[ADD] *: add ir.model.access on all transient models

Following changes needing ir.model.access on transient models too.
Remove groups declaration on the action to move it to ir.model.access
when possible.
Rules are strict by default with no unlink access by default and high
priviledge asked. Adaptations may be needed later.
Write access is given as a wizard may need to be modified in case the
action triggers an error and the user has to correct a value

account*: use account.group_account_user for all transient by default
	  remove account.print.journal relic
stock*: use stock.group_stock_user by default
survey: survey user can send invitations
mail: allow any employee to execute wizards
      additional verifications are made to ensure they are executed
      only on the documents the user has access to you
      give portal access to mail.compose.message as portal still does
      some actions like posting messages on the forum
      add ir.rule to avoid reading somebody else messages
      increase the query count because of undeterminist count
crm: saleman for lead2opp, manager for massmailing
     partner manager for actions linked to partners
     avoid a write in test_lead_lost
sms: any employee can send sms
mrp: mrp user can execute wizards
     give unlink access as making write during do_produce operation
base_import: employees can import files
delivery: stock user can deliver
event_sale: sale user can configure the wizards
	    event user inherit from  sale rights
gamification: employee can give badge
google_service: resolve FIXME
hr: add specific rights
    manager can set a plan according to group on button
    anyone who can write on an employee can register a departure
hr_expense: set rights based on buttons
hr_holidays: an approver can make a summary report
hr_recruitment: recruiter can refuse a candidate
hr_timesheet: can use the wizard if can create a timesheet
l10n_eu_service: managers can create fiscal positions
mass_mailing: same group as on mass.mailing.list
membership: accountant can create invoice from membership
payment: accountant can create a link
	 as the source is an account.move
	 keep the payment.acquirer.onboarding.wizard to system user
	 only as it is called during company configuration
point_of_sale: PoS manager only can use wizards
	       never create closing_balance_confirm_wizard records
product_expiry: stock user has rights on stock.picking
product_margin: access from accounting menus
repair: same rules as for above models
sale: set ir.rule for self wizard only
      add rule from model introduced in payment to add salesman group
sale_crm: saleman can create a quotation from a lead
sale_coupon: any saleman can generate coupon
	     add self ir.rule
sale_product_configurator: salesman can select product variants
snailmail: employee can send letters
website: designers can write on website
website_crm_partner_assign: same rule as group on action
website_sale: sale ACL as for payment.acquirer.onboarding.wizard
website_slides: anyone can send invitation

base: base.language.*: allow employee (cf lang_install)
      change.password.user: can not read change password wizard of
      other users
      test.*: no access is needed

Courtesy of Damien Bouvy, William Andre and Antoine Prieëls for review
of acl

addons/account/security/ir.model.access.csv

@@ -123,3 +123,19 @@ access_account_payment_method_readonly,account.payment.method,model_account_paym
 access_account_payment_method,account.payment.method,model_account_payment_method,account.group_account_invoice,1,1,1,1
 access_account_payment_readonly,account.payment,model_account_payment,account.group_account_readonly,1,0,0,0
 access_account_payment,account.payment,model_account_payment,account.group_account_invoice,1,1,1,1
+
+access_account_payment_register,access.account.payment.register,model_account_payment_register,account.group_account_invoice,1,1,1,0
+access_account_bank_statement_closebalance,access.account.bank.statement.closebalance,model_account_bank_statement_closebalance,account.group_account_user,1,1,1,0
+access_account_accrual_accounting_wizard,access.account.accrual.accounting.wizard,model_account_accrual_accounting_wizard,account.group_account_user,1,1,1,0
+access_account_unreconcile,access.account.unreconcile,model_account_unreconcile,account.group_account_user,1,1,1,0
+access_validate_account_move,access.validate.account.move,model_validate_account_move,account.group_account_invoice,1,1,1,0
+access_cash_box_out,access.cash.box.out,model_cash_box_out,account.group_account_user,1,1,1,0
+access_account_move_reversal,access.account.move.reversal,model_account_move_reversal,account.group_account_invoice,1,1,1,0
+access_account_common_report,access.account.common.report,model_account_common_report,account.group_account_user,1,1,1,0
+access_account_common_journal_report,access.account.common.journal.report,model_account_common_journal_report,account.group_account_user,1,1,1,0
+access_account_print_journal,access.account.print.journal,model_account_print_journal,account.group_account_user,1,1,1,0
+access_account_financial_year_op,access.account.financial.year.op,model_account_financial_year_op,account.group_account_manager,1,1,1,0
+access_account_setup_bank_manual_config,access.account.setup.bank.manual.config,model_account_setup_bank_manual_config,account.group_account_user,1,1,1,0
+access_tax_adjustments_wizard,access.tax.adjustments.wizard,model_tax_adjustments_wizard,account.group_account_user,1,1,1,0
+access_account_invoice_send,access.account.invoice.send,model_account_invoice_send,account.group_account_invoice,1,1,1,0
+access_account_transfer_wizard,access.account.transfer.wizard,model_account_transfer_wizard,account.group_account_user,1,1,1,0

addons/account/wizard/account_invoice_send_views.xml

@@ -86,8 +86,7 @@
             context="{
                 'default_template_id': ref('account.email_template_edi_invoice'),
                 'mark_invoice_as_sent': True,
-            }"
-            groups="account.group_account_invoice"/>
+            }"/>
 
     </data>
 

addons/account_check_printing/__manifest__.py

@@ -13,6 +13,7 @@ The check settings are located in the accounting journals configuration page.
     """,
     'depends': ['account'],
     'data': [
+        'security/ir.model.access.csv',
         'data/account_check_printing_data.xml',
         'views/account_journal_views.xml',
         'views/account_payment_views.xml',

addons/account_check_printing/security/ir.model.access.csv

@@ -0,0 +1,2 @@
+"id","name","model_id:id","group_id:id","perm_read","perm_write","perm_create","perm_unlink"
+"access_print_prenumbered_checks","access.print.prenumbered.checks","model_print_prenumbered_checks","account.group_account_user",1,1,1,0

addons/base_gengo/__manifest__.py

@@ -16,6 +16,7 @@ This wizard will activate the CRON job and the Scheduler and will start the auto
     """,
     'depends': ['base_setup'],
     'data': [
+        'security/ir.model.access.csv',
         'data/ir_cron_data.xml',
         'views/ir_translation_views.xml',
         'views/res_config_settings_views.xml',

addons/base_gengo/security/ir.model.access.csv

@@ -0,0 +1,2 @@
+"id","name","model_id:id","group_id:id","perm_read","perm_write","perm_create","perm_unlink"
+"access_base_gengo_translations","access.base.gengo.translations","model_base_gengo_translations","base.group_system",1,1,1,0

addons/base_import/security/ir.model.access.csv

@@ -15,3 +15,4 @@ access_base_import_tests_models_float,base.import.tests.models.float,model_base_
 access_base_import_tests_models_preview,base.import.tests.models.preview,model_base_import_tests_models_preview,base.group_user,1,1,1,1
 access_base_import_mapping,base.import.mapping,model_base_import_mapping,base.group_user,1,1,1,1
 access_base_import_tests_models_complex,access_base_import_tests_models_complex,model_base_import_tests_models_complex,base.group_user,1,0,0,0
+access_base_import_import,access.base_import.import,model_base_import_import,base.group_user,1,1,1,0

