From 4b9bec96d069723aeb840ccd3947444aba1a86cc Mon Sep 17 00:00:00 2001
From: "Xavier BOL (xbo)" <xbo@odoo.com>
Date: Thu, 14 Apr 2022 13:19:46 +0000
Subject: [PATCH] [FW][FIX] project: add same rules than project.update for
 milestones

Before this commit, the internal user can access to all milestones
created in Project app even if he has no access to the project related.

This commit adds the rules for the project.milestone to filter the
records when the user is not a Project Manager.

closes odoo/odoo#88819

X-original-commit: 6438d8e690229b27ab08ecac436e54a85096eb0f
Forward-port-of: #88546
Forward-port-of: #88509
Signed-off-by: Yannick Tivisse (yti) <yti@odoo.com>
Signed-off-by: Xavier <xbo@odoo.com>
---
 addons/project/security/project_security.xml | 25 ++++++++++++++++++++
 1 file changed, 25 insertions(+)

diff --git a/addons/project/security/project_security.xml b/addons/project/security/project_security.xml
index bc90fe6c8bf..8c4c3853333 100644
--- a/addons/project/security/project_security.xml
+++ b/addons/project/security/project_security.xml
@@ -275,5 +275,30 @@
         <field name="groups" eval="[(4,ref('project.group_project_user'))]"/>
     </record>
 
+    <record model="ir.rule" id="milestone_comp_rule">
+        <field name="name">Project/Milestone: multi-company</field>
+        <field name="model_id" ref="model_project_milestone"/>
+        <field name="domain_force">[('project_id.company_id', 'in', company_ids)]</field>
+    </record>
+
+    <record model="ir.rule" id="milestone_visibility_rule">
+        <field name="name">Project/Milestone: employees: follow required for follower-only projects</field>
+        <field name="model_id" ref="model_project_milestone"/>
+        <field name="domain_force">[
+        '|',
+            ('project_id.privacy_visibility', '!=', 'followers'),
+            '|',
+                ('project_id.message_partner_ids', 'in', [user.partner_id.id]),
+                ('project_id.user_id', '=', user.id),
+        ]</field>
+        <field name="groups" eval="[(4, ref('base.group_user'))]"/>
+    </record>
+
+    <record id="milestone_visibility_project_admin" model="ir.rule">
+        <field name="name">Project/Milestone: Project manager can see all project milestones</field>
+        <field name="model_id" ref="project.model_project_milestone"/>
+        <field name="domain_force">[(1, '=', 1)]</field>
+        <field name="groups" eval="[(4, ref('project.group_project_manager'))]"/>
+    </record>
 </data>
 </odoo>