[IMP] hr_holidays: user reads only own leaves

In order to avoid all users being able to see leaves from everyone
the record rule is updated so that users see only their own leaves.

Code computing leave on employee record now uses super user to compute
it to ensure the current status of an employee is visible to other
employees.

Dashboard menus is now restricted to group hr_manager.

addons/hr_holidays/hr_holidays.py

@@ -16,7 +16,7 @@ from werkzeug import url_encode
 from dateutil.relativedelta import relativedelta
 
 from openerp.exceptions import UserError, AccessError
-from openerp import tools
+from openerp import tools, SUPERUSER_ID
 from openerp.osv import fields, osv
 from openerp.tools.translate import _
 
@@ -592,7 +592,8 @@ class hr_employee(osv.Model):
 
     def _get_leave_status(self, cr, uid, ids, name, args, context=None):
         holidays_obj = self.pool.get('hr.holidays')
-        holidays_id = holidays_obj.search(cr, uid,
+        #Used SUPERUSER_ID to forcefully get status of other user's leave, to bypass record rule
+        holidays_id = holidays_obj.search(cr, SUPERUSER_ID,
            [('employee_id', 'in', ids), ('date_from','<=',time.strftime('%Y-%m-%d %H:%M:%S')),
            ('date_to','>=',time.strftime('%Y-%m-%d %H:%M:%S')),('type','=','remove'),('state','not in',('cancel','refuse'))],
            context=context)
@@ -604,7 +605,7 @@ class hr_employee(osv.Model):
                 'leave_date_from':False,
                 'leave_date_to':False,
             }
-        for holiday in self.pool.get('hr.holidays').browse(cr, uid, holidays_id, context=context):
+        for holiday in self.pool.get('hr.holidays').browse(cr, SUPERUSER_ID, holidays_id, context=context):
             result[holiday.employee_id.id]['leave_date_from'] = holiday.date_from
             result[holiday.employee_id.id]['leave_date_to'] = holiday.date_to
             result[holiday.employee_id.id]['current_leave_state'] = holiday.state

addons/hr_holidays/hr_holidays_view.xml

@@ -254,7 +254,7 @@
         </record>
 
         <menuitem name="Leaves" id="menu_hr_holidays_root" sequence="95" web_icon="hr_holidays,static/description/icon.png" groups="base.group_user"/>
-        <menuitem name="Dashboard" id="menu_hr_holidays_dashboard" parent="menu_hr_holidays_root" sequence="1" action="action_hr_holidays_dashboard"/>
+        <menuitem name="Dashboard" id="menu_hr_holidays_dashboard" parent="menu_hr_holidays_root" sequence="1" action="action_hr_holidays_dashboard" groups="base.group_hr_manager"/>
         <menuitem name="My Leaves" id="menu_hr_holidays_my_leaves" parent="menu_hr_holidays_root" sequence="2"/>
         <menuitem name="Leaves to Approve" id="menu_hr_holidays_approvals" parent="menu_hr_holidays_root" sequence="3" groups="base.group_hr_manager,base.group_hr_user"/>
         <menuitem name="Reports" id="menu_hr_holidays_report" parent="menu_hr_holidays_root" sequence="99" groups="base.group_hr_manager,base.group_hr_user"/>

addons/hr_holidays/security/ir_rule.xml

@@ -4,7 +4,7 @@
     <record id="property_rule_holidays_employee" model="ir.rule">
         <field name="name">Employee Holidays</field>
         <field name="model_id" ref="model_hr_holidays"/>
-        <field name="domain_force">['|', ('employee_id.user_id','=',user.id), ('state', '=', 'validate')]</field>
+        <field name="domain_force">[('employee_id.user_id','=',user.id)]</field>
         <field name="perm_create" eval="False"/>
         <field name="perm_write" eval="False"/>
         <field name="perm_unlink" eval="False"/>