addons/base_import_module/__manifest__.py

@@ -13,5 +13,8 @@ for customization purpose.
     'depends': ['web'],
     'installable': True,
     'auto_install': False,
-    'data': ['views/base_import_module_view.xml'],
+    'data': [
+        'security/ir.model.access.csv',
+        'views/base_import_module_view.xml'
+    ],
 }

addons/base_import_module/security/ir.model.access.csv

@@ -0,0 +1,2 @@
+"id","name","model_id:id","group_id:id","perm_read","perm_write","perm_create","perm_unlink"
+"access_base_import_module","access.base.import.module","model_base_import_module","base.group_system",1,1,1,0

addons/base_sparse_field/__manifest__.py

@@ -12,6 +12,7 @@
     'version': '1.0',
     'depends': ['base'],
     'data': [
+        'security/ir.model.access.csv',
         'views/views.xml',
     ],
 }

addons/base_sparse_field/security/ir.model.access.csv

@@ -0,0 +1,2 @@
+"id","name","model_id:id","group_id:id","perm_read","perm_write","perm_create","perm_unlink"
+"access_sparse_fields_test","access.sparse_fields.test","model_sparse_fields_test","base.group_system",1,1,1,0

addons/crm/security/ir.model.access.csv

@@ -23,3 +23,8 @@ access_calendar_event_type_sale_salesman,calendar.event.type.salesman,calendar.m
 access_mail_activity_type_sale_manager,mail.activity.type.sale.manager,mail.model_mail_activity_type,sales_team.group_sale_manager,1,1,1,1
 access_crm_lead_scoring_frequency,access_crm_lead_scoring_frequency,model_crm_lead_scoring_frequency,sales_team.group_sale_salesman,1,0,0,0
 access_crm_lead_scoring_frequency_field,access_crm_lead_scoring_frequency_field,model_crm_lead_scoring_frequency_field,sales_team.group_sale_salesman,1,0,0,0
+access_crm_lead_lost,access.crm.lead.lost,model_crm_lead_lost,sales_team.group_sale_salesman,1,1,1,0
+access_crm_partner_binding,access.crm.partner.binding,model_crm_partner_binding,base.group_partner_manager,1,1,1,0
+access_crm_lead2opportunity_partner,access.crm.lead2opportunity.partner,model_crm_lead2opportunity_partner,sales_team.group_sale_salesman,1,1,1,0
+access_crm_lead2opportunity_partner_mass,access.crm.lead2opportunity.partner.mass,model_crm_lead2opportunity_partner_mass,sales_team.group_sale_salesman,1,1,1,0
+access_crm_merge_opportunity,access.crm.merge.opportunity,model_crm_merge_opportunity,sales_team.group_sale_salesman,1,1,1,0

addons/crm/tests/test_crm_lead_lost.py

@@ -28,9 +28,10 @@ class TestLeadConvert(crm_common.TestCrmCommon):
 
         lost_wizard = self.env['crm.lead.lost'].with_context({
             'active_ids': lead.ids,
-        }).create({})
+        }).create({
+            'lost_reason_id': self.lost_reason.id
+        })
 
-        lost_wizard.write({'lost_reason_id': self.lost_reason.id})
         lost_wizard.action_lost_reason_apply()
 
         self.assertEqual(lead.probability, 0)
@@ -55,8 +56,9 @@ class TestLeadConvert(crm_common.TestCrmCommon):
 
         lost_wizard = self.env['crm.lead.lost'].with_context({
             'active_ids': lead.ids
-        }).create({})
-        lost_wizard.write({'lost_reason_id': lost_reason.id})
+        }).create({
+            'lost_reason_id': lost_reason.id
+        })
 
         # nice try little salesman, you cannot invoke a wizard to update other people leads
         with self.assertRaises(AccessError):

addons/crm/views/crm_lead_views.xml

@@ -751,7 +751,6 @@
                             'default_use_template': True,
                             'default_template_id': ref('crm.email_template_opportunity_mail'),
                         }"
-                groups="sales_team.group_sale_salesman"
                 />
 
         <!--Update of email_template defined in crm_lead_data, to add ref_ir_act_window

addons/crm/wizard/crm_lead_to_opportunity_mass_views.xml

@@ -58,6 +58,5 @@
         view_mode="form" target="new"
         context="{'mass_convert' : True}"
         view_id="view_crm_lead2opportunity_partner_mass"
-        groups="sales_team.group_sale_salesman"
     />
 </odoo>

addons/crm/wizard/crm_merge_opportunities_views.xml

@@ -40,7 +40,6 @@
             binding_model="crm.lead"
             binding_views="list"
             view_mode="form"
-            target="new"
-            groups="sales_team.group_sale_salesman" />
+            target="new" />
 
 </odoo>

addons/delivery/security/ir.model.access.csv

@@ -7,3 +7,5 @@ access_delivery_carrier_partner_manager,delivery.carrier partner_manager,model_d
 access_delivery_carrier_stock_user,delivery.carrier stock_user,model_delivery_carrier,stock.group_stock_user,1,0,0,0
 access_delivery_carrier_stock_manager,delivery.carrier,model_delivery_carrier,stock.group_stock_manager,1,1,1,1
 access_delivery_price_rule_stock_manager,delivery.price.rule,model_delivery_price_rule,stock.group_stock_manager,1,1,1,1
+access_choose_delivery_package,access.choose.delivery.package,model_choose_delivery_package,stock.group_stock_user,1,1,1,0
+access_choose_delivery_carrier,access.choose.delivery.carrier,model_choose_delivery_carrier,stock.group_stock_user,1,1,1,0

addons/event_sale/security/ir.model.access.csv

@@ -1,3 +1,6 @@
 id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink
 access_product_template_event_manager,product.template.event.manager,product.model_product_template,event.group_event_manager,1,1,1,1
 access_product_product_event_manager,product.product.event.manager,product.model_product_product,event.group_event_manager,1,1,1,1
+access_registration_editor,access.registration.editor,model_registration_editor,sales_team.group_sale_salesman,1,1,1,0
+access_registration_editor_line,access.registration.editor.line,model_registration_editor_line,sales_team.group_sale_salesman,1,1,1,1
+access_event_event_configurator,access.event.event.configurator,model_event_event_configurator,sales_team.group_sale_salesman,1,1,1,0

addons/gamification/security/ir.model.access.csv

@@ -30,3 +30,6 @@ gamification_karma_rank_access_all,gamification.karma.rank.access.all,gamificati
 gamification_karma_rank_access_user_manager,gamification.karma.rank.access.user.manager,gamification.model_gamification_karma_rank,base.group_system,1,1,1,1
 gamification_karma_tracking_access_all,gamification.karma.tracking.access.all,gamification.model_gamification_karma_tracking,,0,0,0,0
 gamification_karma_tracking_access_user_manager,gamification.karma.tracking.access.user.manager,gamification.model_gamification_karma_tracking,base.group_system,1,1,1,1
+
+access_gamification_goal_wizard,access.gamification.goal.wizard,model_gamification_goal_wizard,base.group_user,1,1,1,0
+access_gamification_badge_user_wizard,access.gamification.badge.user.wizard,model_gamification_badge_user_wizard,base.group_user,1,1,1,0

addons/google_account/models/google_service.py

@@ -22,8 +22,7 @@ GOOGLE_TOKEN_ENDPOINT = 'https://accounts.google.com/o/oauth2/token'
 GOOGLE_API_BASE_URL = 'https://www.googleapis.com'
 
