing.user</field>
-            <field name="model_id" ref="analytic.model_account_analytic_line"/>
-            <field name="domain_force">[(1, '=', 1)]</field>
-            <field name="groups" eval="[(4, ref('account.group_account_invoice'))]"/>
-            <field name="perm_create" eval="1"/>
-            <field name="perm_write" eval="1"/>
-            <field name="perm_unlink" eval="1"/>
-            <field name="perm_read" eval="0"/>
-        </record>
-
         <record id="sale_order_line_rule_project_manager" model="ir.rule">
             <field name="name">Project Manager Sales Orders Line</field>
             <field name="model_id" ref="sale.model_sale_order_line"/>