pengyuthon/odoo_source
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[FIX] mail: restrict write access rights of portal users to their own follower and notification entries

Browse Source
This commit is contained in:
Thibault Delavallée
2016-09-14 16:45:01 +02:00
parent 9c9ac8c43a
commit 6e2a455947
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
addons/mail/security/mail_security.xml
+2 -2
View File
@@ -16,7 +16,7 @@
<record id="mail_followers_read_write_own" model="ir.rule">
<field name="name">mail.followers: write its own entries</field>
<field name="model_id" ref="model_mail_followers"/>
<field name="groups" eval="[(4, ref('base.group_user'))]"/>
<field name="groups" eval="[(4, ref('base.group_user')), (4, ref('base.group_portal'))]"/>
<field name="domain_force">[('partner_id', '=', user.partner_id.id)]</field>
<field name="perm_create" eval="False"/>
<field name="perm_unlink" eval="False"/>
@@ -26,7 +26,7 @@
<record id="ir_rule_mail_notifications_group_user" model="ir.rule">
<field name="name">mail.notifications: group_user: write its own entries</field>
<field name="model_id" ref="model_mail_notification"/>
<field name="groups" eval="[(4, ref('base.group_user'))]"/>
<field name="groups" eval="[(4, ref('base.group_user')), (4, ref('base.group_portal'))]"/>
<field name="domain_force">[('res_partner_id', '=', user.partner_id.id)]</field>
<field name="perm_create" eval="False"/>
<field name="perm_unlink" eval="False"/>