 
-# FIXME : this needs to become an AbstractModel, to be inhereted by google_calendar_service and google_drive_service
-class GoogleService(models.TransientModel):
+class GoogleService(models.AbstractModel):
     _name = 'google.service'
     _description = 'Google Service'
 

addons/hr/security/ir.model.access.csv

@@ -13,3 +13,5 @@ access_hr_plan_activity_type_employee,access_hr_plan_activity_type,model_hr_plan
 access_hr_plan_employee,access_hr_plan_employee,model_hr_plan,base.group_user,1,0,0,0
 access_hr_plan_activity_type_hr_user,access_hr_plan_activity_type,model_hr_plan_activity_type,group_hr_user,1,1,1,1
 access_hr_plan_hr_user,access_hr_plan_hr_user,model_hr_plan,group_hr_user,1,1,1,1
+access_hr_plan_wizard,access.hr.plan.wizard,model_hr_plan_wizard,hr.group_hr_manager,1,1,1,0
+access_hr_departure_wizard,access.hr.departure.wizard,model_hr_departure_wizard,hr.group_hr_user,1,1,1,0

addons/hr_expense/security/ir.model.access.csv

@@ -16,3 +16,5 @@ access_account_move_user,account.move.user,account.model_account_move,hr_expense
 access_account_move_line_user,account.move.line.user,account.model_account_move_line,hr_expense.group_hr_expense_team_approver,1,0,0,0
 access_account_analytic_line_user,account.analytic.line.user,account.model_account_analytic_line,hr_expense.group_hr_expense_team_approver,1,1,1,1
 access_mail_activity_type_expense_user,mail.activity.type.expense.user,mail.model_mail_activity_type,hr_expense.group_hr_expense_manager,1,1,1,1
+access_hr_expense_refuse_wizard,access.hr.expense.refuse.wizard,model_hr_expense_refuse_wizard,hr_expense.group_hr_expense_team_approver,1,1,1,0
+access_hr_expense_sheet_register_payment_wizard,access.hr.expense.sheet.register.payment.wizard,model_hr_expense_sheet_register_payment_wizard,account.group_account_manager,1,1,1,0

addons/hr_holidays/security/ir.model.access.csv

@@ -14,3 +14,4 @@ access_calendar_event_hr_user,calendar.event.hr.user,calendar.model_calendar_eve
 access_calendar_event_type_manager,calendar.event.type.manager,calendar.model_calendar_event_type,hr_holidays.group_hr_holidays_manager,1,1,1,1
 access_calendar_attendee_hr_user,calendar.attendee.hr.user,calendar.model_calendar_attendee,hr_holidays.group_hr_holidays_user,1,1,1,1
 access_mail_activity_type_holidays_manager,mail.activity.type.holidays.manager,mail.model_mail_activity_type,hr_holidays.group_hr_holidays_manager,1,1,1,1
+access_hr_holidays_summary_employee,access.hr.holidays.summary.employee,model_hr_holidays_summary_employee,hr_holidays.group_hr_holidays_user,1,1,1,0

addons/hr_recruitment/security/ir.model.access.csv

@@ -11,3 +11,4 @@ access_hr_recruitment_source_all,hr.recruitment.source,model_hr_recruitment_sour
 access_hr_applicant_category,hr.applicant_category,model_hr_applicant_category,,1,1,1,0
 access_hr_applicant_category_manager,hr.applicant_category,model_hr_applicant_category,group_hr_recruitment_user,1,1,1,1
 access_calendar_event_type_hr_officer,calendar.event.type.officer,calendar.model_calendar_event_type,group_hr_recruitment_user,1,1,1,0
+access_applicant_get_refuse_reason,access.applicant.get.refuse.reason,model_applicant_get_refuse_reason,hr_recruitment.group_hr_recruitment_user,1,1,1,0

addons/hr_timesheet/security/ir.model.access.csv

@@ -4,3 +4,4 @@ access_account_analytic_user,analytic.account.analytic.timesheet.user,analytic.m
 access_uom_uom_hr_timesheet,uom.uom.timesheet.user,uom.model_uom_uom,hr_timesheet.group_hr_timesheet_user,1,0,0,0
 access_project_project,project.project.timesheet.user,model_project_project,hr_timesheet.group_hr_timesheet_user,1,0,0,0
 access_project_task,project.task.timesheet.user,model_project_task,hr_timesheet.group_hr_timesheet_user,1,1,0,0
+access_project_task_create_timesheet,access.project.task.create.timesheet,model_project_task_create_timesheet,hr_timesheet.group_hr_timesheet_user,1,1,1,0

addons/l10n_eu_service/security/ir.model.access.csv

@@ -1,3 +1,4 @@
 id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink
 access_l10n_eu_service_service_tax_rate_user,access_l10n_eu_service_service_tax_rate,model_l10n_eu_service_service_tax_rate,,1,0,0,0
 access_l10n_eu_service_service_tax_rate_manager,access_l10n_eu_service_service_tax_rate,model_l10n_eu_service_service_tax_rate,account.group_account_manager,1,1,1,1
+access_l10n_eu_service_wizard,access.l10n_eu_service.wizard,model_l10n_eu_service_wizard,account.group_account_manager,1,1,1,0

addons/mail/security/ir.model.access.csv

@@ -38,3 +38,10 @@ access_mail_activity_type_all,mail.activity.type.all,model_mail_activity_type,,0
 access_mail_activity_type_user,mail.activity.type.user,model_mail_activity_type,base.group_user,1,0,0,0
 access_mail_activity_type_system,mail.activity.type.system,model_mail_activity_type,base.group_system,1,1,1,1
 access_mail_blacklist_system,access_mail_blacklist_system,model_mail_blacklist,base.group_system,1,1,1,1
+access_mail_wizard_invite,access.mail.wizard.invite,model_mail_wizard_invite,base.group_user,1,1,1,0
+access_mail_compose_message,access.mail.compose.message,model_mail_compose_message,base.group_user,1,1,1,0
+access_mail_compose_message_portal,access.mail.compose.message.portal,model_mail_compose_message,base.group_portal,1,1,1,0
+access_mail_resend_cancel,access.mail.resend.cancel,model_mail_resend_cancel,base.group_user,1,1,1,0
+access_mail_resend_message,access.mail.resend.message,model_mail_resend_message,base.group_user,1,1,1,0
+access_mail_resend_partner,access.mail.resend.partner,model_mail_resend_partner,base.group_user,1,1,1,0
+access_mail_template_preview,access.mail.template.preview,model_mail_template_preview,base.group_user,1,1,1,0

