From 783f246bde86901a68a2d7469fddc39aaedd6fd1 Mon Sep 17 00:00:00 2001
From: Mohammed Shekha <msh@openerp.com>
Date: Tue, 19 Jan 2016 15:19:46 +0530
Subject: [PATCH] [IMP] hr_holidays: user reads only own leaves

In order to avoid all users being able to see leaves from everyone
the record rule is updated so that users see only their own leaves.

Code computing leave on employee record now uses super user to compute
it to ensure the current status of an employee is visible to other
employees.

Dashboard menus is now restricted to group hr_manager.
---
 addons/hr_holidays/hr_holidays.py       | 7 ++++---
 addons/hr_holidays/hr_holidays_view.xml | 2 +-
 addons/hr_holidays/security/ir_rule.xml | 2 +-
 3 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/addons/hr_holidays/hr_holidays.py b/addons/hr_holidays/hr_holidays.py
index bdce2f9de44..7151517512a 100644
--- a/addons/hr_holidays/hr_holidays.py
+++ b/addons/hr_holidays/hr_holidays.py
@@ -16,7 +16,7 @@ from werkzeug import url_encode
 from dateutil.relativedelta import relativedelta
 
 from openerp.exceptions import UserError, AccessError
-from openerp import tools
+from openerp import tools, SUPERUSER_ID
 from openerp.osv import fields, osv
 from openerp.tools.translate import _
 
@@ -592,7 +592,8 @@ class hr_employee(osv.Model):
 
     def _get_leave_status(self, cr, uid, ids, name, args, context=None):
         holidays_obj = self.pool.get('hr.holidays')
-        holidays_id = holidays_obj.search(cr, uid,
+        #Used SUPERUSER_ID to forcefully get status of other user's leave, to bypass record rule
+        holidays_id = holidays_obj.search(cr, SUPERUSER_ID,
            [('employee_id', 'in', ids), ('date_from','<=',time.strftime('%Y-%m-%d %H:%M:%S')),
            ('date_to','>=',time.strftime('%Y-%m-%d %H:%M:%S')),('type','=','remove'),('state','not in',('cancel','refuse'))],
            context=context)
@@ -604,7 +605,7 @@ class hr_employee(osv.Model):
                 'leave_date_from':False,
                 'leave_date_to':False,
             }
-        for holiday in self.pool.get('hr.holidays').browse(cr, uid, holidays_id, context=context):
+        for holiday in self.pool.get('hr.holidays').browse(cr, SUPERUSER_ID, holidays_id, context=context):
             result[holiday.employee_id.id]['leave_date_from'] = holiday.date_from
             result[holiday.employee_id.id]['leave_date_to'] = holiday.date_to
             result[holiday.employee_id.id]['current_leave_state'] = holiday.state
diff --git a/addons/hr_holidays/hr_holidays_view.xml b/addons/hr_holidays/hr_holidays_view.xml
index 14be0557085..c53f46051ec 100644
--- a/addons/hr_holidays/hr_holidays_view.xml
+++ b/addons/hr_holidays/hr_holidays_view.xml
@@ -254,7 +254,7 @@
         </record>
 
         <menuitem name="Leaves" id="menu_hr_holidays_root" sequence="95" web_icon="hr_holidays,static/description/icon.png" groups="base.group_user"/>
-        <menuitem name="Dashboard" id="menu_hr_holidays_dashboard" parent="menu_hr_holidays_root" sequence="1" action="action_hr_holidays_dashboard"/>
+        <menuitem name="Dashboard" id="menu_hr_holidays_dashboard" parent="menu_hr_holidays_root" sequence="1" action="action_hr_holidays_dashboard" groups="base.group_hr_manager"/>
         <menuitem name="My Leaves" id="menu_hr_holidays_my_leaves" parent="menu_hr_holidays_root" sequence="2"/>
         <menuitem name="Leaves to Approve" id="menu_hr_holidays_approvals" parent="menu_hr_holidays_root" sequence="3" groups="base.group_hr_manager,base.group_hr_user"/>
         <menuitem name="Reports" id="menu_hr_holidays_report" parent="menu_hr_holidays_root" sequence="99" groups="base.group_hr_manager,base.group_hr_user"/>
diff --git a/addons/hr_holidays/security/ir_rule.xml b/addons/hr_holidays/security/ir_rule.xml
index 64dad315628..c702617382a 100644
--- a/addons/hr_holidays/security/ir_rule.xml
+++ b/addons/hr_holidays/security/ir_rule.xml
@@ -4,7 +4,7 @@
     <record id="property_rule_holidays_employee" model="ir.rule">
         <field name="name">Employee Holidays</field>
         <field name="model_id" ref="model_hr_holidays"/>
-        <field name="domain_force">['|', ('employee_id.user_id','=',user.id), ('state', '=', 'validate')]</field>
+        <field name="domain_force">[('employee_id.user_id','=',user.id)]</field>
         <field name="perm_create" eval="False"/>
         <field name="perm_write" eval="False"/>
         <field name="perm_unlink" eval="False"/>