[FIX] event: fix access right issues

* Limitate rights of event user to reading an event

Event user should not be able to create events. Its rights should be limited
to reading events, creating and updating registrations. Only event managers
are allowed to create and modify events.

* Sudo access on ir.values in event config settings

Configuring events imply modifying auto confirmation parameter which is stored
into an ir.values. As this model is limited to values with user_id = uid we
have to sudo the access here as it is not a user-defined value.

* Add some tests for the various fixed issues

addons/event/models/event_config_settings.py

@@ -37,4 +37,8 @@ class event_config_settings(models.TransientModel):
 
     @api.multi
     def set_default_auto_confirmation(self):
-        self.env['ir.values'].set_default('event.config.settings', 'auto_confirmation', self.auto_confirmation)
+        if self.env.user._is_admin() or self.env['res.users'].has_group('event.group_event_manager'):
+            IrValues = self.env['ir.values'].sudo()
+        else:
+            IrValues = self.env['ir.values']
+        IrValues.set_default('event.config.settings', 'auto_confirmation', self.auto_confirmation)

addons/event/security/ir.model.access.csv

@@ -1,12 +1,13 @@
 id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink
 access_event_type,event.type,model_event_type,event.group_event_user,1,0,0,0
 access_event_type_manager,event.type manager,model_event_type,event.group_event_manager,1,1,1,1
-access_event_event,event.event,model_event_event,event.group_event_user,1,1,1,1
+access_event_event_portal,event.event.portal,model_event_event,,1,0,0,0
+access_event_event_user,event.event.user,model_event_event,event.group_event_user,1,0,0,0
+access_event_event_manager,event.event.manager,model_event_event,event.group_event_manager,1,1,1,1
 access_event_registration,event.registration,model_event_registration,event.group_event_user,1,1,1,1
-access_report_event_registration,report.event.registration,model_report_event_registration,event.group_event_user,1,1,1,1
-access_event_event_portal,event.event,model_event_event,,1,0,0,0
 access_event_registration_portal,event.registration,model_event_registration,,1,0,0,0
 access_event_mail,event.mail,model_event_mail,event.group_event_user,1,0,0,0
 access_event_mail_manager,event.mail manager,model_event_mail,event.group_event_manager,1,1,1,1
 access_event_mail_registration,event.mail.registration,model_event_mail_registration,event.group_event_user,1,0,0,0
-access_event_mail_registration_manager,event.mail.registration.manager,model_event_mail_registration,event.group_event_manager,1,1,1,1
+access_event_mail_registration_manager,event.mail.registration.manager,model_event_mail_registration,event.group_event_manager,1,1,1,1
+access_report_event_registration,report.event.registration,model_report_event_registration,event.group_event_user,1,1,1,1

addons/event/tests/common.py

@@ -1,5 +1,8 @@
 # -*- coding: utf-8 -*-
 
+from datetime import datetime, timedelta
+
+from odoo import fields
 from odoo.tests import common
 
 
@@ -18,6 +21,7 @@ class TestEventCommon(common.TransactionCase):
         self.group_employee_id = self.env['ir.model.data'].xmlid_to_res_id('base.group_user')
         self.group_event_user_id = self.env['ir.model.data'].xmlid_to_res_id('event.group_event_user')
         self.group_event_manager_id = self.env['ir.model.data'].xmlid_to_res_id('event.group_event_manager')
+        group_system = self.env.ref('base.group_system')
 
         # Test users to use through the various tests
         self.user_eventuser = self.Users.with_context({'no_reset_password': True}).create({
@@ -34,5 +38,14 @@ class TestEventCommon(common.TransactionCase):
             'alias_name': 'bastien',
             'email': 'bastien.eventmanager@example.com',
             'tz': 'Europe/Brussels',
-            'groups_id': [(6, 0, [self.group_employee_id, self.group_event_manager_id])]
+            'groups_id': [(6, 0, [
+                self.group_employee_id,
+                self.group_event_manager_id,
+                group_system.id])]
+        })
+
+        self.event_0 = self.env['event.event'].create({
+            'name': 'TestEvent',
+            'date_begin': fields.Datetime.to_string(datetime.today() - timedelta(days=5)),
+            'date_end': fields.Datetime.to_string(datetime.today() + timedelta(days=5)),
         })

addons/event/tests/test_event_flow.py

@@ -4,7 +4,7 @@ import datetime
 from dateutil.relativedelta import relativedelta
 
 from odoo.addons.event.tests.common import TestEventCommon
-from odoo.exceptions import ValidationError, UserError
+from odoo.exceptions import ValidationError, UserError, AccessError
 from odoo.tools import mute_logger
 
 
@@ -13,7 +13,10 @@ class TestEventFlow(TestEventCommon):
     @mute_logger('openerp.addons.base.ir.ir_model', 'openerp.models')
     def test_00_basic_event_auto_confirm(self):
         """ Basic event management with auto confirmation """
-        self.env['ir.values'].set_default('event.config.settings', 'auto_confirmation', True)
+        event_config = self.env['event.config.settings'].sudo(self.user_eventmanager).create({
+            'auto_confirmation': 1
+        })
+        event_config.execute()
 
         # EventUser creates a new event: ok
         test_event = self.Event.sudo(self.user_eventmanager).create({
@@ -87,3 +90,28 @@ class TestEventFlow(TestEventCommon):
         self.assertEqual(
             test_reg1.state, 'draft',
             'Event: new registration should not be confirmed with auto_confirmation parameter being False')
+
+    def test_event_access_rights(self):
+        # EventManager required to create or update events
+        with self.assertRaises(AccessError):
+            self.Event.sudo(self.user_eventuser).create({
+                'name': 'TestEvent',
+                'date_begin': datetime.datetime.now() + relativedelta(days=-1),
+                'date_end': datetime.datetime.now() + relativedelta(days=1),
+                'seats_max': 10,
+            })
+        with self.assertRaises(AccessError):
+            self.event_0.sudo(self.user_eventuser).write({
+                'name': 'TestEvent Modified',
+            })
+
+        # Settings access rights required to enable some features
+        self.user_eventmanager.write({'groups_id': [
+            (3, self.env.ref('base.group_system').id),
+            (4, self.env.ref('base.group_erp_manager').id)
+        ]})
+        with self.assertRaises(AccessError):
+            event_config = self.env['event.config.settings'].sudo(self.user_eventmanager).create({
+                'auto_confirmation': 1
+            })
+            event_config.execute()