addons/mail/security/mail_security.xml

@@ -47,5 +47,16 @@
             <field name="model_id" ref="model_mail_moderation"/>
             <field name="domain_force">[('channel_id.moderator_ids', 'in', user.id)]</field>
         </record>
+
+        <record id="mail_compose_message_rule" model="ir.rule">
+            <field name="name">Mail Compose Message Rule</field>
+            <field name="model_id" ref="model_mail_compose_message"/>
+            <field name="domain_force">[('create_uid', '=', user.id)]</field>
+            <field name="global" eval="True"/>
+            <field name="perm_create" eval="False"/>
+            <field name="perm_read" eval="True"/>
+            <field name="perm_write" eval="True"/>
+            <field name="perm_unlink" eval="False"/>
+        </record>
     </data>
 </odoo>

addons/mass_mailing/security/ir.model.access.csv

@@ -14,3 +14,6 @@ access_utm_source,access_utm_source,utm.model_utm_source,mass_mailing.group_mass
 access_ir_mail_server,access_ir_mail_server,base.model_ir_mail_server,mass_mailing.group_mass_mailing_user,1,0,0,0
 access_mail_blacklist_mass_mailing_user,access.mail.blacklist.mass_mailing_user,mail.model_mail_blacklist,mass_mailing.group_mass_mailing_user,1,1,1,1
 access_link_tracker_mailing,access.link.tracker.mailing,link_tracker.model_link_tracker,mass_mailing.group_mass_mailing_user,1,1,1,1
+access_mailing_list_merge,access.mailing.list.merge,model_mailing_list_merge,mass_mailing.group_mass_mailing_user,1,1,1,0
+access_mailing_mailing_schedule_date,access.mailing.mailing.schedule.date,model_mailing_mailing_schedule_date,mass_mailing.group_mass_mailing_user,1,1,1,0
+access_mailing_mailing_test,access.mailing.mailing.test,model_mailing_mailing_test,mass_mailing.group_mass_mailing_user,1,1,1,0

addons/mass_mailing_sms/security/ir.model.access.csv

@@ -1 +1,2 @@
-id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink
+id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink
+access_mailing_sms_test,access.mailing.sms.test,model_mailing_sms_test,mass_mailing.group_mass_mailing_user,1,1,1,0

addons/membership/security/ir.model.access.csv

@@ -2,3 +2,4 @@ id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink
 access_membership_membership_line_partner_manager,membership.membership_line partner_manager,model_membership_membership_line,base.group_partner_manager,1,1,1,1
 access_membership_membership_line,membership.membership_line,model_membership_membership_line,,1,0,0,0
 access_report_membership,report.membership,model_report_membership,base.group_partner_manager,1,0,0,0
+access_membership_invoice,access.membership.invoice,model_membership_invoice,account.group_account_user,1,1,1,0

addons/mrp/security/ir.model.access.csv

@@ -60,3 +60,7 @@ access_mrp_unbuild,mrp.unbuild,model_mrp_unbuild,group_mrp_user,1,1,1,1
 access_mrp_unbuild_manager,mrp.unbuild manager,model_mrp_unbuild,group_mrp_manager,1,1,1,1
 access_mrp_document_mrp_manager,mrp.document group_user,model_mrp_document,group_mrp_manager,1,1,1,1
 access_mrp_document_mrp_user,mrp.document group_user,model_mrp_document,group_mrp_user,1,1,1,1
+access_mrp_product_produce,access.mrp.product.produce,model_mrp_product_produce,mrp.group_mrp_user,1,1,1,0
+access_mrp_product_produce_line,access.mrp.product.produce.line,model_mrp_product_produce_line,mrp.group_mrp_user,1,1,1,1
+access_change_production_qty,access.change.production.qty,model_change_production_qty,mrp.group_mrp_user,1,1,1,0
+access_stock_warn_insufficient_qty_unbuild,access.stock.warn.insufficient.qty.unbuild,model_stock_warn_insufficient_qty_unbuild,mrp.group_mrp_user,1,1,1,0

addons/payment/security/ir.model.access.csv

@@ -10,4 +10,6 @@ payment_method_portal,payment.token.portal,model_payment_token,base.group_portal
 payment_method_system,payment.token.system,model_payment_token,base.group_system,1,1,1,1
 payment_icon_all,payment.icon.all,model_payment_icon,,1,0,0,0
 payment_icon_user,payment.icon.user,model_payment_icon,base.group_user,1,1,1,0
-payment_icon_system,payment.icon.system,model_payment_icon,base.group_system,1,1,1,1
+payment_icon_system,payment.icon.system,model_payment_icon,base.group_system,1,1,1,1
+access_payment_acquirer_onboarding_wizard,access.payment.acquirer.onboarding.wizard,model_payment_acquirer_onboarding_wizard,base.group_system,1,1,1,0
+access_payment_link_wizard,access.payment.link.wizard,model_payment_link_wizard,account.group_account_user,1,1,1,0

addons/point_of_sale/security/ir.model.access.csv

@@ -40,3 +40,6 @@ access_decimal_precision_user,decimal.precision,base.model_decimal_precision,gro
 access_pos_payment_user,pos.payment user,model_pos_payment,group_pos_user,1,1,1,1
 access_pos_payment_method_user,pos.payment.method user,model_pos_payment_method,group_pos_user,1,0,0,0
 access_pos_payment_method_manager,pos.payment.method manager,model_pos_payment_method,group_pos_manager,1,1,1,1
+access_closing_balance_confirm_wizard,access.closing.balance.confirm.wizard,model_closing_balance_confirm_wizard,point_of_sale.group_pos_manager,0,0,0,0
+access_pos_details_wizard,access.pos.details.wizard,model_pos_details_wizard,point_of_sale.group_pos_manager,1,1,1,0
+access_pos_make_payment,access.pos.make.payment,model_pos_make_payment,point_of_sale.group_pos_manager,1,1,1,0

addons/portal/__manifest__.py

@@ -17,6 +17,7 @@ of this module is to allow the display of a customer portal without having
 a dependency towards website edition and customization capabilities.""",
     'depends': ['web', 'web_editor', 'http_routing', 'mail', 'auth_signup'],
     'data': [
+        'security/ir.model.access.csv',
         'data/portal_data.xml',
         'views/assets.xml',
         'views/portal_templates.xml',

addons/portal/security/ir.model.access.csv

@@ -0,0 +1,4 @@
+"id","name","model_id:id","group_id:id","perm_read","perm_write","perm_create","perm_unlink"
+"access_portal_share","access.portal.share","model_portal_share","base.group_partner_manager",1,1,1,0
+"access_portal_wizard","access.portal.wizard","model_portal_wizard","base.group_partner_manager",1,1,1,0
+"access_portal_wizard_user","access.portal.wizard.user","model_portal_wizard_user","base.group_partner_manager",1,1,1,0

addons/portal/wizard/portal_wizard_views.xml

@@ -5,8 +5,7 @@
             name="Grant portal access"
             binding_model="res.partner"
             res_model="portal.wizard"
-            view_mode="form" target="new"
-            groups="base.group_partner_manager"/>
+            view_mode="form" target="new"/>
 
