[FIX] hr: Hide 'delete' and 'change password' actions on own profile

Expected Behaviour

When a user goes to his own profile, he has two ways to change his password :
1. through the 'Account security' tab
2. through the 'Actions' > 'Change password' menu in list/form view
Both option should let the user change its password, or one of the two should
not be present

Observed behaviour

While the first one works as expected, the second option gives an error as
the user doesn't have the admin rights

Reproducibility

This bug can be reproduced following these steps:
0. Make sure to have the "Employees" app installed
1. Connect as an employee (e.g. demo/demo on runbot)
2. Click on your name at the top right, go to 'My Profile'
3. Click 'Action' then 'Change password'

Problem Root Cause

There is an override of field_view_get for the res.users model in the hr
module which elevates the user with sudo so that the user may modify their
own user in some capacity. The problem is that by elevating the ACLs of the
user, fields_view_get will also return actions that are not normally
available to the user (e.g. deletion of user profile)

Related Issues/PR

- opw-2735671

closes odoo/odoo#86116

X-original-commit: 6487a9ea7d25d14a86a7476b4b512f3681da7405
Signed-off-by: Yannick Tivisse (yti) <yti@odoo.com>

addons/hr/models/res_users.py

@@ -175,9 +175,19 @@ class User(models.Model):
         # Note: limit the `sudo` to the only action of "editing own profile" action in order to
         # avoid breaking `groups` mecanism on res.users form view.
         profile_view = self.env.ref("hr.res_users_view_form_profile")
+        original_user = self.env.user
         if profile_view and view_id == profile_view.id:
             self = self.with_user(SUPERUSER_ID)
-        return super(User, self).fields_view_get(view_id=view_id, view_type=view_type, toolbar=toolbar, submenu=submenu)
+        result = super(User, self).fields_view_get(view_id=view_id, view_type=view_type, toolbar=toolbar, submenu=submenu)
+        # Due to using the SUPERUSER the result will contain action that the user may not have access too
+        # here we filter out actions that requires special implicit rights to avoid having unusable actions
+        # in the dropdown menu.
+        if toolbar and self.env.user != original_user:
+            self = self.with_user(original_user.id)
+            if not self.user_has_groups("base.group_erp_manager"):
+                change_password_action = self.env.ref("base.change_password_wizard_action")
+                result['toolbar']['action'] = [act for act in result['toolbar']['action'] if act['id'] != change_password_action.id]
+        return result
 
     def write(self, vals):
         """

addons/hr/tests/test_self_user_access.py

@@ -76,6 +76,32 @@ class TestSelfAccessProfile(TestHrCommon):
         # Compare both
         self.assertEqual(full_fields.keys(), fields.keys(), "View fields should not depend on user's groups")
 
+    def test_access_my_profile_toolbar(self):
+        """ A simple user shouldn't have the possibilities to see the 'Change Password' action"""
+        james = new_test_user(self.env, login='jam', groups='base.group_user', name='Simple employee', email='jam@example.com')
+        james = james.with_user(james)
+        self.env['hr.employee'].create({
+            'name': 'James',
+            'user_id': james.id,
+        })
+        view = self.env.ref('hr.res_users_view_form_profile')
+        available_actions = james.fields_view_get(view_id=view.id, toolbar=True)['toolbar']['action']
+        change_password_action = self.env.ref("base.change_password_wizard_action")
+
+        self.assertFalse(any(x['id'] == change_password_action.id for x in available_actions))
+
+        # An ERP manager should have the possibilities to see the 'Change Password'
+        john = new_test_user(self.env, login='joh', groups='base.group_erp_manager', name='ERP Manager', email='joh@example.com')
+        john = john.with_user(john)
+        self.env['hr.employee'].create({
+            'name': 'John',
+            'user_id': john.id,
+        })
+        view = self.env.ref('hr.res_users_view_form_profile')
+        available_actions = john.fields_view_get(view_id=view.id, toolbar=True)['toolbar']['action']
+        self.assertTrue(any(x['id'] == change_password_action.id for x in available_actions))
+
+
 class TestSelfAccessRights(TestHrCommon):
 
     @classmethod

addons/hr/views/res_users.xml

@@ -47,6 +47,7 @@
             <field name="arch" type="xml">
                 <form position="attributes">
                     <attribute name="create">false</attribute>
+                    <attribute name="delete">false</attribute>
                     <attribute name="js_class">hr_employee_profile_form</attribute>
                 </form>
                 <notebook position="replace">