From 6b87c731fb3daa4204c3679e9dfb2569902cbb55 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thibault=20Delavall=C3=A9e?= Date: Thu, 11 Aug 2016 10:49:16 +0200 Subject: [PATCH] [FIX] event: fix access right issues * Limitate rights of event user to reading an event Event user should not be able to create events. Its rights should be limited to reading events, creating and updating registrations. Only event managers are allowed to create and modify events. * Sudo access on ir.values in event config settings Configuring events imply modifying auto confirmation parameter which is stored into an ir.values. As this model is limited to values with user_id = uid we have to sudo the access here as it is not a user-defined value. * Add some tests for the various fixed issues --- addons/event/models/event_config_settings.py | 6 +++- addons/event/security/ir.model.access.csv | 9 +++--- addons/event/tests/common.py | 15 ++++++++- addons/event/tests/test_event_flow.py | 32 ++++++++++++++++++-- 4 files changed, 54 insertions(+), 8 deletions(-) diff --git a/addons/event/models/event_config_settings.py b/addons/event/models/event_config_settings.py index 786b7ee461c..92ec85ef4b4 100644 --- a/addons/event/models/event_config_settings.py +++ b/addons/event/models/event_config_settings.py @@ -37,4 +37,8 @@ class event_config_settings(models.TransientModel): @api.multi def set_default_auto_confirmation(self): - self.env['ir.values'].set_default('event.config.settings', 'auto_confirmation', self.auto_confirmation) + if self.env.user._is_admin() or self.env['res.users'].has_group('event.group_event_manager'): + IrValues = self.env['ir.values'].sudo() + else: + IrValues = self.env['ir.values'] + IrValues.set_default('event.config.settings', 'auto_confirmation', self.auto_confirmation) diff --git a/addons/event/security/ir.model.access.csv b/addons/event/security/ir.model.access.csv index 8801c173f17..ac13c583b55 100644 --- a/addons/event/security/ir.model.access.csv +++ b/addons/event/security/ir.model.access.csv @@ -1,12 +1,13 @@ id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink access_event_type,event.type,model_event_type,event.group_event_user,1,0,0,0 access_event_type_manager,event.type manager,model_event_type,event.group_event_manager,1,1,1,1 -access_event_event,event.event,model_event_event,event.group_event_user,1,1,1,1 +access_event_event_portal,event.event.portal,model_event_event,,1,0,0,0 +access_event_event_user,event.event.user,model_event_event,event.group_event_user,1,0,0,0 +access_event_event_manager,event.event.manager,model_event_event,event.group_event_manager,1,1,1,1 access_event_registration,event.registration,model_event_registration,event.group_event_user,1,1,1,1 -access_report_event_registration,report.event.registration,model_report_event_registration,event.group_event_user,1,1,1,1 -access_event_event_portal,event.event,model_event_event,,1,0,0,0 access_event_registration_portal,event.registration,model_event_registration,,1,0,0,0 access_event_mail,event.mail,model_event_mail,event.group_event_user,1,0,0,0 access_event_mail_manager,event.mail manager,model_event_mail,event.group_event_manager,1,1,1,1 access_event_mail_registration,event.mail.registration,model_event_mail_registration,event.group_event_user,1,0,0,0 -access_event_mail_registration_manager,event.mail.registration.manager,model_event_mail_registration,event.group_event_manager,1,1,1,1 \ No newline at end of file +access_event_mail_registration_manager,event.mail.registration.manager,model_event_mail_registration,event.group_event_manager,1,1,1,1 +access_report_event_registration,report.event.registration,model_report_event_registration,event.group_event_user,1,1,1,1 \ No newline at end of file diff --git a/addons/event/tests/common.py b/addons/event/tests/common.py index a1a3ec2f981..15ad898e565 100644 --- a/addons/event/tests/common.py +++ b/addons/event/tests/common.py @@ -1,5 +1,8 @@ # -*- coding: utf-8 -*- +from datetime import datetime, timedelta + +from odoo import fields from odoo.tests import common @@ -18,6 +21,7 @@ class TestEventCommon(common.TransactionCase): self.group_employee_id = self.env['ir.model.data'].xmlid_to_res_id('base.group_user') self.group_event_user_id = self.env['ir.model.data'].xmlid_to_res_id('event.group_event_user') self.group_event_manager_id = self.env['ir.model.data'].xmlid_to_res_id('event.group_event_manager') + group_system = self.env.ref('base.group_system') # Test users to use through the various tests self.user_eventuser = self.Users.with_context({'no_reset_password': True}).create({ @@ -34,5 +38,14 @@ class TestEventCommon(common.TransactionCase): 'alias_name': 'bastien', 'email': 'bastien.eventmanager@example.com', 'tz': 'Europe/Brussels', - 'groups_id': [(6, 0, [self.group_employee_id, self.group_event_manager_id])] + 'groups_id': [(6, 0, [ + self.group_employee_id, + self.group_event_manager_id, + group_system.id])] + }) + + self.event_0 = self.env['event.event'].create({ + 'name': 'TestEvent', + 'date_begin': fields.Datetime.to_string(datetime.today() - timedelta(days=5)), + 'date_end': fields.Datetime.to_string(datetime.today() + timedelta(days=5)), }) diff --git a/addons/event/tests/test_event_flow.py b/addons/event/tests/test_event_flow.py index d1ac9c51465..c35d03088df 100644 --- a/addons/event/tests/test_event_flow.py +++ b/addons/event/tests/test_event_flow.py @@ -4,7 +4,7 @@ import datetime from dateutil.relativedelta import relativedelta from odoo.addons.event.tests.common import TestEventCommon -from odoo.exceptions import ValidationError, UserError +from odoo.exceptions import ValidationError, UserError, AccessError from odoo.tools import mute_logger @@ -13,7 +13,10 @@ class TestEventFlow(TestEventCommon): @mute_logger('openerp.addons.base.ir.ir_model', 'openerp.models') def test_00_basic_event_auto_confirm(self): """ Basic event management with auto confirmation """ - self.env['ir.values'].set_default('event.config.settings', 'auto_confirmation', True) + event_config = self.env['event.config.settings'].sudo(self.user_eventmanager).create({ + 'auto_confirmation': 1 + }) + event_config.execute() # EventUser creates a new event: ok test_event = self.Event.sudo(self.user_eventmanager).create({ @@ -87,3 +90,28 @@ class TestEventFlow(TestEventCommon): self.assertEqual( test_reg1.state, 'draft', 'Event: new registration should not be confirmed with auto_confirmation parameter being False') + + def test_event_access_rights(self): + # EventManager required to create or update events + with self.assertRaises(AccessError): + self.Event.sudo(self.user_eventuser).create({ + 'name': 'TestEvent', + 'date_begin': datetime.datetime.now() + relativedelta(days=-1), + 'date_end': datetime.datetime.now() + relativedelta(days=1), + 'seats_max': 10, + }) + with self.assertRaises(AccessError): + self.event_0.sudo(self.user_eventuser).write({ + 'name': 'TestEvent Modified', + }) + + # Settings access rights required to enable some features + self.user_eventmanager.write({'groups_id': [ + (3, self.env.ref('base.group_system').id), + (4, self.env.ref('base.group_erp_manager').id) + ]}) + with self.assertRaises(AccessError): + event_config = self.env['event.config.settings'].sudo(self.user_eventmanager).create({ + 'auto_confirmation': 1 + }) + event_config.execute()