         <!-- wizard view -->
         <record id="wizard_view" model="ir.ui.view">

addons/product_expiry/__manifest__.py

@@ -17,7 +17,8 @@ Following dates can be tracked:
 
 Also implements the removal strategy First Expiry First Out (FEFO) widely used, for example, in food industries.
 """,
-    'data': ['views/production_lot_views.xml',
+    'data': ['security/ir.model.access.csv',
+             'views/production_lot_views.xml',
              'views/product_template_views.xml',
              'views/stock_move_views.xml',
              'views/stock_quant_views.xml',

addons/product_expiry/security/ir.model.access.csv

@@ -0,0 +1,2 @@
+"id","name","model_id:id","group_id:id","perm_read","perm_write","perm_create","perm_unlink"
+"access_expiry_picking_confirmation","access.expiry.picking.confirmation","model_expiry_picking_confirmation","stock.group_stock_user",1,1,1,0

addons/product_margin/security/ir.model.access.csv

@@ -1 +1,2 @@
-id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink
+id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink
+access_product_margin,access.product.margin,model_product_margin,account.group_account_user,1,1,1,0

addons/repair/security/ir.model.access.csv

@@ -5,3 +5,6 @@ access_repair_tag_user,Repair Tags user,model_repair_tags,stock.group_stock_user
 access_stock_production_lot_user,stock.production.lot user,stock.model_stock_production_lot,stock.group_stock_user,1,1,1,1
 access_repair_line_user,repair.line user,model_repair_line,stock.group_stock_user,1,1,1,1
 access_account_tax_user,account.tax,account.model_account_tax,stock.group_stock_user,1,1,1,1
+access_repair_cancel,access.repair.cancel,model_repair_cancel,stock.group_stock_user,1,1,1,0
+access_repair_order_make_invoice,access.repair.order.make_invoice,model_repair_order_make_invoice,stock.group_stock_user,1,1,1,0
+access_stock_warn_insufficient_qty_repair,access.stock.warn.insufficient.qty.repair,model_stock_warn_insufficient_qty_repair,stock.group_stock_user,1,1,1,0

addons/sale/security/ir.model.access.csv

@@ -55,3 +55,7 @@ access_account_tax_group_sale_manager,account.tax.group sale manager,account.mod
 access_account_account_sale_manager,account.account sale manager,account.model_account_account,sales_team.group_sale_manager,1,0,0,0
 access_mail_activity_type_sale_manager,mail.activity.type.sale.manager,mail.model_mail_activity_type,sales_team.group_sale_manager,1,1,1,1
 access_report_all_channels_sales,access_report_all_channels_sales,model_report_all_channels_sales,sales_team.group_sale_manager,1,0,0,0
+access_sale_payment_acquirer_onboarding_wizard,access.sale.payment.acquirer.onboarding.wizard,model_sale_payment_acquirer_onboarding_wizard,base.group_system,1,1,1,0
+access_sale_advance_payment_inv,access.sale.advance.payment.inv,model_sale_advance_payment_inv,sales_team.group_sale_salesman,1,1,1,0
+access_sale_order_cancel,access.sale.order.cancel,model_sale_order_cancel,sales_team.group_sale_salesman,1,1,1,0
+access_payment_link_wizard_sale,access.payment.link.wizard.sale,model_payment_link_wizard,sales_team.group_sale_salesman,1,1,1,0

addons/sale/security/sale_security.xml

@@ -187,5 +187,27 @@
         <field name="domain_force">[('move_id.type', 'in', ('out_invoice', 'out_refund', 'in_invoice', 'in_refund'))]</field>
         <field name="groups" eval="[(4, ref('sales_team.group_sale_salesman_all_leads'))]"/>
     </record>
+    
+    <!-- Wizard access rules -->
+    <record id="sale_payment_acquirer_onboarding_wizard_rule" model="ir.rule">
+        <field name="name">Payment Acquier Onboarding Wizard Rule</field>
+        <field name="model_id" ref="model_sale_payment_acquirer_onboarding_wizard"/>
+        <field name="global" eval="True"/>
+        <field name="domain_force">[('create_uid', '=', user.id)]</field>
+    </record>
+
+    <record id="sale_advance_payment_inv_rule" model="ir.rule">
+        <field name="name">Sales Advance Payment Invoice Rule</field>
+        <field name="model_id" ref="model_sale_advance_payment_inv"/>
+        <field name="global" eval="True"/>
+        <field name="domain_force">[('create_uid', '=', user.id)]</field>
+    </record>
+
+    <record id="sale_order_cancel_rule" model="ir.rule">
+        <field name="name">Sales Order Cancel Rule</field>
+        <field name="model_id" ref="model_sale_order_cancel"/>
+        <field name="global" eval="True"/>
+        <field name="domain_force">[('create_uid', '=', user.id)]</field>
+    </record>
 </data>
 </odoo>

addons/sale/wizard/sale_make_invoice_advance_views.xml

@@ -56,7 +56,6 @@
             <field name="res_model">sale.advance.payment.inv</field>
             <field name="view_mode">form</field>
             <field name="target">new</field>
-            <field name="groups_id" eval="[(4,ref('sales_team.group_sale_salesman'))]"/>
             <!-- TODO: check if we need this -->
             <field name="binding_model_id" ref="sale.model_sale_order" />
             <field name="binding_view_types">list</field>

addons/sale_coupon/__manifest__.py

@@ -8,6 +8,7 @@
     'version': '1.0',
     'depends': ['sale_management'],
     'data': [
+        'security/sale_coupon_security.xml',
         'security/ir.model.access.csv',
         'wizard/sale_coupon_apply_code_views.xml',
         'wizard/sale_coupon_generate_views.xml',

addons/sale_coupon/security/ir.model.access.csv

@@ -7,3 +7,5 @@ access_coupon_salesman,salesman,model_sale_coupon,sales_team.group_sale_salesman
 access_coupon_manager,program manager,model_sale_coupon,sales_team.group_sale_manager,1,1,1,0
 access_reward_salesman,salesman,model_sale_coupon_reward,sales_team.group_sale_salesman,1,0,0,0
 access_reward_manager,program manager,model_sale_coupon_reward,sales_team.group_sale_manager,1,1,1,0
+access_sale_coupon_apply_code,access.sale.coupon.apply.code,model_sale_coupon_apply_code,sales_team.group_sale_salesman,1,1,1,0
+access_sale_coupon_generate,access.sale.coupon.generate,model_sale_coupon_generate,sales_team.group_sale_salesman,1,1,1,0

addons/sale_coupon/security/sale_coupon_security.xml

@@ -0,0 +1,19 @@
+<?xml version="1.0" encoding="utf-8"?>
+<odoo>
+<data noupdate="1">
+
+    <record id="sale_coupon_apply_code_rule" model="ir.rule">
+        <field name="name">Sale Coupon Apply Code Rule</field>
+        <field name="model_id" ref="model_sale_coupon_apply_code"/>
+        <field name="global" eval="True"/>
+        <field name="domain_force">[('create_uid', '=', user.id)]</field>
+    </record>
+    <record id="sale_coupon_generate_rule" model="ir.rule">
+        <field name="name">Generate Sales Coupon Rule</field>
+        <field name="model_id" ref="model_sale_coupon_generate"/>
+        <field name="global" eval="True"/>
+        <field name="domain_force">[('create_uid', '=', user.id)]</field>
+    </record>
+
+</data>
+</odoo>

addons/sale_crm/security/ir.model.access.csv

@@ -1,2 +1,2 @@
-id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink
-
+id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink
+access_crm_quotation_partner,access.crm.quotation.partner,model_crm_quotation_partner,sales_team.group_sale_salesman,1,1,1,0

addons/sale_product_configurator/__manifest__.py

@@ -15,6 +15,7 @@ It also enables the "optional products" feature.
 
