From 7fd7422647cc125e64cd3e82a55e31ede4c92919 Mon Sep 17 00:00:00 2001
From: Goffin Simon <sig@odoo.com>
Date: Mon, 29 Jun 2020 12:31:43 +0000
Subject: [PATCH] [FIX] hr_attendance: All internal can modifiy hr.attendance

Steps to reproduce:

- Let's consider a user U with no access to hr.attendance
- Let's consider that U has made some check in and check out
- Log with U
- Go to your profile and on Last month

Bug:

U can modifiy manually his attendances.

opw:2279682

closes odoo/odoo#53878

X-original-commit: 53a4a95270622f3aa08136470fb627d51ed4b365
Signed-off-by: Simon Goffin (sig) <sig@openerp.com>
---
 .../views/hr_attendance_view.xml              | 29 +++++++++++++++++--
 1 file changed, 27 insertions(+), 2 deletions(-)

diff --git a/addons/hr_attendance/views/hr_attendance_view.xml b/addons/hr_attendance/views/hr_attendance_view.xml
index adf2ca3e4cd..feada7164d6 100644
--- a/addons/hr_attendance/views/hr_attendance_view.xml
+++ b/addons/hr_attendance/views/hr_attendance_view.xml
@@ -7,7 +7,7 @@
         <field name="name">hr.attendance.tree</field>
         <field name="model">hr.attendance</field>
         <field name="arch" type="xml">
-            <tree string="Employee attendances" editable="bottom" sample="1">
+            <tree string="Employee attendances" edit="0" sample="1">
                 <field name="employee_id"/>
                 <field name="check_in"/>
                 <field name="check_out"/>
@@ -16,6 +16,19 @@
         </field>
     </record>
 
+    <record id="view_attendance_tree_inherit" model="ir.ui.view">
+        <field name="name">hr.attendance.tree.inherit</field>
+        <field name="model">hr.attendance</field>
+        <field name="inherit_id" ref="hr_attendance.view_attendance_tree"/>
+        <field name="groups_id" eval="[(4, ref('hr_attendance.group_hr_attendance_user'))]"/>
+        <field name="arch" type="xml">
+            <tree position="attributes">
+                <attribute name="edit">1</attribute>
+                <attribute name="editable">bottom</attribute>
+            </tree>
+        </field>
+    </record>
+
     <record id="view_hr_attendance_kanban" model="ir.ui.view">
         <field name="name">hr.attendance.kanban</field>
         <field name="model">hr.attendance</field>
@@ -50,7 +63,7 @@
         <field name="name">hr.attendance.form</field>
         <field name="model">hr.attendance</field>
         <field name="arch" type="xml">
-            <form string="Employee attendances">
+            <form string="Employee attendances" edit="0">
                 <sheet>
                     <group>
                         <field name="employee_id"/>
@@ -62,6 +75,18 @@
         </field>
     </record>
 
+    <record id="hr_attendance_view_form_inherit" model="ir.ui.view">
+        <field name="name">hr.attendance.form.inherit</field>
+        <field name="model">hr.attendance</field>
+        <field name="inherit_id" ref="hr_attendance.hr_attendance_view_form"/>
+        <field name="groups_id" eval="[(4, ref('hr_attendance.group_hr_attendance_user'))]"/>
+        <field name="arch" type="xml">
+            <form position="attributes">
+                <attribute name="edit">1</attribute>
+            </form>
+        </field>
+    </record>
+
     <record id="hr_attendance_view_filter" model="ir.ui.view">
         <field name="name">hr_attendance_view_filter</field>
         <field name="model">hr.attendance</field>