From 6e2a455947ef73d21bf99cd369f7fc887d3e89d7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Thibault=20Delavall=C3=A9e?= <tde@odoo.com>
Date: Wed, 14 Sep 2016 16:42:35 +0200
Subject: [PATCH] [FIX] mail: restrict write access rights of portal users to
 their own follower and notification entries

---
 addons/mail/security/mail_security.xml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/addons/mail/security/mail_security.xml b/addons/mail/security/mail_security.xml
index 65495db6925..d5a5b5422c9 100644
--- a/addons/mail/security/mail_security.xml
+++ b/addons/mail/security/mail_security.xml
@@ -16,7 +16,7 @@
         <record id="mail_followers_read_write_own" model="ir.rule">
             <field name="name">mail.followers: write its own entries</field>
             <field name="model_id" ref="model_mail_followers"/>
-            <field name="groups" eval="[(4, ref('base.group_user'))]"/>
+            <field name="groups" eval="[(4, ref('base.group_user')), (4, ref('base.group_portal'))]"/>
             <field name="domain_force">[('partner_id', '=', user.partner_id.id)]</field>
             <field name="perm_create" eval="False"/>
             <field name="perm_unlink" eval="False"/>
@@ -26,7 +26,7 @@
         <record id="ir_rule_mail_notifications_group_user" model="ir.rule">
             <field name="name">mail.notifications: group_user: write its own entries</field>
             <field name="model_id" ref="model_mail_notification"/>
-            <field name="groups" eval="[(4, ref('base.group_user'))]"/>
+            <field name="groups" eval="[(4, ref('base.group_user')), (4, ref('base.group_portal'))]"/>
             <field name="domain_force">[('res_partner_id', '=', user.partner_id.id)]</field>
             <field name="perm_create" eval="False"/>
             <field name="perm_unlink" eval="False"/>