     'depends': ['sale'],
     'data': [
+        'security/ir.model.access.csv',
         'views/assets.xml',
         'views/templates.xml',
         'views/sale_views.xml',

addons/sale_product_configurator/security/ir.model.access.csv

@@ -0,0 +1,2 @@
+"id","name","model_id:id","group_id:id","perm_read","perm_write","perm_create","perm_unlink"
+"access_sale_product_configurator","access.sale.product.configurator","model_sale_product_configurator","sales_team.group_sale_salesman",1,1,1,0

addons/sale_timesheet/security/ir.model.access.csv

@@ -2,3 +2,7 @@ id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink
 access_project_profitability_report_analysis_manager,project.profitability.report.analysis,model_project_profitability_report,project.group_project_manager,1,1,1,1
 access_project_sale_line_employee_map,access_project_sale_line_employee_map,model_project_sale_line_employee_map,base.group_user,1,0,0,0
 access_project_sale_line_employee_map_manager,access_project_sale_line_employee_map_project_manager,model_project_sale_line_employee_map,project.group_project_manager,1,1,1,1
+access_project_create_sale_order,access.project.create.sale.order,model_project_create_sale_order,sales_team.group_sale_salesman,1,1,1,0
+access_project_create_sale_order_line,access.project.create.sale.order.line,model_project_create_sale_order_line,sales_team.group_sale_salesman,1,1,1,0
+access_project_create_invoice,access.project.create.invoice,model_project_create_invoice,sales_team.group_sale_salesman_all_leads,1,1,1,0
+access_project_task_create_sale_order,access.project.task.create.sale.order,model_project_task_create_sale_order,sales_team.group_sale_salesman,1,1,1,0

addons/sale_timesheet/wizard/project_create_invoice_views.xml

@@ -26,7 +26,6 @@
         <field name="view_mode">form</field>
         <field name="view_id" ref="project_create_invoice_view_form"/>
         <field name="target">new</field>
-        <field name="groups_id" eval="[(4, ref('sales_team.group_sale_salesman_all_leads'))]"/>
     </record>
 
 </odoo>

addons/sale_timesheet/wizard/project_create_sale_order_views.xml

@@ -49,7 +49,6 @@
         <field name="view_mode">form</field>
         <field name="view_id" ref="project_create_sale_order_view_form"/>
         <field name="target">new</field>
-        <field name="groups_id" eval="[(4, ref('sales_team.group_sale_salesman'))]"/>
     </record>
 
 </odoo>

addons/sale_timesheet/wizard/project_task_create_sale_order_views.xml

@@ -31,7 +31,6 @@
         <field name="view_mode">form</field>
         <field name="view_id" ref="project_task_create_sale_order_view_form"/>
         <field name="target">new</field>
-        <field name="groups_id" eval="[(4, ref('sales_team.group_sale_salesman'))]"/>
     </record>
 
 </odoo>

addons/sms/security/ir.model.access.csv

@@ -4,3 +4,8 @@ access_sms_sms_system,access.sms.sms.system,model_sms_sms,base.group_system,1,1,
 access_sms_template_all,access.sms.template.all,model_sms_template,,0,0,0,0
 access_sms_template_user,access.sms.template.user,model_sms_template,base.group_user,1,0,0,0
 access_sms_template_system,access.sms.template.system,model_sms_template,base.group_system,1,1,1,1
+access_sms_cancel,access.sms.cancel,model_sms_cancel,base.group_user,1,1,1,0
+access_sms_composer,access.sms.composer,model_sms_composer,base.group_user,1,1,1,0
+access_sms_resend_recipient,access.sms.resend.recipient,model_sms_resend_recipient,base.group_user,1,1,1,0
+access_sms_resend,access.sms.resend,model_sms_resend,base.group_user,1,1,1,0
+access_sms_template_preview,access.sms.template.preview,model_sms_template_preview,base.group_user,1,1,1,0

addons/snailmail/security/ir.model.access.csv

@@ -2,4 +2,7 @@ id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink
 access_snailmail_letter_all,snailmail.letter.all,model_snailmail_letter,,1,0,0,0
 access_snailmail_letter_portal,snailmail.letter.portal,model_snailmail_letter,base.group_portal,1,0,1,0
 access_snailmail_letter_user,snailmail.letter.user,model_snailmail_letter,base.group_user,1,1,1,0
-access_snailmail_letter_system,snailmail.letter.system,model_snailmail_letter,base.group_system,1,1,1,1
+access_snailmail_letter_system,snailmail.letter.system,model_snailmail_letter,base.group_system,1,1,1,1
+access_snailmail_letter_cancel,access.snailmail.letter.cancel,model_snailmail_letter_cancel,base.group_user,1,1,1,0
+access_snailmail_letter_format_error,access.snailmail.letter.format.error,model_snailmail_letter_format_error,base.group_user,1,1,1,0
+access_snailmail_letter_missing_required_fields,access.snailmail.letter.missing.required.fields,model_snailmail_letter_missing_required_fields,base.group_user,1,1,1,0

