From 5e605f589dd9108f8f7a438235aecd34db6859ef Mon Sep 17 00:00:00 2001
From: David Beguin <dbe@odoo.com>
Date: Mon, 18 Nov 2019 13:51:31 +0000
Subject: [PATCH] [FIX-IMP] website, website_livechat : disable create visitor
 and review ACLS

This commit applies the following ACLs rules:

C : nobody can create visitor (except system)
R : everyone that should access to this model
U : website_designer can update (even if only few fields are editable),
    mainly useful for language (+ system obviously)
    + livechat users as they are the guys who directly speaks with the visitors
D : system + website_designer can delete, mainly useful to clean if necessary

Remove the no_create from all visitor views as handled by ACLs.

This fixes the 'can create' that should not be done by any users
except system + admin

Task ID: 2092502
PR #40439

closes odoo/odoo#40865

X-original-commit: 23f3324830adf31edb0a12c7009fcb65b0f54614
Signed-off-by: Thibault Delavallee (tde) <tde@openerp.com>
---
 addons/website/security/ir.model.access.csv          | 2 +-
 addons/website/views/website_visitor_views.xml       | 4 ++--
 addons/website_livechat/security/ir.model.access.csv | 2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/addons/website/security/ir.model.access.csv b/addons/website/security/ir.model.access.csv
index 60afb5481a5..1053d765d0f 100644
--- a/addons/website/security/ir.model.access.csv
+++ b/addons/website/security/ir.model.access.csv
@@ -12,7 +12,7 @@ access_website_ir_ui_view,access_website_ir_ui_view,model_ir_ui_view,group_websi
 access_seo_public,access_seo_public,model_website_seo_metadata,,1,0,0,0
 access_seo_manager,access_seo_manager,model_website_seo_metadata,group_website_designer,1,1,1,1
 access_seo_designer,access_seo_designer,model_website_seo_metadata,group_website_designer,1,1,1,1
-access_website_visitor_designer,access_website_visitor_designer,model_website_visitor,website.group_website_designer,1,1,1,1
+access_website_visitor_designer,access_website_visitor_designer,model_website_visitor,website.group_website_designer,1,1,0,1
 access_website_visitor_system,access_website_visitor_system,model_website_visitor,base.group_system,1,1,1,1
 access_website_track_designer,access_website_track_designer,model_website_track,website.group_website_designer,1,1,1,1
 access_website_track_system,access_website_track_system,model_website_track,base.group_system,1,1,1,1
diff --git a/addons/website/views/website_visitor_views.xml b/addons/website/views/website_visitor_views.xml
index 1b7064c9d6a..eeea6c5ee27 100644
--- a/addons/website/views/website_visitor_views.xml
+++ b/addons/website/views/website_visitor_views.xml
@@ -172,7 +172,7 @@
         <field name="name">website.visitor.view.form</field>
         <field name="model">website.visitor</field>
         <field name="arch" type="xml">
-            <form string="Website Visitor" create="0">
+            <form string="Website Visitor">
                 <header>
                     <button name="action_send_mail" type="object" class="btn btn-primary"
                             attrs="{'invisible': [('email', '=', False)]}" string="Send Email"/>
@@ -224,7 +224,7 @@
         <field name="name">website.visitor.view.tree</field>
         <field name="model">website.visitor</field>
         <field name="arch" type="xml">
-            <tree string="Web Visitors" create="0" decoration-success="is_connected" decoration-danger="not is_connected">
+            <tree string="Web Visitors" decoration-success="is_connected" decoration-danger="not is_connected">
                 <!--TODO DBE : Handle no_label in treeview-->
                 <field name="country_flag" widget="image" options='{"size": [20, 20]}' string=" "/>
                 <field name="display_name"/>
diff --git a/addons/website_livechat/security/ir.model.access.csv b/addons/website_livechat/security/ir.model.access.csv
index ce1863efbbc..1c108334c01 100644
--- a/addons/website_livechat/security/ir.model.access.csv
+++ b/addons/website_livechat/security/ir.model.access.csv
@@ -1,4 +1,4 @@
 id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink
 access_im_livechat_channel_public,im_livechat.channel.public,im_livechat.model_im_livechat_channel,,1,0,0,0
-access_website_visitor_livechat_users,website.visitor.livechat.users,model_website_visitor,im_livechat.im_livechat_group_user,1,0,0,0
+access_website_visitor_livechat_users,website.visitor.livechat.users,model_website_visitor,im_livechat.im_livechat_group_user,1,1,0,0
 access_website_track_livechat_users,website.track.livechat.users,website.model_website_track,im_livechat.im_livechat_group_user,1,0,0,0