From 7ed01a437f63f507b89302bab6bb3f0bcae9c2d5 Mon Sep 17 00:00:00 2001
From: "Touati Djamel (otd)" <otd@odoo.com>
Date: Tue, 10 Aug 2021 12:38:19 +0000
Subject: [PATCH] [FIX] hr_holidays: fix time off allocation access right
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Steps to reproduce the problem:
- Connect as admin
- Create a new employee, e.g: “Employee1” for company “My Company (San Francisco)”
- Create a new time off request for this employee, and select a time off type linked to the company "San Francisco"
- create a user and do not give him access to the company “San Francisco”, e.g: “user1”
- Log in as “user1”
- Go to time off > Managers > Allocations > remove default filter

Problem:
user1 is able to see the time off allocation of “Employee1”, even though he does not have access to My Company San Francisco.

Solution:
Add multi-company rules  for the “hr.leave_allocation” model to display only the time off allocations to which the current user has access

A rule has already been added for "hr.leave" model:
https://github.com/odoo/odoo/blob/0f3281e3b1dc943b81d79d2a8f82fca7b95b8186/addons/hr_holidays/security/hr_holidays_security.xml#L65-L70

opw-2535709

closes odoo/odoo#75211

closes odoo/odoo#75725

X-original-commit: 90ef15043c7d9c35a22dd7f3c10c78774b6e816a
Signed-off-by: Nicolas Lempereur (nle) <nle@odoo.com>
Signed-off-by: Djamel Touati <DjamelTouati@users.noreply.github.com>
---
 addons/hr_holidays/security/hr_holidays_security.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/addons/hr_holidays/security/hr_holidays_security.xml b/addons/hr_holidays/security/hr_holidays_security.xml
index a7ef244d420..30a8adb8e45 100644
--- a/addons/hr_holidays/security/hr_holidays_security.xml
+++ b/addons/hr_holidays/security/hr_holidays_security.xml
@@ -140,7 +140,7 @@
     <record id="hr_leave_allocation_rule_multicompany" model="ir.rule">
         <field name="name">Leave Allocations: multi company global rule</field>
         <field name="model_id" ref="model_hr_leave_allocation"/>
-        <field name="domain_force">['|', ('holiday_status_id.company_id', '=', False), ('holiday_status_id.company_id', 'in', [user.company_id.id])]</field>
+        <field name="domain_force">['|', ('holiday_status_id.company_id', '=', False), ('holiday_status_id.company_id', 'in', company_ids)]</field>
     </record>
 
     <record id="hr_leave_allocation_rule_employee" model="ir.rule">