addons/stock/security/ir.model.access.csv

@@ -72,3 +72,20 @@ access_product_product_attribute_manager,product.product.attribute manager value
 access_product_template_attribute_exclusion_manager,product.attribute manager filter line,product.model_product_template_attribute_exclusion,stock.group_stock_manager,1,1,1,1
 access_product_template_attribute_line_manager,product.attribute manager line,product.model_product_template_attribute_line,stock.group_stock_manager,1,1,1,1
 access_report_stock_quantity,access_report_stock_quantity,model_report_stock_quantity,base.group_user,1,0,0,0
+access_stock_traceability_report,access.stock.traceability.report,model_stock_traceability_report,stock.group_stock_user,1,1,1,0
+access_stock_assign_serial,access.stock.assign.serial,model_stock_assign_serial,stock.group_stock_user,1,1,1,0
+access_stock_return_picking_line,access.stock.return.picking.line,model_stock_return_picking_line,stock.group_stock_user,1,1,1,0
+access_stock_return_picking,access.stock.return.picking,model_stock_return_picking,stock.group_stock_user,1,1,1,0
+access_stock_change_product_qty,access.stock.change.product.qty,model_stock_change_product_qty,stock.group_stock_user,1,1,1,0
+access_stock_scheduler_compute,access.stock.scheduler.compute,model_stock_scheduler_compute,stock.group_stock_user,1,1,1,0
+access_stock_immediate_transfer_line,access.stock.immediate.transfer.line,model_stock_immediate_transfer_line,stock.group_stock_user,1,1,1,0
+access_stock_immediate_transfer,access.stock.immediate.transfer,model_stock_immediate_transfer,stock.group_stock_user,1,1,1,0
+access_stock_backorder_confirmation_line,access.stock.backorder.confirmation.line,model_stock_backorder_confirmation_line,stock.group_stock_user,1,1,1,0
+access_stock_backorder_confirmation,access.stock.backorder.confirmation,model_stock_backorder_confirmation,stock.group_stock_user,1,1,1,0
+access_stock_quantity_history,access.stock.quantity.history,model_stock_quantity_history,stock.group_stock_user,1,1,1,0
+access_stock_rules_report,access.stock.rules.report,model_stock_rules_report,stock.group_stock_user,1,1,1,0
+access_stock_warn_insufficient_qty_scrap,access.stock.warn.insufficient.qty.scrap,model_stock_warn_insufficient_qty_scrap,stock.group_stock_user,1,1,1,0
+access_product_replenish,access.product.replenish,model_product_replenish,stock.group_stock_user,1,1,1,0
+access_stock_track_confirmation,access.stock.track.confirmation,model_stock_track_confirmation,stock.group_stock_user,1,1,1,0
+access_stock_track_line,access.stock.track.line,model_stock_track_line,stock.group_stock_user,1,1,1,0
+access_stock_package_destination,access.stock.package.destination,model_stock_package_destination,stock.group_stock_user,1,1,1,0

addons/stock_picking_batch/security/ir.model.access.csv

@@ -1,2 +1,3 @@
 id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink
 access_stock_picking_batch,stock.picking.batch stock users,model_stock_picking_batch,stock.group_stock_user,1,1,1,1
+access_stock_picking_to_batch,access.stock.picking.to.batch,model_stock_picking_to_batch,stock.group_stock_user,1,1,1,0

addons/stock_sms/security/ir.model.access.csv

@@ -1,2 +1,3 @@
 id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink
 access_sms_template_stock_manager,access.sms.template.stock.manager,sms.model_sms_template,stock.group_stock_manager,1,1,1,1
+access_confirm_stock_sms,access.confirm.stock.sms,model_confirm_stock_sms,stock.group_stock_user,1,1,1,0

addons/survey/security/ir.model.access.csv

@@ -20,3 +20,4 @@ access_survey_user_input_line_user,survey.user_input.line.user,model_survey_user
 access_survey_user_input_line_survey_user,survey.user_input.line.survey.user,model_survey_user_input_line,group_survey_user,1,1,1,1
 access_survey_user_input_line_survey_manager,survey.user_input.line.survey.manager,model_survey_user_input_line,group_survey_manager,1,1,1,1
 access_gamification_badge_survey_user,gamification.badge.survey.user,model_gamification_badge,group_survey_user,1,1,1,1
+access_survey_invite,access.survey.invite,model_survey_invite,survey.group_survey_user,1,1,1,0

addons/test_mail/tests/test_performance.py

@@ -277,8 +277,8 @@ class TestMailAPIPerformance(BaseMailPerformance):
     def test_mail_composer_w_template(self):
         test_record = self.env['mail.test.full'].browse(self.test_record_full.id)
         test_template = self.env['mail.template'].browse(self.test_template_full.id)
-        # TODO XDO/TDE FIXME non deterministic between 25 and 28 queries
-        with self.assertQueryCount(__system__=28, emp=28):
+        # TODO XDO/TDE/MAT FIXME non deterministic between 25 and 29 queries
+        with self.assertQueryCount(__system__=28, emp=29):
             composer = self.env['mail.compose.message'].with_context({
                 'default_composition_mode': 'comment',
                 'default_model': test_record._name,
@@ -489,7 +489,7 @@ class TestMailComplexPerformance(BaseMailPerformance):
         record = self.umbrella.with_user(self.env.user)
         template_id = self.env.ref('test_mail.mail_test_tpl').id
 
-        with self.assertQueryCount(__system__=84, emp=85):
+        with self.assertQueryCount(__system__=84, emp=86):
             record.message_post_with_template(template_id, message_type='comment', composition_mode='comment')
 
         self.assertEqual(record.message_ids[0].body, '<p>Adding stuff on %s</p>' % record.name)
@@ -680,7 +680,7 @@ class TestMailComplexPerformance(BaseMailPerformance):
         rec1 = rec.with_context(active_test=False)      # to see inactive records
         self.assertEqual(rec1.message_partner_ids, self.partners | self.env.user.partner_id | self.user_portal.partner_id)
 
-        with self.assertQueryCount(__system__=34, emp=35):
+        with self.assertQueryCount(__system__=34, emp=36):
             rec.write({
                 'name': 'Test2',
                 'customer_id': customer_id,

addons/website/security/ir.model.access.csv

@@ -21,3 +21,4 @@ access_theme_ir_ui_view,access_theme_ir_ui_view,model_theme_ir_ui_view,base.grou
 access_theme_ir_attachment,access_theme_ir_attachment,model_theme_ir_attachment,base.group_system,1,1,1,1
 access_theme_website_menu,access_theme_website_menu,model_theme_website_menu,base.group_system,1,1,1,1
 access_theme_website_page,access_theme_website_page,model_theme_website_page,base.group_system,1,1,1,1
+access_website_robots,access.website.robots,model_website_robots,website.group_website_designer,1,1,1,0

addons/website_crm_partner_assign/security/ir.model.access.csv

@@ -10,3 +10,5 @@ access_partner_activation_manager,res.partner.activation.manager,model_res_partn
 partner_access_crm_lead,crm.lead,crm.model_crm_lead,base.group_portal,1,1,0,0
 access_res_partner_grade_invoicing_payment_readonly,res.partner.grade,model_res_partner_grade,account.group_account_readonly,1,0,0,0
 access_res_partner_grade_invoicing_payment,res.partner.grade,model_res_partner_grade,account.group_account_invoice,1,0,0,0
+access_crm_lead_forward_to_partner,access.crm.lead.forward.to.partner,model_crm_lead_forward_to_partner,sales_team.group_sale_manager,1,1,1,0
+access_crm_lead_assignation,access.crm.lead.assignation,model_crm_lead_assignation,sales_team.group_sale_manager,1,1,1,0

addons/website_crm_partner_assign/wizard/crm_forward_to_partner_view.xml

@@ -48,7 +48,6 @@
             name="Forward to partner" res_model="crm.lead.forward.to.partner"
             binding_model="crm.lead"
             view_mode="form" target="new"
-            groups="sales_team.group_sale_manager"
             context="{'default_composition_mode' : 'mass_mail'}" view_id="crm_lead_forward_to_partner_form" />
 
 </odoo>

addons/website_sale/security/ir.model.access.csv

@@ -21,3 +21,4 @@ access_account_tax_user,account.tax,account.model_account_tax,base.group_public,
 access_product_image_public,product.image public,model_product_image,,1,0,0,0
 access_product_image_publisher,product.image wbesite publisher,model_product_image,website.group_website_publisher,1,1,1,1
 access_product_image_sale,product.image sale,model_product_image,sales_team.group_sale_manager,1,1,1,1
+access_website_sale_payment_acquirer_onboarding_wizard,access.website.sale.payment.acquirer.onboarding.wizard,model_website_sale_payment_acquirer_onboarding_wizard,base.group_system,1,1,1,0

addons/website_slides/security/ir.model.access.csv

@@ -26,3 +26,4 @@ access_slide_slide_link_officer,slide.slide.link.officer,model_slide_slide_link,
 access_slide_slide_resource_all,slide.slide.resource.all,model_slide_slide_resource,,1,0,0,0
 access_slide_slide_resource_public,slide.slide.resource.public,model_slide_slide_resource,base.group_public,0,0,0,0
 access_slide_slide_resource_publisher,slide.slide.resource.publisher,model_slide_slide_resource,website_slides.group_website_slides_officer,1,1,1,1
+access_slide_channel_invite,access.slide.channel.invite,model_slide_channel_invite,base.group_user,1,1,1,0

odoo/addons/base/security/base_security.xml

@@ -68,6 +68,12 @@
             <field name="domain_force">['|',('company_id','=',False),('company_id', 'in', company_ids)]</field>
         </record>
 
+        <record id="change_password_rule" model="ir.rule">
+            <field name="name">change user password rule</field>
+            <field name="model_id" ref="model_change_password_user"/>
+            <field name="domain_force">[('create_uid', '=', user.id)]</field>
+        </record>
+
         <!-- Security restriction for private addresses -->
         <record id="res_partner_rule_private_employee" model="ir.rule">
             <field name="name">res.partner.rule.private.employee</field>

odoo/addons/base/security/ir.model.access.csv

@@ -99,3 +99,23 @@
 "paperformat_access_portal","ir_actions_report_paperformat group_portal","model_report_paperformat",,1,0,0,0
 "paperformat_access_employee","ir_actions_report_paperformat group_system","model_report_paperformat",group_system,1,1,1,1
 "access_report_layout","access_report_layout","model_report_layout",,1,1,1,1
+"access_wizard_ir_model_menu_create","access.wizard.ir.model.menu.create","model_wizard_ir_model_menu_create","base.group_system",1,1,1,0
+"access_reset_view_arch_wizard","access.reset.view.arch.wizard","model_reset_view_arch_wizard","base.group_erp_manager",1,1,1,0
+"access_ir_demo","access.ir.demo","model_ir_demo","base.group_system",1,1,1,0
+"access_ir_demo_failure","access.ir.demo_failure","model_ir_demo_failure","base.group_system",1,1,1,0
+"access_ir_demo_failure_wizard","access.ir.demo_failure.wizard","model_ir_demo_failure_wizard","base.group_system",1,1,1,0
+"access_res_config","access.res.config","model_res_config","base.group_system",1,1,1,0
+"access_res_config_installer","access.res.config.installer","model_res_config_installer","base.group_system",1,1,1,0
+"access_res_config_settings","access.res.config.settings","model_res_config_settings","base.group_system",1,1,1,0
+"access_change_password_wizard","access.change.password.wizard","model_change_password_wizard","base.group_erp_manager",1,1,1,0
+"access_change_password_user","access.change.password.user","model_change_password_user","base.group_system",1,1,1,0
+"access_base_module_update","access.base.module.update","model_base_module_update","base.group_system",1,1,1,0
+"access_base_language_install","access.base.language.install","model_base_language_install","base.group_system",1,1,1,0
+"access_base_language_import","access.base.language.import","model_base_language_import","base.group_system",1,1,1,0
+"access_base_module_upgrade","access.base.module.upgrade","model_base_module_upgrade","base.group_system",1,1,1,0
+"access_base_module_uninstall","access.base.module.uninstall","model_base_module_uninstall","base.group_system",1,1,1,0
+"access_base_language_export","access.base.language.export","model_base_language_export","base.group_user",1,1,1,0
+"access_base_update_translations","access.base.update.translations","model_base_update_translations","base.group_system",1,1,1,0
+"access_base_partner_merge_line","access.base.partner.merge.line","model_base_partner_merge_line","base.group_system",1,1,1,0
+"access_base_partner_merge_automatic_wizard","access.base.partner.merge.automatic.wizard","model_base_partner_merge_automatic_wizard","base.group_system",1,1,1,0
+"access_base_document_layout","access.base.document.layout","model_base_document_layout","base.group_system",1,1,1,0

odoo/addons/base/views/ir_ui_view_views.xml

@@ -129,8 +129,7 @@
             binding_model="ir.ui.view" binding_views="form"
             res_model="reset.view.arch.wizard"
             view_mode="form"
-            target="new"
-            groups="base.group_erp_manager"/>
+            target="new"/>
 
         <!-- View customizations -->
         <record id="view_view_custom_form" model="ir.ui.view">

odoo/addons/base/views/res_users_views.xml

@@ -31,8 +31,7 @@
             name="Change Password"
             binding_model="res.users"
             res_model="change.password.wizard"
-            view_mode="form" target="new"
-            groups="base.group_erp_manager"/>
+            view_mode="form" target="new"/>
 
         <!-- res.groups -->
         <record id="view_groups_search" model="ir.ui.view">

odoo/addons/test_new_api/security/ir.model.access.csv

@@ -48,3 +48,4 @@ access_test_new_api_model_binary,access_test_new_api_model_binary,model_test_new
 access_test_new_api_model_child_m2o,access_test_new_api_model_child_m2o,model_test_new_api_model_child_m2o,,1,1,1,1
 access_test_new_api_model_parent_m2o,access_test_new_api_model_parent_m2o,model_test_new_api_model_parent_m2o,,1,1,1,1
 access_test_new_api_model_private_address_onchange,access_test_new_api_model_private_address_onchange,model_test_new_api_model_private_address_onchange,base.group_user,1,1,1,1
+access_test_new_api_req_m2o_transient,access_test_new_api_req_m2o_transient,model_test_new_api_req_m2o_transient,,0,0,0,0

odoo/addons/test_translation_import/__manifest__.py

@@ -5,7 +5,10 @@
     'category': 'Tests',
     'description': """A module to test translation import.""",
     'depends': ['base'],
-    'data': ['view.xml'],
+    'data': [
+        'security/ir.model.access.csv',
+        'view.xml'
+    ],
     'installable': True,
     'auto_install': False,
 }

odoo/addons/test_translation_import/security/ir.model.access.csv

@@ -0,0 +1,2 @@
+"id","name","model_id:id","group_id:id","perm_read","perm_write","perm_create","perm_unlink"
+"access_test_translation_import","access.test.translation.import","model_test_translation_import",,0,0,0,0